Browse public community intelligence reports, source analysis, and threat research.
1,186 intel reports
Cavern Manticore, an Iran-nexus threat actor, targets Israeli government and IT sectors using a modular .NET C2 framework employing complex compilation formats as anti-analysis layers.
Adversaries leverage automated tools and weak server-side authorization to exploit Web APIs through BOLA, JWT tampering, and SSRF techniques.
The REF6045 activity cluster uses ClickFix social engineering to deploy SCMBANKER, a PowerShell toolkit designed for banking fraud targeting Mexican financial institutions.
UNC1549, an Iranian-linked APT, targets global aerospace and defense sectors using fake career portals to deliver custom malware including MiniJunk and MiniBrowse.
Offensive researchers are using large language models to automate the reverse engineering of EDR products, extracting static YARA rules, behavioral logic, and ML model classifiers to facilitate bypasses.
Kimsuky (APT43) utilizes a multi-stage CHM-based execution chain to profile systems and selectively deliver follow-on PowerShell payloads to targeted hosts.
Adversaries are registering nonexistent domains hallucinated by LLMs to intercept traffic and deploy phishing kits like Montana Empire.
UAC-0226 is utilizing WinRAR path traversal (CVE-2025-8088) with NTFS Alternate Data Streams to deploy the GIFTEDCROOK stealer via a multi-stage PowerShell and reflective loading chain.
Void Dokkaebi targets software developers by injecting obfuscated JavaScript malware into configuration files like tailwind.config.js to establish command-and-control via blockchain APIs.
A high-ca pability . NET-based infosteale r targetin g multiple browsers, Discord t okens, an d system f ingerprint s while by passing Ch rome App-B ound Encry ption via DLL inject ion.
