Browse public community intelligence reports, source analysis, and threat research.
131 intel reports
A low-privileged user can coerce the Windows Store Install Service (SYSTEM) to perform NTLM authentication or execute arbitrary DLLs via UNC-located loose-file package registration.
Rapid Brigantine has pivoted to ClickFix lures on compromised WordPress sites to deploy the Lorem Ipsum Loader following a disruption to their previous malware-signing infrastructure.
Dropping Elephant is using a China-themed decoy document to deliver a heavily reworked, in-memory RAT via DLL side-loading and Donut shellcode.
Financially motivated actors like Vanilla Tempest are leveraging ClickFix social engineering to deliver modular loaders including BabaDeda, Lorem Ipsum, and Potemkin, ultimately deploying ransomware like Rhysida.
OceanLotus (APT32) is leveraging SPECTRALVIPER in targeted supply-chain attacks against Vietnamese stock investors and infrastructure corporations to support domestic surveillance.
LegionLoader uses a multi-stage infection chain involving MSI files, DLL sideloading, and Python-based components to achieve stealthy execution and C2 communication.
A threat actor operating as Leda Elacoate is conducting a supply chain campaign using trojanized installers for crypto-trading and VPN software to deploy the STX RAT infostealer via DLL sideloading.
Mustang Panda APT utilizes a multi-stage PlugX execution chain involving legitimate G DATA binaries and complex obfuscation to target systems via fake browser updates.
The Silver Fox threat actor targets Japanese and Chinese organizations using spear-phishing to deploy the modular 10FXRAT and the PoisonX kernel driver for security product bypass.
The suspected Chinese threat actor TA4922 is expanding globally, utilizing new loaders like RomulusLoader and SilentRunLoader alongside Atlas RAT to target organizations in Asia and Europe.
