Browse public community intelligence reports, source analysis, and threat research.
17 intel reports
Russian-speaking threat actor UAT-11795 is utilizing ClickFix lures and trojanized software to deploy novel Python-based Starland RAT and PowerShell-based WLDR agent for cryptocurrency theft.
Cavern Manticore, an Iran-nexus threat actor, targets Israeli government and IT sectors using a modular .NET C2 framework employing complex compilation formats as anti-analysis layers.
A customized variant of DcRAT named BeepRAT is being distributed via a Chinese phone number management utility, targeting telecommunications providers with an extensive C2 command framework.
The 'Adblock for YouTube' Chrome extension uses excessive permissions and a remote-controlled injection architecture that could be weaponized for arbitrary code execution on any website.
An active phishing campaign targets hospitality organizations in Europe and Asia using photo-themed ZIP files to deliver a Node.js-based implant called TonRAT.
BlackSuit affiliates use Microsoft Teams vishing and email bombing to deploy Nimbus RAT, a Java-based malware abusing Google Drive for C2.
The PowMix botnet targets Czech organizations using compliance-themed phishing lures and sophisticated PowerShell-based in-memory execution.
