A threat intelligence & detection community helping security teams detect new & emerging malware. Ticker: $NCT Join our Discord: discord.gg/uzvBVvWwR5
San Diego, CA
- Tweets 3,120
- Following 1,361
- Followers 13,795
- Likes 5,930
#FamousSparrow is targeting government organizations across Latin America with its new modular #SparroWocky backdoor, featuring in-memory execution, BOF support, proxy functionality & more. Read our latest threat analysis: blog.polyswarm.io/famousspar… #Cybersecurity #APT
2
6
23
1,002
#BlueMoon is a new exploit kit chaining Chromium V8 vulnerabilities with a Windows kernel flaw.
Four espionage-focused threat actors are already using it to deliver GemStone and ShadowPad.
Read more: blog.polyswarm.io/bluemoon-e…
#Cybersecurity #ThreatIntel #Malware
2
3
14
940
Fake #GTA6 leaks are delivering a nasty malware grab bag.
Including NJRAT, DCRAT, Mercurial Grabber & Chaos ransomware. 🎮☠️
See how attackers are turning gaming hype into malware infections:
blog.polyswarm.io/gamers-get…
#Cybersecurity #Malware #InfoSec #ThreatIntel
4
15
968
#BraZetsu is an evolving Windows malware framework linked to #Exilware, profiling compromised systems to identify high-value targets for its access marketplace.
Read our latest analysis & explore related samples:
blog.polyswarm.io/brazetsu-a…
#Malware #ThreatIntel #Cybersecurity
1
4
13
983
#MirageKitten is targeting software engineers with fake recruiter personas & trojanized coding challenges, deploying two new cross-platform RATs: NodeRabbit & PollCat.
Our latest report breaks down the campaign:
blog.polyswarm.io/the-job-of…
#Cybersecurity #Malware #ThreatIntel
2
4
17
1,349
BlueDelta, overlapping with APT28/Fancy Bear, deployed the HOOKEDGE Windows backdoor against European diplomatic, government & defense targets. Read our blog for more details and related PolySwarm samples:
blog.polyswarm.io/hooked-on-…
#Cybersecurity #APT28 #BlueDelta #Malware
1
10
30
2,197
Great time at #FalCon2026 in Las Vegas! Always valuable connecting with the cybersecurity community, catching up with industry peers, & seeing what’s next across the threat landscape.
Thanks to @CrowdStrike for a great event. 👏
#Cybersecurity #ThreatIntelligence #PolySwarm
Fal.Con 2026 closed with incredible keynotes that gave customers a look at what comes next for cybersecurity in the AI era.
CrowdStrike Chief AI & Autonomous Systems Officer Bartley Richardson showed how the Cyber Super Intelligence Lab is bringing together frontier AI, world-class threat intelligence, purpose-built harnesses and the Falcon platform to tilt the advantage back to defenders. He also went deeper into CrowdStrike SafeMind and the adversarial co-evolution, where the best offense is built for one reason: to forge a better defense, both moving at the speed of AI.
Alex Ionescu, our Chief Technology Innovation Officer, followed with the road ahead for the Falcon sensor. A more resilient, flexible, modular architecture that expands the classes of systems the sensor can run on, and the missions it can take on. AI inference running directly on the endpoint with our first small language model running on the NPU. Fifteen years of engineering, and he showed exactly where it goes next.
Together, they made the case that matters most: as AI transforms both offense and defense, security has to evolve with it. We are bringing AI-powered defense closer to where attacks happen, pairing intelligence in the cloud with reasoning on the endpoint to stop threats at machine speed.
What a way to close out an unforgettable week at #FalCon2026
1
12
1,007
Still going strong. 💪 Six years later, @CrowdStrike's Falcon ML engine remains part of the PolySwarm marketplace, helping protect users with crowdsourced threat intelligence. 🔥
We are thrilled to announce @CrowdStrike participation in PolySwarm’s crowdsourced threat intelligence marketplace. CrowdStrike’s Falcon ML engine is live on our platform! 🔥🚀
polyswarm.network/engines
1
7
18
1,861
SLEEPWALKER stays dormant until attackers wake it with a specially crafted network packet—enabling payload delivery, lateral movement & in-memory execution. Discovered by @TheEnergyStory. See PolySwarm’s related samples: blog.polyswarm.io/sleepwalke… #Cybersecurity #Malware #Backdoor
1
3
18
1,379
UAT-10147 is using AI-assisted workflows to target Windows & Linux servers, deploying the SPECTRE backdoor with credential theft, process injection, rootkit & EDR evasion capabilities. See PolySwarm’s related samples:
blog.polyswarm.io/uat-10147-… #Cybersecurity #SPECTRE #UAT10147 #AI
1
6
20
1,167
Exciting news for the PolySwarm ecosystem! NCT/KRW trading is coming to Upbit, expanding access to Nectar in South Korea.
Thanks to @cryptodotnews for the coverage!
crypto.news/nct-price-surges…
3
6
29
2,214
ClickFix has evolved far beyond fake CAPTCHAs. Attackers are abusing trusted workflows in both execution- and identity-focused attacks. Our analysts map the growing “Fix” family and what defenders should watch: blog.polyswarm.io/the-evolut… #ClickFix #ThreatIntel #Cybersecurity
2
6
15
2,200
AmnesiaStealer is a new Rust-based macOS infostealer spread via ClickFix. Its standout capability: interactive hijacking of authenticated Chromium browser sessions via CDP. See our analysis and related samples: blog.polyswarm.io/amnesiaste… #macOS #Malware #ThreatIntel
1
4
17
1,925
400+ npm packages have been compromised in a supply chain attack delivering Chaindrop malware, targeting developer credentials and cloud infrastructure.
Watch our latest threat breakdown: piped.video/shorts/R7Dzuv3P6…
#Cybersecurity #Malware #npm
6
12
1,997
Kimsuky is expanding its AI capabilities in Operation GitPower, deploying local LLMs, RAG, AI frameworks, & speech-to-text tools alongside its established espionage tactics.
blog.polyswarm.io/kimsuky-ex…
#Kimsuky #ThreatIntel #Cybersecurity #AI #Malware #NorthKorea
1
2
8
1,864
DeadLock ransomware is taking a decentralized approach to resilience, leveraging blockchain-backed services, Session messaging, and distributed file hosting to boost resilience.
blog.polyswarm.io/deadlock-r…
#Ransomware #ThreatIntel #Cybersecurity
2
11
1,155
#ChainDrop has compromised 400+ npm packages in a self-propagating software supply chain attack targeting developer credentials and CI/CD environments.
Check out our latest analysis + related samples 👇
blog.polyswarm.io/self-propa…
#SupplyChainSecurity #ThreatIntel #Malware #npm
3
8
1,295
#OctLurk & #SilkLurk are stealthy malware families powering a cyber espionage campaign targeting governments across Central Asia and the Middle East. Read our analysis and explore related PolySwarm samples: blog.polyswarm.io/octlurk-an… #ThreatIntel #Malware #CyberSecurity
1
3
7
1,092
Black Hat is underway! We're excited to spend the week connecting with customers, partners, researchers, and the cybersecurity community. If you're at @BlackHatEvents, come say hello. We'd love to meet you.
#BlackHat #BHUSA #InfoSec
3
10
958