@PolySwarm

A threat intelligence & detection community helping security teams detect new & emerging malware. Ticker: $NCT Join our Discord: https://xitter.cf/t.co/AVknm1YZjh

 San Diego, CA
polyswarm.network
Joined August 2017
  • Tweets3.1K
  • Following1.4K
  • Followers13.8K
711Media
Midnight Mimosa malware has infected Android devices in 150+ countries, exploiting preinstalled firmware to deploy malicious payloads, commit ad fraud, and enable proxy abuse. blog.polyswarm.io/midnight-m… #MidnightMimosa #AndroidMalware #CyberSecurity #ThreatIntel

Midnight Mimosa Malware Campaign Exploits Android Firmware Supply Chain

Midnight Mimosa is a widespread Android malware campaign involving malicious applications preinstalled in the firmware of low-cost, MediaTek-based devices, with infections observed across more than...

blog.polyswarm.io
1
12
497
Chinese state-linked hackers are targeting US critical infrastructure with automated scanning, credential attacks, and cyber espionage tools. blog.polyswarm.io/chinese-st… #CyberSecurity #ThreatIntel #CriticalInfrastructure

Chinese State-Linked Hackers Target US Critical Infrastructure with Automated Scanning and Cyber...

Chinese government-linked threat actors enabled by Integrity Technology Group (Integrity Tech) combine automated vulnerability scanning and hands-on exploitation to compromise organizations worldwide.

blog.polyswarm.io
4
12
830
We're proud to be a data partner of @trmlabs new AI-powered investigation platform, Ardence! By connecting intelligence from trusted partners, Ardence helps investigators uncover threats & connect the dots. Learn more: trmlink.info/3UcFEZx #ThreatIntelligence #CyberSecurity
2
3
1
22
1,003
ClingSTUN is turning vulnerable IoT and Linux devices into attacker-controlled proxy nodes, abusing public STUN infrastructure for NAT traversal and persistence. Learn more: blog.polyswarm.io/clingstun-… #CyberSecurity #IoT #ClingSTUN #Linux

ClingSTUN Turns Vulnerable Edge Devices Into Attacker Infrastructure

An evolving Linux malware campaign was observed deploying ClingSTUN, a back-connect proxy backdoor that exploits known vulnerabilities in Internet-facing IoT and embedded/network devices to establish...

blog.polyswarm.io
1
2
13
816
New research from @symantec tracks China-nexus threat actor Longlegs exploiting Microsoft SharePoint to deploy Warlock ransomware against critical infrastructure and other targets. We break down the campaign and TTPs: blog.polyswarm.io/china-link… #ThreatIntel #Ransomware

China Linked Warlock Ransomware Campaign Targets Critical Infrastructure

A China-nexus threat actor tracked by Symantec as Longlegs is continuing to exploit vulnerabilities in on-premises Microsoft SharePoint Server to deploy Warlock ransomware, with recent victims...

blog.polyswarm.io
5
18
977
Critical infrastructure is part of the battlefield. State-sponsored actors targeting US power, water, telecom & other OT systems can disrupt military operations without ever touching a military network. blog.polyswarm.io/targeting-… #OTSecurity #CriticalInfrastructure #ThreatIntel

Targeting the Systems Behind the Mission: OT Threats to US Critical Infrastructure and Military...

US critical infrastructure faces an increasingly consequential operational technology (OT) threat as state-sponsored and other cyber actors conduct activity ranging from long-term pre-positioning in...

blog.polyswarm.io
6
1
14
1,175
Lunex MaaS is using #BYOVD to turn security tools against themselves—abusing a vulnerable AMD driver to disable endpoint monitoring before deploying LunexStealer. We break down the attack chain, persistence mechanisms & IOCs 👇 blog.polyswarm.io/lunex-uses…

Lunex Uses BYOVD to Disable Security Monitoring and Deploy Persistent Stealer

Lunex Malware-as-a-Service (MaaS) platform uses a fake CAPTCHA lure to deliver a loader, abuse a vulnerable AMD driver, and deploy the LunexStealer credential-stealing and C2 agent.

