APT & Nation-State Intelligence
Advanced Persistent Threat intelligence tracking nation-state actors — Lazarus Group, Sandworm, Volt Typhoon, and others. Campaign TTPs, targeted sectors, and SIGMA/KQL detection rules.
APT & Nation-State — Archive & Latest
DragonForce Ransomware Cartel, Noodle RAT Espionage Cluster + ScreenConnect Invitation Lures: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses expose DragonForce's ransomware cartel expansion, Chinese-speaking actors deploying Noodle RAT across APAC, and ScreenConnect RAT delivery via fake event invites. High urgency for enterprise SOC teams.
KREMLIN Banking Extension, SysGoRAT Espionage & ARMORY CASTLE BeyondTrust Zero-Day: OTX Pulse Analysis — Enterprise Detection Pack
Three active campaigns: REF9334 KREMLIN banking malware targets Brazil, CL-UNK-1211 AI-built SysGoRAT hits government Linux, ARMORY CASTLE exploits BeyondTrust CVE-2026-102764 zero-day.
Iron Man System + YamStore PhaaS: OTX Pulse Analysis — Global Postal, Bank and Government Lure Infrastructure
OTX: Iron Man System/YamStore PhaaS sells postal, bank and gov lure kits to Chinese-speaking buyers; finance, health, telecom and retail should hunt IOCs now.
Iron Man & CoGUI PhaaS Ecosystem: Chinese-Language Phishing Kit Disruption — OTX Pulse Analysis & Enterprise Detection Pack
OTX pulses expose the Iron Man/YamStore PhaaS ecosystem and CoGUI/CoAceV/CoFish_Ws kits hitting finance, government, and Japanese enterprises. High urgency: hunt and block now.
Calendly Meta Phishing Kit + Candiru AdFection + CoGUI/CoAceV/CoFish Disruption: OTX Enterprise Detection Pack
OTX: fake Calendly Meta interviews steal Facebook/Google creds; Candiru AdFection zero-click ads; CoGUI/CoAceV/CoFish kits hit Japan. Hunt now.
Storm-2561 Fake WatchGuard VPN SEO Poisoning: Signed Installer Trust Abuse + Credential Harvest — OTX Detection Pack
Storm-2561 SEO-poisoned fake WatchGuard VPN pages steal creds twice, then drop a genuine signed client. Block lookalike domains; verify VPN logins now.
Log4Shell-Linked Malicious Domains Behind CDN Infrastructure: OTX Pulse Analysis of Shared-IP C2 & Precision Blocking — Enterprise Detection Pack
OTX pulse flags malicious domains moonlighthathel[.]org and ukankingwithea[.]com hidden behind shared CloudFront IPs; 15 hosts affected. Precision DNS triage and Log4Shell exposure checks urged.
VulcanRAT207.A + Kimsuky 'GitPower': OTX Pulse Analysis — WhatsApp-Delivered RAT Chains & Nation-State Espionage Detection Pack
OTX pulses expose TA4922's WhatsApp-delivered VulcanRAT207.A SYSTEM-escalation chain and Kimsuky's GitPower spear-phishing op against Ukrainian diplomats. High urgency.
JeetBot Twitch Extension OAuth Token Theft: OTX Pulse Analysis — Enterprise Detection Pack
Malicious 'JeetBot' Twitch extension stole OAuth tokens from ~30.5k users, sending sessions to Russian-linked proxies; revoke tokens and block jeetbot.cc now.
Google Trust-Proxy Phishing Chain + ScreenConnect Follow-On: OTX Detection Pack for Credential Harvesting
OTX: global phishing abuses six Google services as trusted redirects to harvest credentials across manufacturing, government, finance and NGOs; ScreenConnect flagged as possible follow-on.
Melofee Linux Implant Resurfaces: APT41 Toolset Evolution with Reptile Kernel Rootkit — OTX Detection & Hunting Pack
OTX pulse reveals APT41's Melofee Linux implant evolved with modular hot-loadable components and Reptile-based kernel rootkit. High urgency for Linux server fleets.
GRIMWEDGE & SUPERSTOMP 0-Day Chain: UTA0560 and JungleBamboo Exploit CVE-2026-85880 in NGO Targeting Campaign
Two Chinese threat actors chain unpatched Chrome/Windows 0-days (CVE-2026-85046/85880/87491) to deploy GRIMWEDGE, SUPERSTOMP, and LONGTALE against U.S. NGOs. Urgent patch-gap risk.
