Tag index

26 curated tag landing pages: APT groups, malware families, TTPs and vulnerabilities

Tag index

26 curated tag landing pages

APT groups · 3

Threat actors and the IOCs linked to them.

#Kimsuky 13,317 hits last year · 40 last month

DPRK-aligned APT (Velvet Chollima, TA427)

#DPRK 11,669 hits last year · 5 last month

DPRK-aligned activity: Lazarus, Kimsuky and more

#Lazarus 108 hits last year · 0 last month

DPRK-aligned APT for financial gain

Malware and tools · 12

Named malware, C2 frameworks, offensive tools.

#AsyncRAT 611 hits last year · 2 last month

Open-source .NET RAT, common in phishing

#Xworm 478 hits last year · 14 last month

Modular .NET RAT/stealer, leaked builder

#Lumma 292 hits last year · 0 last month

LummaC2 infostealer for hire

#Remcos 291 hits last year · 3 last month

Commercial RAT widely abused in mass phishing

#Njrat 178 hits last year · 0 last month

Commodity .NET RAT, especially active in MENA

#CobaltStrike 126 hits last year · 1 last month

Red-team tool abused by APTs and ransomware

#NetSupportRAT 43 hits last year · 0 last month

NetSupport Manager abused as RAT

#Sliver 39 hits last year · 0 last month

Open-source C2, abused as a Cobalt Strike alternative

#Interactsh 17 hits last year · 0 last month

OAST canary used for blind XSS, SSRF, RCE

#Havoc 16 hits last year · 1 last month

Open-source C2, abused in real intrusions

#Mythic 12 hits last year · 6 last month

Open-source modular C2

#Deimos 2 hits last year · 0 last month

Open-source Go C2, cross-platform implants

Techniques and labels · 10

Broad themes: phishing, C2, ransomware, scams.

#phishing 34,462 hits last year · 3,414 last month

Phishing IOCs from Twitter/X researchers

#malware 4,038 hits last year · 1,144 last month

Malware-hosting URLs, domains, IPs

#scam 3,443 hits last year · 48 last month

Fake stores, crypto, romance, giveaways.

#C2 2,215 hits last year · 113 last month

Command and Control servers

#APT 1,493 hits last year · 37 last month

APT infrastructure: URLs, domains, IPs, hashes

#ClickFix 1,113 hits last year · 287 last month

Fake CAPTCHA that tricks you into pasting a command

#opendir 707 hits last year · 38 last month

Open directories with attacker payloads

#ransomware 691 hits last year · 101 last month

Ransomware URLs, domains, IPs, hashes

#stealer 656 hits last year · 21 last month

Infostealer panels, payloads, exfil

#malvertising 371 hits last year · 310 last month

Malicious ads leading to phishing or malware

Vulnerabilities · 1

Named CVEs seen exploited.

#PHP2Shell 25 hits last year · 25 last month

Critical PHP RCE. Fixed in 8.5.12, 8.4.27, 8.3.36, 8.2.35.

Other reference

IOC types · the 5 type-specific hubs (URLs / domains / IPs / MD5 / SHA-256).
Threat Intelligence guide · ~1,640-word pillar covering IOC types, OSINT vs commercial, MITRE ATT&CK basics, glossary.