Browse public community intelligence reports, source analysis, and threat research.
6 intel reports
The SideCopy APT is targeting Indian academic institutions using weaponized LNK files and mshta.exe to deploy ReverseRAT via fileless .NET deserialization.
China-linked threat actor OP-512 is targeting Windows IIS servers with a custom ASPX/ASHX web shell framework and memory-only privilege escalation tools.
A massive SEO-driven campaign uses over 90 localized domains to distribute malicious software archives that deploy ScreenConnect as a persistent backdoor for AsyncRAT infections.
The HellCat ransomware group is increasingly exploiting Jira credentials harvested by infostealers like StealC and Amadey to facilitate corporate breaches and data exfiltration.
The Weedhack Malware-as-a-Service (MaaS) campaign targets Minecraft players with custom JAR files that deploy multi-stage infostealers and RATs using Ethereum-based C2 infrastructure.
APT29 utilizes a multi-stage execution chain involving screensaver droppers, steganography-embedded payloads, and extensive memory manipulation to harvest credentials and move laterally.
