Browse public community intelligence reports, source analysis, and threat research.
8 intel reports
MovieReaper uses compromised torrent repositories and the Solana blockchain to deploy a multi-stage modular framework targeting diverse global sectors.
The China-linked hacking group QTFY (associated with Nanjing Xinjiuwei Network Technology) utilizes the QScan and QTRouter distributed systems to exploit IoT devices and target critical infrastructure globally.
An unidentified threat actor is conducting a global phishing campaign using Vercel-hosted lures to deliver legitimate, signed RMM tools for remote system access.
The Pluto Hephaestus threat actor utilizes the AI-powered 'Hephaestus' framework to automate the full attack lifecycle against government and educational targets in Southeast Asia and South Korea.
Threat actors are utilizing AI-enhanced text salting techniques to inject hidden benign content into phishing emails, successfully misguiding AI-powered security filters and LLM-based detection systems.
Threat actors compromised an Artlist subdomain using stolen credentials to deploy a ClickFix campaign that uses blockchain-based EtherHiding for evasion and delivers a multi-stage RAT.
State-sponsored and cybercriminal actors are utilizing ClickFix Payload-as-a-Service (CPaaS) to deliver dynamically obfuscated malware via fake CAPTCHA social engineering and stealthy clipboard injection.
Threat actor link99 systematically exploits abandoned Azure and DigitalOcean DNS zone delegations to host Thai gambling platforms under the authority of over 160 enterprise and government domains.
