Browse public community intelligence reports, source analysis, and threat research.
81 intel reports
Chinese threat actors UTA0560 and JungleBamboo exploited a 'patch-gap' zero-day chain in Chrome and Windows to deploy the GRIMWEDGE backdoor and LONGTALE credential stealer.
The Iranopasmigirim campaign by an Iran-linked actor uses DLL sideloading to deploy ParsaStealer, a Rust-based infostealer targeting dissidents via lures mimicking the Rise Iran movement.
The SideCopy APT is targeting Indian academic institutions using weaponized LNK files and mshta.exe to deploy ReverseRAT via fileless .NET deserialization.
The ClickFix campaign compromised a regional news outlet using malicious JavaScript to deliver social engineering prompts that lead to the execution of an encrypted .NET infostealer.
An unidentified ransomware-related threat actor is using SloppyRAT, a new multi-stage malware, to establish network footholds via ClickFix lures and blockchain-based C2 resolution.
Suspected North Korean threat actors are using 13 malicious npm packages to deliver WeaselBiscuit, a lightweight stealer targeting Chrome extension storage and system metadata.
Kimsuky (APT-C-55) utilizes multi-stage PowerShell and C# malware delivered via disguised installers to target South Korean institutions for intelligence theft.
MovieReaper uses compromised torrent repositories and the Solana blockchain to deploy a multi-stage modular framework targeting diverse global sectors.
LausivLoader utilizes a multi-stage infection chain involving JavaScript, PowerShell, and .NET, leveraging environment variable inheritance for inter-process data handoff and steganography to deliver final payloads.
China-aligned actor FamousSparrow is targeting Latin American governments with SparroWocky, a sophisticated C++ backdoor featuring advanced anti-analysis and modular execution capabilities.
