PolySwarm 🇺🇸

A threat intelligence & detection community helping security teams detect new & emerging malware.

Ticker: $NCT

Join our Discord:

[PolySwarm 🇺🇸 @PolySwarm]

AI-assisted cyberespionage campaign CL-UNK-1211 targeted government systems using custom malware, Linux backdoors, and SysGoRAT.

Explore the tactics behind the intrusions.

https://t.co/BtyY9nW0rm

#CyberSecurity #ThreatIntel #malware

[PolySwarm 🇺🇸 @PolySwarm]

Midnight Mimosa malware has infected Android devices in 150+ countries, exploiting preinstalled firmware to deploy malicious payloads, commit ad fraud, and enable proxy abuse.

https://t.co/eJteOcBuSO

#MidnightMimosa #AndroidMalware #CyberSecurity #ThreatIntel

[PolySwarm 🇺🇸 @PolySwarm]

Chinese state-linked hackers are targeting US critical infrastructure with automated scanning, credential attacks, and cyber espionage tools.

https://t.co/mwwejHWJPN

#CyberSecurity #ThreatIntel #CriticalInfrastructure

[PolySwarm 🇺🇸 @PolySwarm]

@fall_to_aether

[PolySwarm 🇺🇸 @PolySwarm]

ClingSTUN is turning vulnerable IoT and Linux devices into attacker-controlled proxy nodes, abusing public STUN infrastructure for NAT traversal and persistence.

Learn more: https://t.co/2N2NAkda3l

#CyberSecurity #IoT #ClingSTUN #Linux

[PolySwarm 🇺🇸 @PolySwarm]

We're proud to be a data partner of @trmlabs new AI-powered investigation platform, Ardence!

By connecting intelligence from trusted partners, Ardence helps investigators uncover threats & connect the dots.

Learn more: https://t.co/L2BA4kQapt

#ThreatIntelligence #CyberSecurity

[PolySwarm 🇺🇸 @PolySwarm]

New research from @symantec tracks China-nexus threat actor Longlegs exploiting Microsoft SharePoint to deploy Warlock ransomware against critical infrastructure and other targets. We break down the campaign and TTPs:

https://t.co/c6DcTifhWR
#ThreatIntel #Ransomware

[PolySwarm 🇺🇸 @PolySwarm]

Critical infrastructure is part of the battlefield. State-sponsored actors targeting US power, water, telecom & other OT systems can disrupt military operations without ever touching a military network.

https://t.co/cWWG8X4sRa
#OTSecurity #CriticalInfrastructure #ThreatIntel

[PolySwarm 🇺🇸 @PolySwarm]

Lunex MaaS is using #BYOVD to turn security tools against themselves—abusing a vulnerable AMD driver to disable endpoint monitoring before deploying LunexStealer.

We break down the attack chain, persistence mechanisms & IOCs 👇
https://t.co/pEhX8ApKnx

[PolySwarm 🇺🇸 @PolySwarm]

Malware is putting AI in the C2 loop. #CLOSEDQUORUM queries commercial LLMs to choose malicious actions like credential theft, process injection & persistence, reducing reliance on human operators and traditional C2.

https://t.co/hqfn6fGqjW

#Cybersecurity #AI #Malware

[PolySwarm 🇺🇸 @PolySwarm]

#FamousSparrow is targeting government organizations across Latin America with its new modular #SparroWocky backdoor, featuring in-memory execution, BOF support, proxy functionality & more. Read our latest threat analysis: https://t.co/r7GyN7UGCe #Cybersecurity #APT

[PolySwarm 🇺🇸 @PolySwarm]

#BlueMoon is a new exploit kit chaining Chromium V8 vulnerabilities with a Windows kernel flaw.

Four espionage-focused threat actors are already using it to deliver GemStone and ShadowPad.

Read more: https://t.co/AmX92p7ctL

#Cybersecurity #ThreatIntel #Malware

[PolySwarm 🇺🇸 @PolySwarm]

Fake #GTA6 leaks are delivering a nasty malware grab bag.

