Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,233 reports388 publishers50 added in the past week

181–200 of 353 reports · page 10 of 18 · Clear filters

Added Thu 7 May

Check Point · Web page · Published 17 Nov
Malware Spotlight – Into the Trash: Analyzing LitterDrifter
Gamaredon, also known as Primitive Bear, ACTINIUM, and Shuckworm, is a unique player in the Russian espionage ecosystem that targets a wide variety of almost exclusively Ukrainian entities. While researchers often struggle to uncover evidence of Russian…
State-sponsored Malware Original (new tab)
Cisco Talos · Web page · Published 5 May
UAT-8302 and its box full of malware
Cisco Talos is disclosing UAT-8302, a sophisticated, China-nexus advanced persistent threat (APT) group targeting government entities in South America since at least late 2024 and government agencies in southeastern Europe in 2025. After successful…
State-sponsored Malware Original (new tab)

Added Wed 6 May

Darktrace · Web page · Published 16 Apr
Inside ZionSiphon: Darktrace’s Analysis of OT Malware Targeting Israeli Water Systems
What is ZionSiphon? Darktrace recently analyzed a malware sample, which identifies itself as ZionSiphon. This sample combines several familiar host-based capabilities, including privilege escalation, persistence, and removable-media propagation, with…
Malware Original (new tab)
gdatasoftware.com · Web page · Published 17 Mar
HijackLoader: Free Games, Costly Consequences, and Loads of Malware
PiviGames, a popular Spanish gaming platform is well-known in the gaming community for providing download links to pirated PC games. Such a platform offers attractive content and it has built a reputation within the gaming community over the years. However,…
Malware Original (new tab)
Trend Micro · Web page · Published 21 Apr
Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories
Void Dokkaebi (aka Famous Chollima) has evolved beyond single-target social engineering into a self-propagating supply chain threat. A compromised developer’s repository becomes an infection vector for the next wave of victims, creating a worm-like…
Malware Original (new tab)
intel.breakglass.tech · Web page · Published 11 Apr
We Dumped a Live Kimsuky C2 and Recovered Every Stage of the Kill Chain: CHM Dropper, VBScript Stager, PowerSh
#Infrastructure: 79 Domains Across 5 IPs ##The DAOU Staging Server (27.102.137.38 — 37 domains) ##The Fast-Flux Farm (118.194.249.109 — 40 domains) ##The Naver Phishing Farm (27.102.137.150 — 12+ domains, LIVE) #Related Kimsuky Sample #Detection Guidance…
State-sponsored Malware Original (new tab)
hexastrike.com · Web page · Published 18 Apr
Cloned, Loaded, and Stolen: How 109 Fake GitHub Repositories Delivered SmartLoader and StealC
We identified 109 malicious GitHub repositories across 103 accounts that impersonate legitimate projects and redirect users to embedded ZIP files containing a LuaJIT-based SmartLoader stage. The campaign appears to be operated by a single threat actor or…
Malware Infostealers Original (new tab)
zynap.com · Web page · Published 24 Mar
Defensive Rootkits: Engineering Kernel-Level Malware Analysis from Ring 0
We are in the middle of the next transition. This time, the failures are silent. Modern malware is industrialized: sold as-a-service, rapidly iterated, and designed to scale. At the same time, defenders increasingly depend on automated pipelines. When those…
Malware Infostealers Original (new tab)
Darktrace · Web page · Published 26 Mar
Tracking & Detecting GhostSocks Malware
Software supply-chain attacks now represent the primary threat shaping the 2026 security landscape. Rather than relying on exploits at the perimeter, attackers are targeting the connective tissue of modern engineering environments: package managers, CI/CD…
Malware Supply chain Original (new tab)
Huntress · Web page · Published 4 Mar
“Malware, from the Outside!”: How a Threat Actor Used Fake OpenClaw Installers to Infect Systems with GhostSocks and Information Stealers
Special thanks to Greig Bailey for their effort in triaging and responding to this activity, and Aaron Deal for his tireless review and edits of this blog. Summary Information stealers continue to be an initial access vector for severe attacks against…
Malware Infostealers Original (new tab)
Trend Micro · Web page · Published 4 May
Quasar Linux (QLNX) – A Silent Foothold in the Supply Chain: Inside a Full-Featured Linux RAT With Rootkit, PAM Backdoor, Credential Harvesting Capabilities
Quasar Linux RAT (QLNX) is a comprehensive Linux implant that combines remote access capabilities with advanced evasion, persistence, keylogging, and credential harvesting features. The malware carries embedded C source code for both its PAM backdoor and…
Malware Phishing Supply chain Original (new tab)
zanezhub.github.io · Web page · Published 19 Apr
WannaCry Malware Analysis - How YOU Could have Saved the World ꩜
Everyone knows and has heard about the WannaCry ransomware. One of the biggests and most well known attacks to ever happen in cybersecurity, the range was so big that even people outside of the cybersecurity community knew about it. WannaCry? :’( If somehow…
Malware Original (new tab)
Gen Digital · Web page · Added 6 May
When Malware Authors Study Algebra: The Group Theory Inside Bedep's DGA
TLDR: Bedep was a malware family active mainly in 2014 and 2015 that used an unusually sophisticated domain generation algorithm, or DGA, to hide its command-and-control infrastructure. Instead of relying only on the date, it used real foreign exchange rates…
Malware Original (new tab)

