Browse public community intelligence reports, source analysis, and threat research.
81 intel reports
Russia-aligned actors Earth Dahu and SHADOW-EARTH-066 are exploiting a WinRAR path traversal vulnerability to deploy GIFTEDCROOK and espionage modules against Ukrainian organizations.
The Chaos ransomware group is using a new Rust-based RAT called msaRAT that establishes covert C2 channels by hijacking headless Chrome and Edge browsers via the Chrome DevTools Protocol.
Stealth Falcon utilized an LLM-accelerated WebDAV delivery lab to deploy PureRAT via working directory hijacking and DLL sideloading targeting Mexican enterprise users.
TELEPUZ is a full-featured modular malware spreading through CLICKFIX social engineering and VIDAR stealer, featuring advanced evasion and dead-drop resolver techniques.
The threat actor Hyadina has rebranded Beast ransomware as GodDamn, utilizing the malicious PoisonX kernel driver to disable endpoint defenses via BYOVD attacks.
UAT-7810, a China-nexus infrastructure specialist, builds Operational Relay Box (ORB) networks targeting SOHO and enterprise systems using the LEASH malware family for secondary espionage actors.
Silver Fox (UTG-Q-1000) distributors are deploying MODBEACON, a modular Rust-based implant using gRPC over HTTP/2 for C2 communication, targeting technology, education, and state-owned enterprises.
A China-nexus threat actor is targeting Indian taxpayers and government infrastructure using a multi-stage infection chain to deploy DcRAT via fake tax utility lures.
The Veil#Drop framework utilizes a multi-stage infection chain involving JavaScript launchers and PowerShell cradles hosted on Blogspot to deploy PureLog Stealer in memory.
A threat actor compromised a Mastra maintainer account to poison 140+ npm packages with a malicious dependency used for cross-platform backdoors and credential exfiltration.
