Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,259 reports391 publishers75 added in the past week

181–200 of 1,259 reports · page 10 of 63

Added Wed 14 Oct

dev.to · Web page · Published 27 May
Cryptojacking Abusing AI Chatbot Recommendations — A New Delivery Vector Beyond Search Poisoning
Cryptojacking Abusing AI Chatbot Recommendations — A New Delivery Vector Beyond Search Poisoning LLM-recommended download links lead to malicious sites; a GPU-targeting mining, remote-access, and ransomware composite campaign Dennis Kim (김호광 / HoKwang Kim)…
Original (new tab)
tenable.com · Web page · Published 29 Jul
Coordinated "cyberattack" on U.S. water utilities: What you need to know
A coordinated cyber attack disrupted water and wastewater systems in at least 12 U.S. states, including more than 30 Minnesota communities. Here is what defenders need to know about the attack so far. This FAQ also details recent cyberactivity targeting…
Original (new tab)
Microsoft · Web page · Published 28 May
The Gentlemen ransomware: Dissecting a self-propagating Go encryptor
Ransomware that combines robust encryption with rapid lateral movement significantly increases the risk and impact of an attack. The Gentlemen ransomware is a ransomware-as-a-service (RaaS) threat that is distinguished by its ability to pair its strong…
Ransomware Original (new tab)
LevelBlue · Web page · Published 7 May
Unmasking a Multi-Stage Loader: AutoIt Abuse Leading to Vidar Stealer Command-and-Control Communication
LevelBlue’s Security Services issues Threat Analysis reports to inform on impacting threats. The Threat Analysis reports investigate these threats and provide practical recommendations for protecting against them. In this Threat Analysis report, we…
Malware Infostealers Original (new tab)
sycope.com · Web page · Published 16 Apr
Dead Drop Resolver – What It Is and How It Works
What is a Dead Drop Resolver? Dead Drop Resolver is a specialized program or technique that automatically detects and reads hidden data—so-called “dead drops.” These digital stashes can be scattered across hard-to-reach, unconventional places on the internet,…
Original (new tab)
Unit 42 · Web page · Published 7 Jul
Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation
In April 2026, Unit 42 researchers identified a financially motivated campaign delivering Vidar stealer and the XMRig cryptocurrency miner to consumer and small- and medium-sized business victims worldwide. Attackers lure victims via malvertising to pages for…
Malware Infostealers Original (new tab)
dispel.com · Web page · Added 14 Oct
When 30 Water Utilities Get Hit in 48 Hours, the Lesson Isn’t “Better Malware” — It’s “No Front Door”
Originally published July 31, 2026. Last updated August 10, 2026 as reporting expanded beyond Minnesota and identified the controller families and configuration changes involved. Key Takeaway: In July 2026, a coordinated attack disrupted more than 30…
Malware Original (new tab)

Added Tue 13 Oct

Elastic Security Labs · Web page · Published 14 Apr
Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT
If you're interested in a deeper technical analysis of PHANTOMPULSE itself, covering its injection engines, persistence internals, and C2 protocol in greater detail, check out this follow-on analysis of the PHANTOMPULSE malware. Preamble Elastic Security Labs…
Malware Original (new tab)
Censys · Web page · Published 7 Oct
DarkSword/Coruna Open Directory Finding Report
Open directories on five hosts exposed the full DarkSword/Coruna iOS exploit-and-harvest platform, from the C2 delivery server to the per-wallet theft modules. The infrastructure was still in use at triage time. The platform runs a commercial…
Vulnerabilities Original (new tab)
Microsoft · Web page · Published 28 Sep
NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
Microsoft Threat Intelligence has identified NeedyMantis, a modular post-compromise malware family observed in a limited number of targeted operations affecting telecommunications organizations, universities, medical nonprofits, intergovernmental…
Malware Original (new tab)