blog.polyswarm.io
6
22
1,381
Malware is putting AI in the C2 loop. #CLOSEDQUORUM queries commercial LLMs to choose malicious actions like credential theft, process injection & persistence, reducing reliance on human operators and traditional C2. blog.polyswarm.io/closedquor… #Cybersecurity #AI #Malware

CLOSEDQUORUM: Malware Puts AI in the C2 Loop

Cisco Talos has identified CLOSEDQUORUM, a Windows malware implant that delegates tactical command-and-control (C2) decisions to a panel of commercial large language models (LLMs), allowing portions...

blog.polyswarm.io
2
2
17
944
#FamousSparrow is targeting government organizations across Latin America with its new modular #SparroWocky backdoor, featuring in-memory execution, BOF support, proxy functionality & more. Read our latest threat analysis: blog.polyswarm.io/famousspar… #Cybersecurity #APT

FamousSparrow Takes Flight with New SparroWocky Backdoor

China-aligned advanced persistent threat (APT) group FamousSparrow has shifted much of its targeting toward government organizations in Latin America while deploying a newly developed modular C++...

blog.polyswarm.io
2
6
23
1,205
#BlueMoon is a new exploit kit chaining Chromium V8 vulnerabilities with a Windows kernel flaw. Four espionage-focused threat actors are already using it to deliver GemStone and ShadowPad. Read more: blog.polyswarm.io/bluemoon-e… #Cybersecurity #ThreatIntel #Malware

BlueMoon Exploit Kit Rapidly Targets Key Verticals Across Multiple Espionage Campaigns

Four espionage-focused threat actors were observed using BlueMoon, a newly tracked exploit kit chaining two Chromium V8 vulnerabilities with a Windows kernel privilege-escalation flaw.

blog.polyswarm.io
2
3
14
1,064
Fake #GTA6 leaks are delivering a nasty malware grab bag. Including NJRAT, DCRAT, Mercurial Grabber & Chaos ransomware. 🎮☠️ See how attackers are turning gaming hype into malware infections: blog.polyswarm.io/gamers-get… #Cybersecurity #Malware #InfoSec #ThreatIntel

Gamers Get Played: Fake GTA6 Leaks Deliver a Grab Bag of Malware

Threat actors are exploiting anticipation surrounding Grand Theft Auto VI by distributing fake leaked game ISOs containing multiple malware families.

blog.polyswarm.io
4
15
1,049
#BraZetsu is an evolving Windows malware framework linked to #Exilware, profiling compromised systems to identify high-value targets for its access marketplace. Read our latest analysis & explore related samples: blog.polyswarm.io/brazetsu-a… #Malware #ThreatIntel #Cybersecurity

BraZetsu: AI-Enhanced Reconnaissance Fuels Exilware’s Access Marketplace

BraZetsu is a Python-based Windows malware framework attributed to the Brazilian threat actor Exilware.

blog.polyswarm.io
1
5
14
1,052
#MirageKitten is targeting software engineers with fake recruiter personas & trojanized coding challenges, deploying two new cross-platform RATs: NodeRabbit & PollCat. Our latest report breaks down the campaign: blog.polyswarm.io/the-job-of… #Cybersecurity #Malware #ThreatIntel

The Job Offer Has Claws: Mirage Kitten Deploys NodeRabbit and PollCat

Mirage Kitten conducted a cyberespionage campaign targeting software engineers through fake recruiter personas and trojanized coding challenges.

blog.polyswarm.io
2
4
17
1,394
BlueDelta, overlapping with APT28/Fancy Bear, deployed the HOOKEDGE Windows backdoor against European diplomatic, government & defense targets. Read our blog for more details and related PolySwarm samples: blog.polyswarm.io/hooked-on-… #Cybersecurity #APT28 #BlueDelta #Malware

Hooked on Espionage: BlueDelta Targets Europe with HOOKEDGE

Russian state-sponsored threat group BlueDelta, which overlaps with APT28, Fancy Bear, and Forest Blizzard, deployed the HOOKEDGE Windows backdoor in espionage campaigns targeting European diplomat...

