APT & Nation-State Intelligence
Advanced Persistent Threat intelligence tracking nation-state actors — Lazarus Group, Sandworm, Volt Typhoon, and others. Campaign TTPs, targeted sectors, and SIGMA/KQL detection rules.
APT & Nation-State — Archive & Latest
Storm-0940 ARTEX Autonomous AI Attack Framework + CL-STA-1178 Blinder Tunnel Campaign: OTX Pulse Analysis — APT Detection Pack for Finance and Critical Infrastructure
OTX pulses expose agentic AI-driven attacks on South Korean finance (Storm-0940/ARTEX), Iranian APT CL-STA-1178's Blinder Tunnel campaign in Iraq, and mass Langflow RCE scanning. Hunt now.
BO Team Supply Chain Intrusion, Mirax Android DTO, and Storm-2603 ToolShell Fileless Attacks: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal BO Team hypervisor compromise via Log4Shell, Mirax Android banking takeover in META, and Storm-2603 fileless SharePoint ransomware. Hunt now.
SkyW4lker Device-Code Phishing Kit: Microsoft 365 OAuth Token Theft Campaign — OTX Detection Pack
SkyW4lker phishing kit abuses Microsoft device-code OAuth flow to hijack M365 sessions without passwords or MFA. 618 sandbox hits. US, UK, Canada, India targeted.
KeyHunter Operation: leepsmarts LLM API Key Theft & Academic Fraud Campaign — OTX Detection Pack
Chinese-speaking actor 'leepsmarts' harvested 2,233 LLM API keys from misconfigured cloud infra and ran academic fraud against 20 universities. URGENT: rotate exposed keys, hunt IOCs now.
Gorbag Espionage on Ukraine, Rogue Gentlemen Affiliate 'Azazel' & XWorm RAT: OTX Pulse Detection Pack
OTX pulses track Gorbag's infostealer campaign against Ukrainian government, a rogue Gentlemen ransomware affiliate abusing GitLab CI/CD secrets, and XWorm RAT spread. Hunt now.
BADBOX Supply Chain Compromise: Videostrong x.cpe Backdoor & Residential Proxy Botnet — OTX Pulse Analysis
Supply chain compromise of MECOOL Android boxes by Videostrong Technology infects 1.3M devices with x.cpe backdoor, MQTT C2, and proxyware SDKs.
BITTER PapRAT Cyberespionage + BADBOX Supply Chain Compromise: OTX Pulse Analysis — Enterprise Detection Pack
BITTER APT deploys PapRAT against South Asian government/energy targets; BADBOX infects 1.3M Android devices via supply chain. Immediate IOC blocking and hunt guidance included.
Kimsuky XenoRAT + FrostyNeighbor Wiper Campaign: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal Kimsuky spear-phishing delivering XenoRAT via LNK/PowerShell in South Korea and FrostyNeighbor (UNC1151) deploying VBScript wiper via GPO in Ukraine. High urgency.
PaperCut MF Zero-Day Intrusion Chain: Java Loader, Web Shell & AdaptixC2 via CVE-2026-82078 / CVE-2026-81578 — OTX Pulse Analysis & Enterprise Detection Pack
OTX pulse: threat actors exploited two PaperCut MF zero-days (CVE-2026-82078, CVE-2026-81578) against an Education-sector print server, deploying a Java loader, web shell, and trojanized Microsoft Copilot binary carrying AdaptixC2. Patch and hunt now.
Psychedelic Stealer ClickFix Campaign: Fake CAPTCHA MSI Installer Targets Ukrainian Enterprises — OTX Detection Pack
Unattributed Russian-speaking operator uses ClickFix fake CAPTCHA to deliver Psychedelic Stealer via msiexec. 14% completion rate. Ukraine-targeted. HIGH urgency.
AtlasCore, PolyFucked & Magnetic Team: Traffer-as-a-Service Infrastructure Targeting Prediction Markets — OTX Pulse Analysis
Russian-language traffer teams are exploiting prediction market hype via affiliate fraud and crypto theft. Urgent: Block identified C2 and payment infrastructure immediately.
PHP2Shell Weaponization + Traffer Team Fraud Infrastructure: OTX Pulse Analysis — Web Shell & Prediction Market Scam Detection Pack
OTX pulses expose kkkkevin777's PHP2Shell extortion campaign against Japanese real estate and Russian traffer teams AtlasCore/PolyFucked/Magnetic targeting prediction markets. Detection pack inside.
