Browse public community intelligence reports, source analysis, and threat research.
30 intel reports
The TuxBot v3 Evolution framework is a modular IoT botnet targeting multiple architectures using LLM-assisted code generation and diverse C2 fallback mechanisms.
The ModHeader browser extension (v7.0.17) exfiltrates user browsing history to a covert C2 domain using encrypted IndexedDB storage and randomized upload schedules.
The GoSerpent campaign utilizes a sophisticated suite of Go-based backdoors and specialized loaders to collect and exfiltrate sensitive data from government and diplomatic entities in Southeast Asia.
CrashStealer is a native C++ macOS information stealer that impersonates Apple crash-reporting tools and uses notarized droppers to harvest credentials, keychain data, and crypto wallets.
PamStealer is a macOS infostealer that validates captured credentials using the PAM API and uses a two-stage JXA/Rust delivery chain to evade detection.
Remcos RAT is a sophisticated Windows remote access trojan used by actors like APT33 and UAC-0050 for extensive surveillance, credential theft, and full system control.
Dropping Elephant is using a China-themed decoy document to deliver a heavily reworked, in-memory RAT via DLL side-loading and Donut shellcode.
The IRGC-affiliated Cyber Isnaad Front (ASA) is conducting destructive wiper and OT sabotage operations against Israeli critical infrastructure sectors.
MiniRAT is a Go-based macOS remote access trojan delivered via the compromised velora-dex-sdk npm package, utilizing LaunchAgent persistence and AES-encrypted C2 configurations.
Lazarus Group utilizes a macOS 1st-stage loader named unioncryptoupdater to execute 2nd-stage payloads directly from memory using repurposed open-source code.