EtherRAT & TONResolver: Blockchain-Based C2 Campaign Targets Hospitality Sector — OTX Detection Pack
URGENT: Phishing campaign hits hotels with fake guest complaints delivering EtherRAT & TONResolver RATs using Ethereum/TON blockchain C2. Detect & block now.
TraderTraitor Terraform Supply-Chain Campaign, Blockchain-C2 Hotel Intrusion Wave & Flax Typhoon Disruption: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal TraderTraitor trojanized Terraform providers dropping FLATROOF/ROOFDECK, blockchain-C2 RATs targeting hospitality, and FBI disruption of Flax Typhoon tooling. Hunt now.
'Raabby WaIIet' Malicious Firefox Extension Campaign: Cryptocurrency Seed Phrase Theft via Cloudflare Workers C2 — OTX Detection Pack
16 malicious Firefox extensions cloning Rabby and OKX wallets steal recovery phrases and private keys, exfiltrating via Cloudflare Workers. High urgency for Web3-exposed orgs.
ClearFake WebDAV Chain Delivers Amatera Stealer + Malicious Firefox Wallet Extensions: OTX Pulse Analysis — Enterprise Detection Pack
UAT-10820 ClearFake/WebDAV chain drops Amatera stealer, ZigCryptoStealer & NetSupport RAT; 16 rogue Firefox extensions steal crypto wallet keys. Urgent action required.
Fake AI Ads BitB Phishing Platform + Akira Ransomware RDP Intrusion: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses expose a Browser-in-the-Browser phishing platform impersonating AI ad products and an Akira ransomware intrusion via RDP with Rclone exfil. High urgency.
BraZetsu IAB Framework, Psychedelic Stealer ClickFix Chain & GlassWorm VS Code Supply Chain: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses expose a Python-based IAB marketplace framework, a ClickFix CAPTCHA stealer hitting Ukraine, and malicious VS Code themes. Detection pack inside. Urgent.
Contagious Interview + OtterCookie: DPRK Trojanized macOS Installers Expand Beyond Developer Workflows — OTX Pulse Detection Pack
DPRK's Contagious Interview campaign ships 14 trojanized macOS DMG/PKG apps (The Unarchiver, Sketch, Bartender) dropping OtterCookie. Critical for macOS fleets.
Woodgnat Node.js Loader Campaign + PaperCut MF Zero-Day AdaptixC2 Intrusions: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal Node.exe LOLBin abuse delivering ModeloRAT/EtherRAT/AdaptixC2 via ClickFix, plus PaperCut MF zero-day exploitation. Finance, Gov, Tech, Education targeted. Hunt now.
Kimsuky XenoRAT, Longlegs Warlock Ransomware & Municipal Webshell Campaigns: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal Kimsuky XenoRAT spear-phishing against South Korea, Longlegs Warlock ransomware via SharePoint ToolShell, and webshell intrusions on municipal platforms. High urgency.
UAT-11587 'Antino' Rust Backdoor Campaign: China-Nexus APT Targeting Asian Governments via M365 C2 — OTX Detection Pack
China-nexus UAT-11587 hits government and policy orgs across 8 Asian nations with the Rust-compiled Antino backdoor using DLL sideloading and Microsoft 365 C2. HIGH urgency.
ClickFix Social Engineering Delivers Lumma Stealer & SectopRAT; Void Arachne's ValleyRAT Hides in QN Wallpaper Adware — OTX Pulse Detection Pack
OTX pulses confirm active ClickFix campaigns abusing ChatGPT Custom GPTs to drop Lumma/SectopRAT/AMOS, and Void Arachne spreading ValleyRAT via fake QN Wallpaper adware. Hunt now.
ShinyHunters (UNC6240) Mass Exploitation of Oracle PeopleSoft CVE-2026-35273: SIDEEYE Backdoor, Neo-reGeorg Tunnels & MeshAgent — OTX Detection Pack
UNC6240/ShinyHunters is mass-exploiting CVE-2026-35273 in Oracle PeopleSoft via WAF-bypass URL encoding, dropping SIDEEYE, Neo-reGeorg and MeshAgent. Patch and hunt now.
Lunex Stealer BYOVD Chain + AdaptixC2 'Operation Master' + ShinyHunters PeopleSoft Mass Exploitation: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal three concurrent threats: Lunex Stealer via BYOVD targeting Ukrainian users, AdaptixC2 GlobalProtect exploitation, and ShinyHunters mass exploitation of Oracle PeopleSoft. Act now.
