Research reports
1,224 reports from 387 publishers45 added in the past week
294 reports, newest added first
Added Wed 6 May
Defensive Rootkits: Engineering Kernel-Level Malware Analysis from Ring 0
We are in the middle of the next transition. This time, the failures are silent. Modern malware is industrialized: sold as-a-service, rapidly iterated, and designed to scale. At the same time, defenders increasingly depend on automated pipelines. When those…
MalwareInfostealers
Tracking & Detecting GhostSocks Malware
Software supply-chain attacks now represent the primary threat shaping the 2026 security landscape. Rather than relying on exploits at the perimeter, attackers are targeting the connective tissue of modern engineering environments: package managers, CI/CD…
MalwareSupply chain
“Malware, from the Outside!”: How a Threat Actor Used Fake OpenClaw Installers to Infect Systems with GhostSocks and Information Stealers
Special thanks to Greig Bailey for their effort in triaging and responding to this activity, and Aaron Deal for his tireless review and edits of this blog. Summary Information stealers continue to be an initial access vector for severe attacks against…
MalwareInfostealers
Quasar Linux (QLNX) – A Silent Foothold in the Supply Chain: Inside a Full-Featured Linux RAT With Rootkit, PAM Backdoor, Credential Harvesting Capabilities
Quasar Linux RAT (QLNX) is a comprehensive Linux implant that combines remote access capabilities with advanced evasion, persistence, keylogging, and credential harvesting features. The malware carries embedded C source code for both its PAM backdoor and…
MalwarePhishingSupply chain
WannaCry Malware Analysis - How YOU Could have Saved the World ꩜
Everyone knows and has heard about the WannaCry ransomware. One of the biggests and most well known attacks to ever happen in cybersecurity, the range was so big that even people outside of the cybersecurity community knew about it. WannaCry? :’( If somehow…
Malware
When Malware Authors Study Algebra: The Group Theory Inside Bedep's DGA
TLDR: Bedep was a malware family active mainly in 2014 and 2015 that used an unusually sophisticated domain generation algorithm, or DGA, to hide its command-and-control infrastructure. Instead of relying only on the date, it used real foreign exchange rates…
Malware
Added Tue 5 May
We see you, Gozi
The ISFB Trojan also known as Gozi ISFB first appeared in 2014. It is based on Gozi, which was released in 2006 and developed by Russian threat actors. Gozi was designed to collect network traffic and steal credentials from browsers and email clients. It has…
Malware
Craxs Rat, the master tool behind fake app scams and banking fraud
Since April 2023, a series of scams involving fake Android apps have targeted Singapore. These fake apps are banking trojans used to harvest victims’ banking credentials and personal information, as well as to take control of their devices. In this specific…
MalwareMobile
Emerging Threat: AgentTesla – A Review and Detection Strategies
It has been spreading rapidly in the wild with CISA listing it in the Top Malware Strains list for the year 2021 and it still is in the top 10 list on MalwareBazaar as of March 2023. The operators of AgentTesla are providing Malware-as-a-Service with various…
Malware
IcedID: new malware version
What did malware analysts think when they first heard the words IcedID and BokBot? Undoubtedly things like: web injects, proxy servers, quick version updates… The updates were sometimes so fast that while analysts were studying the current version, a new one…
Malware
Group-IB uncovers Android Trojan named «Gustuff» capable of targeting more than 100 global banking apps, cryptocurrency and marketplace applications
Group-IB, an international company that specializes in preventing cyberattacks, has detected activity of Gustuff a mobile Android Trojan, which includes potential targets of customers in leading international banks, users of cryptocurrency services, popular…
MalwareMobile
BianLian - from rags to riches, the malware dropper that had a dream
Recently, while analyzing our daily portion of APK files, searching for the new banking related threats, we found a sample that was standing out among the others. While being seemingly benign, the sample was downloading and installing the infamous Anubis…
MalwareMobile
Godfather Trojan - mobile banking malware that is impossible to refuse
The Android banking Trojan Godfather is currently being utilized by cybercriminals to attack users of popular financial services across the globe. Godfather is designed to allow threat actors to harvest login credentials for banking applications and other…
MalwareMobile
Added Sun 3 May
Nemty 1.6 Ransomware Released and Pushed via RIG Exploit Kit
The RIG exploit kit is now pushing a cocktail of malware that includes a new variant of the Nemty Ransomware. First spotted by exploit kit researcher mol69, a malvertising campaign is redirecting users to the RIG exploit kit to target enterprise users who are…
RansomwareMalwareVulnerabilities
Winnti: More than just Windows and Gates
The Winnti malware family was first reported in 2013 by Kaspersky Lab¹. Since then, threat actors leveraging Winnti malware have victimized a diverse set of targets for varied motivations. While the name ‘Winnti’ in public reporting was previously used to…
Malware
Added Fri 1 May
UAC-0056 cyberattack on Ukrainian authorities using GraphSteel and GrimPlant malware
The Governmental Computer Emergency Response Team of Ukraine CERT-UA received information on the distribution of e-mails on the topic "Wage arrears" among government agencies of Ukraine. Attached to the letter is the document "Wage arrears.xls", which…
Malware
Kimsuky disguised as a Korean company signed with a valid certificate to distribute Troll Stealer…
S2W threat research and intelligence center Talon has hunted for and analyzed a sample of what is believed to be a new malware from the Kimsuky group on VirusTotal. — The malware was found to be distributed from a page that redirects users to a specific site…
State-sponsoredMalwareInfostealers
Gustuff: Weapon of Mass Infection
“Serious product for individuals with skills and experience,” — that’s how Gustuff was advertised by its seller nicknamed Bestoffer on an underground forum in December 2018. Although the Trojan was developed by a Russian-speaking cybercriminal, Gustuff…
Malware
How UNC6692 Employed Social Engineering to Deploy a Custom Malware Suite
Google Threat Intelligence Group (GTIG) identified a multistage intrusion campaign by a newly tracked threat group, UNC6692, that leveraged persistent social engineering, a custom modular malware suite, and deft pivoting inside the victim’s environment to…
State-sponsoredMalware
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.