Browse public community intelligence reports, source analysis, and threat research.
17 intel reports
A North Korean-linked operation targeted the npm registry using the GHAPPIER loader to establish persistence and remote access via compromised developer credentials.
Adversary Pursuit Group identified ChainScript, a Node.js RAT that utilizes Polygon smart contracts for resilient C2 infrastructure rotation and delivery via ClickFix lures.
The Hagaseca cluster uses THost9, a multi-stage Android RAT and ADB worm that leverages accessibility services and exposed ADB ports to infect physical and containerized Android environments.
DPRK-linked actors (Kimsuky, APT37, Lazarus) are using the Ted backdoor and CurlRAT framework to target South Korean media and automotive sectors for long-term espionage and watering-hole attacks.
Funnull-linked threat actors exploited a Sub-Store zero-day through poisoned CDN dependencies to deliver multi-platform malware including ProRAM, RingH23, and iOS exploit kits.
ChainDrop, a descendant of the Shai-Hulud malware family, is a self-propagating npm worm targeting developer workstations and CI/CD pipelines to harvest cloud, registry, and AI tool credentials.
Sapphire Sleet (DPRK) compromised popular Rust crates including arrayref and append-only-vec by injecting a malicious typosquatted dependency, proc-macro1, to execute a second-stage backdoor at build time.
pyCodeV3 is a multi-stage Python loader using dynamic domain generation and pickle deserialization to execute arbitrary code from C2 servers.
The Miasma v3 malware is currently targeting AsyncAPI npm packages via a compromised GitHub Actions release workflow to deliver a persistent Node.js remote access trojan.
Russian-speaking actor UAT-11795 is targeting US and European users with trojanized installers for MobaXterm, WebEx, and Zoom to deploy the novel Starland RAT and WLDR PowerShell agent.