Star Blizzard SPICA Malware & PHP2Shell Extortion: OTX Pulse Analysis — Prediction Market Fraud Infrastructure Detection
Live OTX data reveals Russian APT Star Blizzard credential theft campaigns, PHP2Shell real estate extortion in Japan, and Russian traffer teams exploiting prediction markets.
Aurora Ransomware's AI-Assisted ESXi Exploitation, Star Blizzard Espionage & PHP2Shell Extortion: Multi-Vector Threat Analysis — OTX Detection Pack
OTX telemetry exposes Aurora ransomware abusing Cursor Agent against ESXi, Star Blizzard's FSB-linked phishing wave, and PHP2Shell weaponization targeting Japanese real estate. Enterprise detection pack included.
N0n AI-Assisted Ransomware + NetamLoader Government Supply-Chain APT + Brazilian Magecart Skimmer: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal AI-assisted ransomware staging exposure, a NetamLoader supply-chain APT on Asian government Windows builds, and Magecart skimming via Convertr analytics. High urgency — hunt now.
ClickFix RAT Campaign, n0n AI-Assisted Ransomware, and Convertr Magecart Skimmer: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses expose ClickFix-driven RAT deployment via fake ChatGPT Custom GPTs, n0n ransomware's AI-assisted extortion, and a Brazilian Magecart supply chain skimmer. Enterprise SOC action required.
CyberDakait GhostBat Android Banking Fraud + Brazilian Magecart Supply-Chain Skimming: OTX Enterprise Detection Pack
OTX flags CyberDakait Android banking trojan clusters targeting India, wallet-stealing Firefox extensions via bonto[.]io, and Brazilian Magecart skimming on Convertr. High urgency.
Operation Master (masterblack/AdaptixC2), PHP2Shell RCE & Firefox Wallet-Impersonation Campaign: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal AdaptixC2 intrusions via GlobalProtect bypass, mass PHP2Shell RCE exploitation dropping Mirai/Keitaro, and Firefox extensions stealing crypto seed phrases. Patch and hunt now.
SkyW4lker Device-Code Phishing Kit + Brazilian Magecart Convertr Skimmer: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses flag SkyW4lker MFA-bypass phishing kit targeting Microsoft 365 and a Brazilian Magecart supply-chain skimmer on Convertr checkouts. Immediate action required.
ICMacOS RAT, Convertr Magecart Skimmer & Hidden Hawk DNS Shadowing: OTX Pulse Analysis — Multi-Vector Detection Pack
GlowComa's ICMacOS macOS RAT, a Brazilian Magecart supply-chain skimmer on Convertr checkouts, and Hidden Hawk domain shadowing — active IOCs and detection content inside.
Lazarus Group 'June 2026 Minjun' Campaign: PHP2Shell Web Shell Exploitation of Global PHP Infrastructure — OTX Pulse Analysis & Detection Pack
Lazarus Group actively exploiting critical PHP RCE flaws (CVE-2026-109618/109619) to deploy PHP2Shell web shells against government, finance, and technology sectors globally. Urgent patching required.
Psychedelic Stealer MSI Distribution via Fake CAPTCHA: OTX Pulse Analysis — Ukraine Targeting Detection Pack
Active ClickFix-style campaign compromises legitimate Ukrainian business sites, deploying Psychedelic infostealer via fake Cloudflare verification pages and MSI packages.
M365 AiTM Token Replay Campaign: 79 Organizations Compromised — Enterprise Detection Pack
OTX pulse exposes an AiTM token spray/replay campaign targeting Microsoft 365, compromising 79 orgs and enabling 497 malicious sign-ins via German-hosted infrastructure.
INC Ransomware Double-Extortion Timeline + M365 AiTM Token Replay: OTX Pulse Detection Pack
OTX pulses expose INC ransomware intrusions spanning 175 endpoints via IAB handoff and an AiTM token-replay campaign compromising 79 M365 tenants — hunt and block now.
UTA0565 Chrome & Windows 0-Day Chain, Sandworm MythicRatatoskr, and INC Ransomware: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses expose a Chinese APT exploiting Chrome & Windows 0-days, Sandworm deploying a Go-based backdoor in Ukraine, and INC ransomware hitting 175+ endpoints. Immediate action required.
