Browse public community intelligence reports, source analysis, and threat research.
35 intel reports
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
UNC7017 conducted ephemeral supply chain tampering against AOMEI Technology update servers to deliver CROSSROAD and SHINYROAD malware via short-burst configuration modifications.
The Iranian state-aligned actor CL-STA-1178 is conducting the 'Blinder Tunnel' campaign targeting Iraqi critical infrastructure using trojanized coding challenges and living-off-the-cloud TTPs.
The CSuite operation targets US and European organizations using sophisticated phishing lures to steal Microsoft 365 sessions and deploy legitimate RMM tools like ScreenConnect for persistent endpoint access.
China-linked threat actor Storm-3069 uses NeedyMantis, a modular post-compromise framework, to maintain long-term access via DLL sideloading and custom encrypted archives.
Water Hydra (EvilNum) has transitioned from complex zero-day exploits to social engineering-driven campaigns using .PIF files and non-standard protocol handlers to deliver the DarkMe RAT.
The Rapuncel infostealer is distributed via SEO-optimized fake GitHub organizations, utilizing a Microsoft-signed kernel driver to disable security software.
Threat actors are utilizing a Black Basta-style playbook involving email bombing and Microsoft Teams vishing to deliver Xray-core implants via DLL sideloading.
A variant of SectopRAT uses a multi-stage loader and tampered legitimate DLLs to exfiltrate credentials and control systems via encrypted C2 communication.
Chinese threat actors UTA0560 and JungleBamboo exploited a 'patch-gap' zero-day chain in Chrome and Windows to deploy the GRIMWEDGE backdoor and LONGTALE credential stealer.
