Browse public community intelligence reports, source analysis, and threat research.
81 intel reports
Threat actors are utilizing VHDX disk images to deliver Remcos RAT through a multi-stage process involving WMI execution and reflective .NET loading to bypass security controls.
Suspected Lazarus Group (DPRK) operators are using malicious VS Code extensions like jupyter-powerdev to deliver a multi-stage backdoor utilizing SharePoint for C2 and Roslyn for in-memory execution.
A threat actor operating as Leda Elacoate is conducting a supply chain campaign using trojanized installers for crypto-trading and VPN software to deploy the STX RAT infostealer via DLL sideloading.
Mustang Panda APT utilizes a multi-stage PlugX execution chain involving legitimate G DATA binaries and complex obfuscation to target systems via fake browser updates.
RemusStealer and the SessionGate framework are distributed through a complex ecosystem of impersonation websites and gated Traffic Distribution Systems (TDS) targeting technical users.
The BoldTealLayer campaign utilizes a sophisticated Lua-driven loader to execute fileless .NET payloads by bypassing AMSI and disabling ETW monitoring.
DesckVB RAT operators utilize a multi-stage infection chain starting with malspam and legitimate domain redirection to deploy an in-memory .NET Trojan.
SilentCryptoMiner and XMRig variants are being distributed through pirated movie and digital library sites using fake video player updates and DLL side-loading.
JS.MonoGlyphRAT is a persistent JScript backdoor targeting US technology, MSSP, and telecom sectors using monoglyph-obfuscated scripts and encrypted PowerShell stagers.
Threat actor UNG0002 is targeting Chinese universities using spear-phishing lures related to national fitness standards to deliver Cobalt Strike via DLL side-loading.
