Browse public community intelligence reports, source analysis, and threat research.
131 intel reports
The ROMULUS delivery platform utilizes ClickFix lures and social engineering to distribute diverse payloads including LegionLoader, Atlas RAT, and RomulusLoader targeting global organizations.
Threat actors including Stardust Chollima and Sandworm are utilizing 'Browser Cache Smuggling' to deliver malware like Vidar Stealer and GeniexRAT by pre-fetching payloads into browser caches to bypass security scans and character limits.
The Yoba campaign utilizes SEO-poisoned GitHub repositories and fake AI desktop applications to distribute a custom loader that delivers XMRig miners via DLL sideloading.
VulcanRAT207.B leverages RomulusLoader and signed VulkanInfo binaries to establish persistent remote access and kernel-level evasion on Windows systems.
The AnyDesk TAG campaign uses cloned banking support sites and telephone-led social engineering to deploy AnyDesk and persistent ScreenConnect instances via malicious signed payloads and DLL side-loading.
The threat actor UNG0002 is targeting academic institutions using macOS-style metadata folder structures to evade Windows security scanners and deliver Cobalt Strike via DLL sideloading.
The Lazarus Group is targeting South Korean sectors by exploiting mandatory financial security software to deploy a sophisticated malware framework featuring post-quantum encryption.
UNC7017 conducted ephemeral supply chain tampering against AOMEI Technology update servers to deliver CROSSROAD and SHINYROAD malware via short-burst configuration modifications.
Threat actors associated with Vice Society are utilizing ClickFix social engineering to deploy Lorem Ipsum Loader and Python-based tunnels for network access.
China-linked APT41 (FishMonger) is using BlackX, a UEFI bootkit evolved from BlackLotus, to bypass Secure Boot and maintain persistence on diplomatic targets in Central Asia.
