Research reports

Storm-3168: Agentic-driven cloud attacks using compromised service principals

Microsoft Security Research has identified malicious cloud activity associated with JADEPUFFER, a threat actor discovered by Sysdig in July 2026 and reported to be the first documented agentic ransomware operation. Our investigation found an extensive…

Zawoo Ransomware

Researchers at CERTAINITY recently reported on Zawoo Team, a ransomware operation. The actor has been active since at least early August 2026 and brought its leak site online on 30 August, listing 19 victims at once, concentrated among small and micro…

Ransomware

From El Dorado to BlackLock: Inside a Fast-Rising RaaS Threat

BlackLock is a relatively new ransomware group that is believed to have been established around March 2024. Their existence was publicly revealed in June 2024 when the Dedicated Leak Site (DLS) was identified. At that time, information on multiple affected…

Threat Spotlight: Inside the World’s Fastest Rising Ransomware Operator — BlackLock

First observed in March 2024, “BlackLock” (aka El Dorado or Eldorado) has rapidly emerged as a major player in the ransomware-as-a-service (RaaS) ecosystem. By Q4 2024, it ranked as the 7th most prolific ransomware group on data-leak sites, fueled by a…

Ransomware

From Payment Plan to Ransomware - Inside a Global Group Attack

Highly sophisticated ransomware now targets industries worldwide. Today’s ransomware allows threat actors to infiltrate networks, encrypt confidential data, and hold critical systems hostage until a cryptocurrency ransom is paid. Worse, threat actors often…

Ransomware

Unmasking EvilTokens: Getting to the root of device code phishing

By Microsoft Threat Intelligence, Microsoft Defender Experts, Microsoft Security Research Following its emergence in February 2026, EvilTokens quickly became one of the most widely used phishing-as-a-service (PhaaS) platforms, providing cybercriminals with AI…

Phishing

The Closed Quorum: Inside the first reported autonomous AI C2 implant

CLOSEDQUORUM, a malware binary discovered through Cisco Talos’ CAIRN project, exhibits fully autonomous command and control (C2). While we do not have confirmation of in-the-wild deployment, artifacts from the binary were used to connect the developer to…

Malware

Amadey-Malware-Analysis/Reports/Amadey_EN.md at main · Yavuzhanzgen/Amadey-Malware-Analysis

This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. Amadey Technical Analysis Report Static Analysis • Dynamic Analysis •…

Malware

public-research/drifter/report.md at main · deepfield/public-research

What distinguishes Drifter is how it hides. Its C2 domains are named after IP camera brands ( cctv[.]su , nvms9000[.]su ), chosen to blend with the traffic of devices that

Botnets and DDoS

RenEngine Loader and HijackLoader: Dual-Stage Attack Chain

Our analysis indicates that more than 400,000 global victims have been impacted, with the operation continuing to infect over 5,000 new victims per day. The threat actors blend compelling social‑engineering techniques with a stealthy, multi‑stage execution…

Malware

ValleyRAT-Malware-Analysis/Reports/ValleyRat-EN.md at main · Yavuzhanzgen/ValleyRAT-Malware-Analysis

This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. ValleyRAT Technical Analysis Report Static Analysis • Dynamic Analysis •…

Malware

The road to Xloader

Xloader is a stealer that was built on the FormBook malware family that first emerged in 2016; the rebranded Xloader was introduced in 2020. It is highly sophisticated malware that uses a combination of anti-analysis and obfuscation techniques, and it’s…

Malware

KoiLoader-Malware-Analysis/Reports/KoiLoader-EN.md at main · Yavuzhanzgen/KoiLoader-Malware-Analysis

This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. KoiLoader Technical Analysis Report Static Analysis • Dynamic Analysis •…

Malware

public-research/potassium/report.md at main · deepfield/public-research

Content warning: This report quotes malware artifacts verbatim, including domain names, URL paths, campaign tags, and embedded strings chosen by the threat actor. Some contain crude or offensive language, including an antisemitic slur. These are reproduced…

Botnets and DDoS

Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit

Acronis Threat Research Unit (TRU) uncovered a multinational campaign in which a Chinese-speaking threat actor, tracked as Red Heron, rapidly weaponized CVE-2026-60004 to compromise internet-facing instances of Gitea, a self-hosted source-code management…

MalwareVulnerabilities

XWorm-Malware-Analysis/Reports/XWorm_v3.1_Report_EN.md at main · Yavuzhanzgen/XWorm-Malware-Analysis

This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples have been analyzed in an isolated laboratory environment. XWorm V3.1 Malware T Static Analysis • Dynamic Analysis • Reverse…

Malware

XoriumStealer-Malware-Analysis/Reports/XoriumStealer-EN.md at main · Yavuzhanzgen/XoriumStealer-Malware-Analysis

This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. Xorium Stealer Malware T Static Analysis • Dynamic Analysis • Reverse…

Malware

Shattering the Dream - When a Job Offer Becomes a Zero-Day Attack

Check Point Research is tracking a long‑running campaign called Operation Dream Job, targeting organizations worldwide, with a particular focus on the defense sector. The campaign is affiliated to DPRK-linked Lazarus group and its latest wave focuses on the…

Vulnerabilities

NSA Joins FBI and Others in Releasing Guidance to Defend Against Gunra Ransomware

FORT MEADE, Md. — Today, the National Security Agency (NSA) joins the Federal Bureau of Investigation (FBI) and others in releasing a joint Cybersecurity Advisory, “#StopRansomware: Gunra Ransomware,” as an ongoing effort to publish information about…

RansomwareTakedowns and arrests

Don’t Call Us, We’ll Call Your APIs

Following disclosure of the TraderTraitor attack against LayerZero Labs in April 2026, SentinelOne identified an additional victim with the same macOS backdoors. Our analysis explores the mechanics of these backdoors and the expanded targeting against a…

Malware