SiriusQT RAT, RemControl Banking Trojan & ClickFix AS202412 Hosting Cluster: OTX Pulse Analysis — Enterprise Detection Pack
MaaS RAT SiriusQT, Android banking trojan RemControl, and a bulletproof-hosted ClickFix loader cluster active. Credential theft, banking fraud, loader delivery — hunt now.
BlackX UEFI Bootkit, ClickFix/Lumma Stealer Chains & INC Ransomware: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal APT41's BlackX UEFI bootkit hitting Central Asian diplomats, ClickFix malvertising delivering Lumma Stealer, and INC ransomware via IAB access. High urgency.
DPRK Hangro VPN Infrastructure + Hotejka Help TDS: OTX Pulse Analysis — Certificate Anomalies, Tech Support Scam Delivery & Enterprise Detection Pack
OTX pulses expose North Korea's Hangro VPN/mail relay infrastructure with anomalous certificates, plus the Hotejka TDS pushing UltraViewer tech support scams across 7 countries.
The Gentlemen RaaS + Hangro DPRK Infrastructure + Help TDS: OTX Multi-Campaign Intelligence — Enterprise Detection Pack
OTX pulses expose The Gentlemen RaaS (800+ victims, EDR-killer drivers), DPRK Hangro VPN infrastructure, and Hotejka TDS tech-support scam networks. High urgency.
Silent Lynx Espionage Cluster + Plex CVE-2026-9665x Exploitation Chain: OTX Pulse Analysis — Central Asia APT & Mass Cryptominer Detection Pack
OTX pulses reveal Silent Lynx APT targeting CIS governments via GitHub-staged implants, plus active Plex CVE chain exploitation dropping XMRig. High urgency — patch and hunt now.
YuanKong Android RAT + TraderTraitor (DPRK) FLATROOF/ROOFDECK Backdoors: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal YuanKong multi-tenant Android RAT with operator-stamped builds and DPRK TraderTraitor resurfacing with FLATROOF/ROOFDECK backdoors against non-crypto targets. Hunt now.
Lazarus Operation Dream Job: LightlessCan & NickelLoader Target Aerospace via Trojanized Coding Challenges — OTX Pulse Detection Pack
OTX pulse: Lazarus Group impersonates Meta recruiters on LinkedIn, delivering trojanized coding challenges to aerospace employees. LightlessCan backdoor deployed. High urgency.
LabubaRAT Rust-Based RAT + PolinRider Supply Chain Infostealer: OTX Pulse Analysis — Enterprise Detection Pack
Two active campaigns: LabubaRAT Rust RAT masquerading as NVIDIA software, and PolinRider infostealer spreading via compromised GitHub/Packagist accounts. High urgency for dev environments.
SparroWocky Backdoor & GhostEmperor (FamousSparrow) LATAM Government Espionage Campaign: OTX Pulse Detection Pack
ESET-documented SparroWocky C++ backdoor deployed by China-aligned GhostEmperor/FamousSparrow APT against Latin American governments since Aug 2025. 33 IOCs live. High urgency.
SilkParasite SpiceRAT C2 Cluster + skynox7 Proxyjacking Campaign: OTX Pulse Analysis — Edge Device & Central Asia Detection Pack
OTX pulses expose SilkParasite's SpiceRAT/NodeEdgeRAT C2 cluster targeting Central Asian government and energy sectors, plus a 143-device proxyjacking campaign exploiting D-Link, Ubiquiti, and SAP edge vulnerabilities.
DragonForce Ransomware Cartel, Noodle RAT Espionage Cluster + ScreenConnect Invitation Lures: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses expose DragonForce's ransomware cartel expansion, Chinese-speaking actors deploying Noodle RAT across APAC, and ScreenConnect RAT delivery via fake event invites. High urgency for enterprise SOC teams.
KREMLIN Banking Extension, SysGoRAT Espionage & ARMORY CASTLE BeyondTrust Zero-Day: OTX Pulse Analysis — Enterprise Detection Pack
Three active campaigns: REF9334 KREMLIN banking malware targets Brazil, CL-UNK-1211 AI-built SysGoRAT hits government Linux, ARMORY CASTLE exploits BeyondTrust CVE-2026-102764 zero-day.
Iron Man System + YamStore PhaaS: OTX Pulse Analysis — Global Postal, Bank and Government Lure Infrastructure
OTX: Iron Man System/YamStore PhaaS sells postal, bank and gov lure kits to Chinese-speaking buyers; finance, health, telecom and retail should hunt IOCs now.
