Browse public community intelligence reports, source analysis, and threat research.
25 intel reports
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
The Lazarus Group is targeting South Korean sectors by exploiting mandatory financial security software to deploy a sophisticated malware framework featuring post-quantum encryption.
UNC7017 conducted ephemeral supply chain tampering against AOMEI Technology update servers to deliver CROSSROAD and SHINYROAD malware via short-burst configuration modifications.
The Brazilian threat actor Exilware utilizes the BraZetsu framework and Hestia Control Panel infrastructure to operate an initial access marketplace targeting Latin American organizations.
A variant of SectopRAT uses a multi-stage loader and tampered legitimate DLLs to exfiltrate credentials and control systems via encrypted C2 communication.
The SideCopy APT is targeting Indian academic institutions using weaponized LNK files and mshta.exe to deploy ReverseRAT via fileless .NET deserialization.
Transparent Tribe (APT-C-56) utilizes ISO/ZIP-based lure files and LNK execution chains to deploy CrimsonRAT and a custom Golang-based remote access trojan against Indian and South Asian targets.
The REF9334 threat group utilizes the KREMLIN toolkit to install malicious browser extensions on Chrome and Edge, leveraging Ethereum smart contracts as dead-drop resolvers to target Brazilian banking users.
KATARU is a newly observed IoT malware family that utilizes Linux local privilege escalation exploits and encrypted C2 to conduct DDoS attacks.
UNC3569 is exploiting a one-click RCE vulnerability (CVE-2026-51990) in Sogou Input Method to deploy the GRAYRABBIT backdoor using a chained attack involving protocol handler injection and an outdated Chromium engine.