APT-C-36 GitHub Loader: AsyncRAT/DcRat/Remcos/XWorm Colombia Phishing — OTX Detection Pack
APT-C-36/Blind Eagle-linked GitHub loader pushes AsyncRAT, DcRat, Remcos and XWorm via Colombian juridical phishing; hunt and block now.
SNOWLIGHT Go Loader + VShell RAT: Fake Academic Resume Lure Targeting China's Defense-Tech Pipeline — OTX Pulse Detection Pack
OTX pulse: Chinese-language fake-resume executable delivers SNOWLIGHT stager and VShell RAT via fileless Go loader with sandbox evasion, targeting academic users.
Moobot/Mirai Botnet Resurgence: Open Directory Exposure of 'StresD Pro+' DDoS-as-a-Service Panel — OTX Pulse Analysis & Detection Pack
OTX pulse reveals exposed Moobot source code and active 'StresD Pro+' DDoS panel post-2024 takedown. IoT botnet ops tied to China-linked infrastructure. High urgency.
Salt Typhoon / Fire Ant TACACS+ Pre-Auth RCE (CVE-2026-48842): OTX Pulse Analysis — Telecom Infrastructure Detection Pack
OTX flags critical pre-auth RCE in TACACS+ (CVE-2026-48842) tied to Salt Typhoon/Fire Ant telecom espionage. Pre-authentication exploitation of network AAA. URGENT.
ClickFix Clipboard Poisoning via third-party.com, Galago Ransomware Emergence, and TACACS+ Pre-Auth RCE: OTX Pulse Analysis — Enterprise Detection Pack
ClickFix lures hijack placeholder domain third-party.com; Galago ransomware hits Icelandic healthcare; critical pre-auth RCE in TACACS+ protocol. Hunt now.
HookBot Android Banking Trojan Leak, ClickFix Clipboard Poisoning & Konni VelvetCake LNK Campaign: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses expose leaked HookBot/ERMAC panels with default creds, ClickFix lures on third-party[.]com, and Konni's VelvetCake LNK campaign targeting Ukraine. Hunt now.
PavinLoader Multi-Stage Campaign: ClickFix, Fake Captchas & EtherHiding Blockchain C2 — OTX Pulse Analysis with Enterprise Detection Pack
PavinLoader .NET loader distributing Amatera Stealer & HijackLoader via ClickFix/fake captcha lures, using MSBuild abuse and EtherHiding blockchain C2. High urgency.
DPRK Hangro State VPN Infrastructure Exposed: Silibank Mail Relays & Rogue Certificate Hierarchy — OTX Detection Pack
OTX pulse exposes North Korea's Hangro state VPN/mail infrastructure spanning Pyongyang, Russian Far East & Chinese netblocks. Rogue certs, mail relays identified. Hunt now.
ClickFix Fake CAPTCHA Chains, UTA0565 Chrome/Windows 0-Days & Red Heron Kapibala: OTX Pulse Analysis — Enterprise Detection Pack
CRITICAL: Bulletproof-hosted ClickFix malware chains, Chinese APT zero-day phishing (UTA0565), and Red Heron WordPress exploitation hitting governments globally.
INC Ransomware Double-Extortion Campaign + DPRK Hangro VPN Infrastructure: OTX Pulse Detection Pack — IAB Handoffs, BYOVD & SoftEther C2
OTX pulses expose INC ransomware's 17-day IAB-to-affiliate attack chain across 175 endpoints and North Korea's Hangro VPN/mail infrastructure on Russian Far East servers. Hunt now.
Operation DreamJob Resurfaces: Lazarus LightlessCan, NickelLoader and BLINDINGCAN Trojanized Coding Challenges — OTX Detection Pack
Lazarus Operation DreamJob spearphishing targets aerospace via fake Meta recruiter coding tests; hunt LightlessCan, NickelLoader, BLINDINGCAN IOCs now.
Head Mare APT Exploits TrueConf Video Conferencing Servers to Deliver PhantomCore Malware: OTX Pulse Analysis — Supply Chain Detection Pack
Head Mare APT exploited two TrueConf server vulnerabilities to push trojanized client installers and PhantomCore/PhantomGraph malware to conference participants. Patch and hunt now.
Mirage2FA PhaaS Session Hijacking + BlackCore Influence-for-Hire: OTX Pulse Analysis — Enterprise Detection Pack
Mirage2FA PhaaS steals Microsoft 365 sessions via AiTM attacks (4K+ US victims); BlackCore runs global influence-for-hire ops. Detection pack inside.