Including NJRAT, DCRAT, Mercurial Grabber & Chaos ransomware. 🎮☠️

See how attackers are turning gaming hype into malware infections:
https://t.co/QeJqP2RMQE
#Cybersecurity #Malware #InfoSec #ThreatIntel

[PolySwarm 🇺🇸 @PolySwarm]

#BraZetsu is an evolving Windows malware framework linked to #Exilware, profiling compromised systems to identify high-value targets for its access marketplace.

Read our latest analysis & explore related samples:
https://t.co/W64bP7Tdtj
#Malware #ThreatIntel #Cybersecurity

[PolySwarm 🇺🇸 @PolySwarm]

#MirageKitten is targeting software engineers with fake recruiter personas & trojanized coding challenges, deploying two new cross-platform RATs: NodeRabbit & PollCat.

Our latest report breaks down the campaign:
https://t.co/s9fs7O17JD
#Cybersecurity #Malware #ThreatIntel

[PolySwarm 🇺🇸 @PolySwarm]

BlueDelta, overlapping with APT28/Fancy Bear, deployed the HOOKEDGE Windows backdoor against European diplomatic, government & defense targets. Read our blog for more details and related PolySwarm samples:
https://t.co/czAU2j1xF6
#Cybersecurity #APT28 #BlueDelta #Malware

[PolySwarm 🇺🇸 @PolySwarm]

Great time at #FalCon2026 in Las Vegas! Always valuable connecting with the cybersecurity community, catching up with industry peers, & seeing what’s next across the threat landscape.

Thanks to @CrowdStrike for a great event. 👏

#Cybersecurity #ThreatIntelligence #PolySwarm

[CrowdStrike @CrowdStrike]

Fal.Con 2026 closed with incredible keynotes that gave customers a look at what comes next for cybersecurity in the AI era.

CrowdStrike Chief AI & Autonomous Systems Officer Bartley Richardson showed how the Cyber Super Intelligence Lab is bringing together frontier AI, world-class threat intelligence, purpose-built harnesses and the Falcon platform to tilt the advantage back to defenders. He also went deeper into CrowdStrike SafeMind and the adversarial co-evolution, where the best offense is built for one reason: to forge a better defense, both moving at the speed of AI.

Alex Ionescu, our Chief Technology Innovation Officer, followed with the road ahead for the Falcon sensor. A more resilient, flexible, modular architecture that expands the classes of systems the sensor can run on, and the missions it can take on. AI inference running directly on the endpoint with our first small language model running on the NPU. Fifteen years of engineering, and he showed exactly where it goes next.

Together, they made the case that matters most: as AI transforms both offense and defense, security has to evolve with it. We are bringing AI-powered defense closer to where attacks happen, pairing intelligence in the cloud with reasoning on the endpoint to stop threats at machine speed.

What a way to close out an unforgettable week at #FalCon2026

[PolySwarm 🇺🇸 @PolySwarm]

Still going strong. 💪 Six years later, @CrowdStrike's Falcon ML engine remains part of the PolySwarm marketplace, helping protect users with crowdsourced threat intelligence. 🔥

[PolySwarm 🇺🇸 @PolySwarm]

We are thrilled to announce @CrowdStrike participation in PolySwarm’s crowdsourced threat intelligence marketplace. CrowdStrike’s Falcon ML engine is live on our platform! 🔥🚀
https://t.co/bvwDgpWIh0

[PolySwarm 🇺🇸 @PolySwarm]

SLEEPWALKER stays dormant until attackers wake it with a specially crafted network packet—enabling payload delivery, lateral movement & in-memory execution. Discovered by @TheEnergyStory. See PolySwarm’s related samples: https://t.co/T9BFkhYZR3 #Cybersecurity #Malware #Backdoor

[PolySwarm 🇺🇸 @PolySwarm]

UAT-10147 is using AI-assisted workflows to target Windows & Linux servers, deploying the SPECTRE backdoor with credential theft, process injection, rootkit & EDR evasion capabilities. See PolySwarm’s related samples:
https://t.co/CAv1Rbi5Y6 #Cybersecurity #SPECTRE #UAT10147 #AI