Browse public community intelligence reports, source analysis, and threat research.
19 intel reports
The Yoba campaign utilizes SEO-poisoned GitHub repositories and fake AI desktop applications to distribute a custom loader that delivers XMRig miners via DLL sideloading.
Adversaries, including activity sharing infrastructure history with APT29, are exploiting CVE-2026-42589 in Gotenberg to deploy the 'cache_base' Go-based reverse shell and a broader toolkit.
The Poper Blocker browser extension by dingosolutions acts as spyware by using a custom remote interpreter to exfiltrate browsing history, AI chat logs, and screenshots.
Koktevrat is a multi-stage Android RAT distributed via a fake Polish government application named MandatGO that utilizes Accessibility Services and Firebase for full device control.
DPRK-nexus actors, likely Sapphire Sleet, leveraged malicious Rust packages on crates.io to deploy Rustbot, a macOS RAT targeting cloud credentials and cryptocurrency wallets.
Sapphire Sleet (DPRK) compromised popular Rust crates including arrayref and append-only-vec by injecting a malicious typosquatted dependency, proc-macro1, to execute a second-stage backdoor at build time.
A ransomware-related threat actor is deploying MLTBackdoor, a sophisticated malware using ClickFix lures and BOF loading capabilities for post-exploitation.
APT42 (suspected Iran-linked) is utilizing AI-assisted phishing and the SpearSpecter campaign to deliver an evolved modular TAMECAT backdoor targeting defense and nuclear energy sectors.
Tengu is an evolved Mirai-derived IoT botnet featuring AEAD-encrypted C2, proxy capabilities, and aggressive self-defense mechanisms targeting Linux and Android systems.
The TuxBot v3 Evolution framework is a modular IoT botnet targeting multiple architectures using LLM-assisted code generation and diverse C2 fallback mechanisms.