Offside Wallet Theft Factory, Mirage2FA AiTM, and PurpleDelta DPRK Employment Fraud: OTX Enterprise Detection Pack
OTX: 77 malicious Firefox extensions, Mirage2FA AiTM M365 session theft, and PurpleDelta DPRK job-fraud personas. Enterprise identity/browser risk is high.
EtherHiding Blockchain C2, BlackHatSect0r/DXQRTXX Go C2, Balonx Spyroid PhaaS: OTX Enterprise Detection Pack
OTX pulses expose EtherHiding blockchain C2, BlackHatSect0r/DXQRTXX Go C2 credential harvesting and Balonx Spyroid PhaaS hitting banks; hunt now.
LabubaRAT, EtherHiding Blockchain C2 & PolinRider Supply Chain Campaign: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses expose a Rust RAT spoofing NVIDIA software, a Polygon blockchain C2 campaign, and a Packagist supply-chain infostealer. Enterprise detection pack inside.
Octagon Android MaaS + APT36 Operation RapidRust + Mirage2FA AiTM Kit: OTX Pulse Analysis — Mobile Banking Fraud, GitHub C2 Backdoors, and M365 Session Hijacking Detection Pack
OTX pulses expose AndroidKitKat's Octagon banking bot, APT36's Rust backdoors hitting India/Afghanistan defense, and Mirage2FA AiTM phishing with 4K+ US victims. High urgency.
VectraRAT MaaS Platform, Noodle RAT Espionage Kit & APT36 Operation RapidRust: OTX Pulse Analysis — Multi-Family Detection Pack
OTX pulses expose VectraRAT MaaS rentals, Chinese-nexus Noodle RAT espionage, and APT36's Rust-based RapidRust campaign targeting government, defense, and finance. High urgency.
NightEagle APT (APT-Q-95) GhostContainer Exchange Backdoor + PeckBirdy Casino Infrastructure: OTX Pulse Analysis — Enterprise Detection Pack
NightEagle APT expands GhostContainer Exchange backdoor ops to Russian enterprises via compromised VPN creds; PeckBirdy gambling infrastructure masks espionage. High urgency.
GrelosGTM Google Tag Manager Skimmer: Magento Checkout JS Sniffer + WebSocket Exfil Detection Pack
GrelosGTM abuses Google Tag Manager to skim Magento checkout data via JS sniffers/WebSocket exfil; retail in US/EU at risk—hunt and block now.
JeetBot Malicious Browser Extension Campaign: Twitch OAuth Token Theft via Russian Proxy Infrastructure — OTX Detection Pack
Malicious 'Twitch Enhanced Viewer | JeetBot' extension exfiltrated OAuth session tokens from 30K+ users to Russian proxies. URGENT: audit extensions, revoke tokens now.
Cl0p LEMURLOOT MFT Exploitation + Jewelbug REF7707 Antino Backdoor: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses detail Cl0p's zero-day MFT ransomware campaigns and Jewelbug/REF7707 dual espionage-fraud ops via Antino backdoor and XG-Web. Govt, defense, telecom at risk. Act now.
Midnight Blizzard CaptiveCrunch + LegionLoader ClickFix + Melofee Linux Implant: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses expose APT29 hotel Wi-Fi M365 credential theft, LegionLoader ClickFix distribution, and Melofee Linux rootkit variants. Immediate hunting advised.
GRIMWEDGE Chrome 0-Day Chain, Vwork Work-Profile Evasion & PREY-0058 MFA-Bypass Extortion: OTX Pulse Analysis — Enterprise Detection Pack
Chinese actors chain Chrome/Windows 0-days against NGOs; GoldFactory weaponizes Shelter fork; PREY-0058 runs vishing + AiTM MFA bypass against M365. Hunt now.
Aeternum Blockchain C2 Botnet + XWorm/ZingoStealer Loader Chain: OTX Pulse Analysis — Polygon Smart Contract Detection Pack
AlienVault OTX flags Aeternum, a C++ loader using Polygon smart contracts for C2, dropping XWorm, ZingoStealer and XMRig. Immutable blockchain C2 defeats takedowns — hunt RPC egress now.
Showing 50 of 306 reports. Archive expands automatically as new intel is generated.
Every APT & Nation-State Report Includes SIGMA & KQL Detection Rules
Every intelligence briefing on this page includes at least one Sigma rule, a Microsoft Sentinel KQL hunt query, and an IOC check script — ready to drop into your SIEM. No paywall. No registration.