Added Sat 10 Oct

JPCERT/CC · PDF · Added 10 Oct
JSAC2026_1_3_joseph_chen_en.pdf
The “I-S00N” Leak • A massive leak of internal documents and data from a Chinese campany “i-Soon” (Anxun) found on a Github repository on Feburary 2024 • Leaks of the company including Conducted widespread cyber espionage campaigns Government Operated as a…
State-sponsored Original (new tab)
Darktrace · Web page · Published 3 Feb
Darktrace Malware Analysis: Unpacking SnappyBee
The aim of this blog is to be an educational resource, documenting how an analyst can perform malware analysis techniques such as unpacking. This blog will demonstrate the malware analysis process against well-known malware, in this case SnappyBee. SnappyBee…
State-sponsored Malware Original (new tab)
Lumen Black Lotus Labs · Web page · Added 10 Oct
JDY Botnet: How IoT and SOHO Devices Are Exploited
Expanded JDY IoT and SOHO botnet enables rapid vulnerability exploitation Published on Jun 10, 2026 | 11 minute read Black Lotus Labs® recently identified a significant resurgence of the JDY botnet, a covert reconnaissance network tied to China-nexus threat…
Vulnerabilities Botnets and DDoS Original (new tab)
Microsoft · Web page · Published 29 Sep
Star Blizzard refines phishing and malware delivery with the RedFlick technique
Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a novel malware delivery technique that…
State-sponsored Malware Phishing Original (new tab)
Unit 42 · Web page · Published 24 Feb
Data From Chinese Security Services Company i-Soon Linked to Previous Chinese APT Campaigns
On Feb. 16, 2024, someone uploaded data to GitHub that included possible internal company communications, sales-related materials and product manuals belonging to the Chinese IT security services company i-Soon, also known as Anxun Information Technology. The…
State-sponsored Original (new tab)
bushidotoken.net · Web page · Published 22 Feb
Lessons from the iSOON Leaks
A Chinese Ministry of Public Security (MPS) contractor called iSOON (also known as Anxun Information) that specializes in network penetration research and related services has had its data leaked to GitHub. Based on the level of detail, leaked chat logs,…
Original (new tab)
kelacyber.com · Web page · Published 7 Mar
I-Soon Leak: Kela’s Insights
On February 16, 2024, a repository titled “I-S00N” was uploaded to Github, allegedly intended to expose insider information about I-Soon (Anxun Information Technology Co., 安洵信息技术有限公司,i-soon[.]net), a Chinese technology company in the cybersecurity field. The…
Original (new tab)
IBM X-Force · Web page · Published 9 Apr
IBM X-Force Discovers New Sheriff Backdoor used to target Ukraine
IBM X-Force discovered a set of previously unknown malware (Sheriff backdoor) used in a cyber espionage attack against an entity within Ukraine’s defense sector in the first half of 2024. The threat actor used a popular news portal in Ukraine, ukr.net, to…
State-sponsored Malware Original (new tab)
GitHub · Web page · Added 10 Oct
GitHub - yankywilson/jdy-botnet-threat-analysis: Defensive CTI analysis of the JDY reconnaissance botnet (China-nexus, Volt Typhoon / KV lineage, MITRE G1017): MIPS64 implant reverse engineering, infrastructure enumeration, tiered intelligence reporting, Sigma/YARA detections, and a tasking decryptor. TLP:CLEAR.
A complete defensive analysis of the JDY botnet: reverse engineering of the implant, enumeration of its control infrastructure, three-tier intelligence reporting, deployable detections, and a working tasking decryptor. JDY is a China-nexus reconnaissance…
State-sponsored Malware Botnets and DDoS Original (new tab)

Added Fri 9 Oct

ctrlaltintel.com · Web page · Published 20 Aug
From Campus to C2: Tracking a Persistent Chinese Operation Against Vietnamese Universities
This personal research is based solely on open-source intelligence (OSINT) and technical analysis of available data. The attribution of activity to suspected Chinese threat actors is made on the basis of observed infrastructure, malware, and tactics,…
Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.