Added Tue 5 May

Group-IB · Web page · Added 5 May
We see you, Gozi
The ISFB Trojan also known as Gozi ISFB first appeared in 2014. It is based on Gozi, which was released in 2006 and developed by Russian threat actors. Gozi was designed to collect network traffic and steal credentials from browsers and email clients. It has…
Malware Original (new tab)
Group-IB · Web page · Added 5 May
Craxs Rat, the master tool behind fake app scams and banking fraud
Since April 2023, a series of scams involving fake Android apps have targeted Singapore. These fake apps are banking trojans used to harvest victims’ banking credentials and personal information, as well as to take control of their devices. In this specific…
Malware Mobile Original (new tab)
logpoint.com · Web page · Added 5 May
Emerging Threat: AgentTesla – A Review and Detection Strategies
It has been spreading rapidly in the wild with CISA listing it in the Top Malware Strains list for the year 2021 and it still is in the top 10 list on MalwareBazaar as of March 2023. The operators of AgentTesla are providing Malware-as-a-Service with various…
Malware Original (new tab)
Group-IB · Web page · Added 5 May
IcedID: new malware version
What did malware analysts think when they first heard the words IcedID and BokBot? Undoubtedly things like: web injects, proxy servers, quick version updates… The updates were sometimes so fast that while analysts were studying the current version, a new one…
Malware Original (new tab)
Group-IB · Web page · Added 5 May
Group-IB uncovers Android Trojan named «Gustuff» capable of targeting more than 100 global banking apps, cryptocurrency and marketplace applications
Group-IB, an international company that specializes in preventing cyberattacks, has detected activity of Gustuff a mobile Android Trojan, which includes potential targets of customers in leading international banks, users of cryptocurrency services, popular…
Malware Mobile Original (new tab)
ThreatFabric · Web page · Published 1 Oct
BianLian - from rags to riches, the malware dropper that had a dream
Recently, while analyzing our daily portion of APK files, searching for the new banking related threats, we found a sample that was standing out among the others. While being seemingly benign, the sample was downloading and installing the infamous Anubis…
Malware Mobile Original (new tab)
Group-IB · Web page · Added 5 May
Godfather Trojan - mobile banking malware that is impossible to refuse
The Android banking Trojan Godfather is currently being utilized by cybercriminals to attack users of popular financial services across the globe. Godfather is designed to allow threat actors to harvest login credentials for banking applications and other…
Malware Mobile Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.