blog.polyswarm.io
1
10
31
2,260
Great time at #FalCon2026 in Las Vegas! Always valuable connecting with the cybersecurity community, catching up with industry peers, & seeing what’s next across the threat landscape. Thanks to @CrowdStrike for a great event. 👏 #Cybersecurity #ThreatIntelligence #PolySwarm
CrowdStrike
@CrowdStrikeSep 4
Fal.Con 2026 closed with incredible keynotes that gave customers a look at what comes next for cybersecurity in the AI era. CrowdStrike Chief AI & Autonomous Systems Officer Bartley Richardson showed how the Cyber Super Intelligence Lab is bringing together frontier AI, world-class threat intelligence, purpose-built harnesses and the Falcon platform to tilt the advantage back to defenders. He also went deeper into CrowdStrike SafeMind and the adversarial co-evolution, where the best offense is built for one reason: to forge a better defense, both moving at the speed of AI. Alex Ionescu, our Chief Technology Innovation Officer, followed with the road ahead for the Falcon sensor. A more resilient, flexible, modular architecture that expands the classes of systems the sensor can run on, and the missions it can take on. AI inference running directly on the endpoint with our first small language model running on the NPU. Fifteen years of engineering, and he showed exactly where it goes next. Together, they made the case that matters most: as AI transforms both offense and defense, security has to evolve with it. We are bringing AI-powered defense closer to where attacks happen, pairing intelligence in the cloud with reasoning on the endpoint to stop threats at machine speed. What a way to close out an unforgettable week at #FalCon2026
1
12
1,044
Still going strong. 💪 Six years later, @CrowdStrike's Falcon ML engine remains part of the PolySwarm marketplace, helping protect users with crowdsourced threat intelligence. 🔥
PolySwarm 🇺🇸@PolySwarm30 Jul 2020
We are thrilled to announce @CrowdStrike participation in PolySwarm’s crowdsourced threat intelligence marketplace. CrowdStrike’s Falcon ML engine is live on our platform! 🔥🚀 polyswarm.network/engines
1
7
18
1,886
SLEEPWALKER stays dormant until attackers wake it with a specially crafted network packet—enabling payload delivery, lateral movement & in-memory execution. Discovered by @TheEnergyStory. See PolySwarm’s related samples: blog.polyswarm.io/sleepwalke… #Cybersecurity #Malware #Backdoor

SLEEPWALKER: Passive Backdoor Awakens Only When Attackers Call

SLEEPWALKER is a novel passive Windows backdoor.

blog.polyswarm.io
1
3
18
1,380
UAT-10147 is using AI-assisted workflows to target Windows & Linux servers, deploying the SPECTRE backdoor with credential theft, process injection, rootkit & EDR evasion capabilities. See PolySwarm’s related samples: blog.polyswarm.io/uat-10147-… #Cybersecurity #SPECTRE #UAT10147 #AI

UAT-10147 Uses AI-Assisted Workflows to Deploy SPECTRE Backdoor

Cisco Talos identified an advanced intrusion ecosystem operated by UAT-10147, a Chinese-speaking, financially motivated threat actor targeting internet-facing Windows and Linux servers.

blog.polyswarm.io
1
6
20
1,197
Exciting news for the PolySwarm ecosystem! NCT/KRW trading is coming to Upbit, expanding access to Nectar in South Korea. Thanks to @cryptodotnews for the coverage! crypto.news/nct-price-surges…

NCT price surges 200% on Upbit KRW listing

Upbit will open NCT/KRW trading on Aug. 26, offering 24 hours of zero fees as PolySwarm’s token rallies before the market launch.

crypto.news
3
6
1
29
2,268
ClickFix has evolved far beyond fake CAPTCHAs. Attackers are abusing trusted workflows in both execution- and identity-focused attacks. Our analysts map the growing “Fix” family and what defenders should watch: blog.polyswarm.io/the-evolut… #ClickFix #ThreatIntel #Cybersecurity

The Evolution of ClickFix: Mapping the Growing *Fix Family

ClickFix has evolved from fake CAPTCHA and technical support lures into a broader family of attacks that manipulate trusted intermediaries to cross security boundaries.

blog.polyswarm.io
2
6
1
15
2,219
Load more