Iron Man & CoGUI PhaaS Ecosystem: Chinese-Language Phishing Kit Disruption — OTX Pulse Analysis & Enterprise Detection Pack
OTX pulses expose the Iron Man/YamStore PhaaS ecosystem and CoGUI/CoAceV/CoFish_Ws kits hitting finance, government, and Japanese enterprises. High urgency: hunt and block now.
Calendly Meta Phishing Kit + Candiru AdFection + CoGUI/CoAceV/CoFish Disruption: OTX Enterprise Detection Pack
OTX: fake Calendly Meta interviews steal Facebook/Google creds; Candiru AdFection zero-click ads; CoGUI/CoAceV/CoFish kits hit Japan. Hunt now.
Storm-2561 Fake WatchGuard VPN SEO Poisoning: Signed Installer Trust Abuse + Credential Harvest — OTX Detection Pack
Storm-2561 SEO-poisoned fake WatchGuard VPN pages steal creds twice, then drop a genuine signed client. Block lookalike domains; verify VPN logins now.
Log4Shell-Linked Malicious Domains Behind CDN Infrastructure: OTX Pulse Analysis of Shared-IP C2 & Precision Blocking — Enterprise Detection Pack
OTX pulse flags malicious domains moonlighthathel[.]org and ukankingwithea[.]com hidden behind shared CloudFront IPs; 15 hosts affected. Precision DNS triage and Log4Shell exposure checks urged.
VulcanRAT207.A + Kimsuky 'GitPower': OTX Pulse Analysis — WhatsApp-Delivered RAT Chains & Nation-State Espionage Detection Pack
OTX pulses expose TA4922's WhatsApp-delivered VulcanRAT207.A SYSTEM-escalation chain and Kimsuky's GitPower spear-phishing op against Ukrainian diplomats. High urgency.
JeetBot Twitch Extension OAuth Token Theft: OTX Pulse Analysis — Enterprise Detection Pack
Malicious 'JeetBot' Twitch extension stole OAuth tokens from ~30.5k users, sending sessions to Russian-linked proxies; revoke tokens and block jeetbot.cc now.
Google Trust-Proxy Phishing Chain + ScreenConnect Follow-On: OTX Detection Pack for Credential Harvesting
OTX: global phishing abuses six Google services as trusted redirects to harvest credentials across manufacturing, government, finance and NGOs; ScreenConnect flagged as possible follow-on.
Melofee Linux Implant Resurfaces: APT41 Toolset Evolution with Reptile Kernel Rootkit — OTX Detection & Hunting Pack
OTX pulse reveals APT41's Melofee Linux implant evolved with modular hot-loadable components and Reptile-based kernel rootkit. High urgency for Linux server fleets.
GRIMWEDGE & SUPERSTOMP 0-Day Chain: UTA0560 and JungleBamboo Exploit CVE-2026-85880 in NGO Targeting Campaign
Two Chinese threat actors chain unpatched Chrome/Windows 0-days (CVE-2026-85046/85880/87491) to deploy GRIMWEDGE, SUPERSTOMP, and LONGTALE against U.S. NGOs. Urgent patch-gap risk.
EtherRAT & TONResolver: Blockchain-Based C2 Campaign Targets Hospitality Sector — OTX Detection Pack
URGENT: Phishing campaign hits hotels with fake guest complaints delivering EtherRAT & TONResolver RATs using Ethereum/TON blockchain C2. Detect & block now.
TraderTraitor Terraform Supply-Chain Campaign, Blockchain-C2 Hotel Intrusion Wave & Flax Typhoon Disruption: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal TraderTraitor trojanized Terraform providers dropping FLATROOF/ROOFDECK, blockchain-C2 RATs targeting hospitality, and FBI disruption of Flax Typhoon tooling. Hunt now.
'Raabby WaIIet' Malicious Firefox Extension Campaign: Cryptocurrency Seed Phrase Theft via Cloudflare Workers C2 — OTX Detection Pack
16 malicious Firefox extensions cloning Rabby and OKX wallets steal recovery phrases and private keys, exfiltrating via Cloudflare Workers. High urgency for Web3-exposed orgs.
Showing 50 of 341 reports. Archive expands automatically as new intel is generated.
Every APT & Nation-State Report Includes SIGMA & KQL Detection Rules
Every intelligence briefing on this page includes at least one Sigma rule, a Microsoft Sentinel KQL hunt query, and an IOC check script — ready to drop into your SIEM. No paywall. No registration.