Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,259 reports391 publishers75 added in the past week

201–220 of 1,259 reports · page 11 of 63

Added Fri 9 Oct

GitHub · Web page · Added 9 Oct
XenoRAT-Malware-Analysis/Reports/XenoRAT_EN.md at main · Yavuzhanzgen/XenoRAT-Malware-Analysis
This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. XenoRAT Technical Analysis Report Static Analysis • Dynamic Analysis •…
Malware Original (new tab)
K7 Labs · Web page · Published 18 Sep
From Registry-Stored PowerShell to In-Memory Cryptocurrency Mining: A Multi-Stage Infection Chain
We had an opportunity to analyse a system with frequent detection-alerts over powershell execution. Our analysis revealed a multi-stage infection that relied heavily on obfuscation, Registry-based payload storage, covert data delivery, persistence mechanisms,…
Original (new tab)
Zscaler · Web page · Published 30 Sep
Technical Analysis of 2CLoader
Important strings in 2CLoader are decrypted at runtime using an inlined bitwise XOR operation applied to global values. The key in the analyzed sample is 0x37 . Indirect system calls For the Nt* APIs listed below, 2CLoader prefers indirect system calls to…
Malware Original (new tab)
Huntress · Web page · Published 6 Oct
Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack
Acknowledgments: Special thanks to Dray Agha for his extensive contributions to this investigation. Background In September, the Huntress agent was deployed on an organization that had been targeted in an Akira ransomware attack. As we've written about…
Ransomware Original (new tab)

Added Thu 8 Oct

Netskope · Web page · Published 1 Oct
$100k in Crypto Drained by the Underground Operation
Netskope Threat Labs analyzed a crypto-stealing operation that drains victims’ cryptocurrency exchange accounts. An Aotera/Tedy loader injects a Vidar-class stealer into a Windows process, which then launches Chrome or Edge and injects its scripts into the…
Malware Infostealers Original (new tab)
hexastrike.com · Web page · Published 4 Oct
FLEXRAT – ChilloutVR Lures, Shared Secrets, and an OPSEC Hangover
Hexastrike uncovered an undocumented commodity stealer and remote access toolset, which we track as FLEXRAT, distributed through counterfeit game-modification websites. The most prominent lure infrastructure impersonates the ecosystem surrounding ChilloutVR,…
Original (new tab)
SOCRadar · Web page · Published 3 Aug
Introducing DOUBLECUP, a ClickFix Loader Delivering CountLoader and DeviceManager RATs
The DOUBLECUP panel provides multiple utilities to load an operator’s final payload. The first stage drops a steganographic PNG image into the browser’s cache, retrieves its hidden content, and executes the second stage. This second stage decrypts the final…
Malware Original (new tab)

Added Wed 7 Oct

GitHub · Web page · Added 7 Oct
threat-research/ancient-botnet at main · ksi-digital/threat-research
We captured a botnet family that calls itself "ancient" in our SSH/Telnet honeypot. Between 2026-10-04 and 2026-10-05 we observed its delivery chain, three iterations of its dropper, and its C2 behaviour. We confirmed its C2 server live. We have not found a…
Malware Botnets and DDoS Original (new tab)
Mandiant (Google) · Web page · Published 25 Sep
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
As an update to the June 2026 post, ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit, Mandiant and Google Threat Intelligence Group (GTIG) have identified renewed mass exploitation of CVE-2026-35273 by UNC6240 (ShinyHunters), along with…
State-sponsored Vulnerabilities Original (new tab)

Added Tue 6 Oct

Proofpoint · Web page · Published 30 Sep
Hallucinating Credibility: China-Aligned TA419 Impersonates its Way into US AI Policy Circles
In July 2026, a China-aligned threat actor Proofpoint tracks as TA419 conducted multiple credential phishing campaigns impersonating prominent economists and artificial intelligence (AI) policymakers to target AI experts working for US think tanks,…
Original (new tab)
Sysdig · Web page · Published 20 Jul
JADEPUFFER evolves: The agentic threat actor deploys ransomware built to destroy AI models
Falco Feeds extends the power of Falco by giving open source-focused companies access to expert-written rules that are continuously updated as new threats are discovered. learn more Ransomware operators make a bet that their victims don’t keep backups. In a…
Ransomware AI Original (new tab)
Resecurity · Web page · Published 25 Mar
Resecurity | Blacklock Ransomware: A Late Holiday Gift with Intrusion into the Threat Actor's Infrastructure
Dubbed “BlackLock” (aka "El Dorado" or "Eldorado"), the ransomware-as-a-service (RaaS) outfit has existed since March 2024. In Q4 of last year, it increased its number of data leak posts by a staggering 1,425% quarter-on-quarter. According to independent…
Ransomware Original (new tab)
certainity.com · Web page · Added 6 Oct
Inside a Zawoo Team Intrusion
Redaction: hostnames, domains and internal addresses are replaced with <domain> , <HOST> , 10.x.x.x , and the encryptor’s file extension with <EXT> . Details that would identify the victim organisation or its sector have been removed. TL;DR Who: Zawoo Team,…
Original (new tab)
Sysdig · Web page · Published 1 Jul
JADEPUFFER: Agentic ransomware for automated database extortion
Falco Feeds extends the power of Falco by giving open source-focused companies access to expert-written rules that are continuously updated as new threats are discovered. learn more Ransomware has had a human at the keyboard, or at least a human writing its…
Ransomware Original (new tab)
Symantec · Web page · Added 6 Oct
Warlock Ransomware Attackers Hit Water and Telecom Operators
Warlock first came to prominence via the exploitation of a Microsoft SharePoint “ToolShell” exploit chain. Warlock is developed by a China-nexus threat actor Symantec calls Longlegs (aka Storm-2603). Symantec has previously tied this group to older activity…
Ransomware Vulnerabilities Original (new tab)
Microsoft · Web page · Published 25 Sep
Storm-3168: Agentic-driven cloud attacks using compromised service principals
Microsoft Security Research has identified malicious cloud activity associated with JADEPUFFER, a threat actor discovered by Sysdig in July 2026 and reported to be the first documented agentic ransomware operation. Our investigation found an extensive…
Original (new tab)
broadcom.com · Web page · Added 6 Oct
Zawoo Ransomware
Researchers at CERTAINITY recently reported on Zawoo Team, a ransomware operation. The actor has been active since at least early August 2026 and brought its leak site online on 30 August, listing 19 victims at once, concentrated among small and micro…
Ransomware Original (new tab)
AhnLab · Web page · Published 15 Sep
From El Dorado to BlackLock: Inside a Fast-Rising RaaS Threat
BlackLock is a relatively new ransomware group that is believed to have been established around March 2024. Their existence was publicly revealed in June 2024 when the Dedicated Leak Site (DLS) was identified. At that time, information on multiple affected…
Original (new tab)
reliaquest.com · Web page · Published 18 Feb
Threat Spotlight: Inside the World’s Fastest Rising Ransomware Operator — BlackLock
First observed in March 2024, “BlackLock” (aka El Dorado or Eldorado) has rapidly emerged as a major player in the ransomware-as-a-service (RaaS) ecosystem. By Q4 2024, it ranked as the 7th most prolific ransomware group on data-leak sites, fueled by a…
Ransomware Original (new tab)
cofense.com · Web page · Added 6 Oct
From Payment Plan to Ransomware - Inside a Global Group Attack
Highly sophisticated ransomware now targets industries worldwide. Today’s ransomware allows threat actors to infiltrate networks, encrypt confidential data, and hold critical systems hostage until a cryptocurrency ransom is paid. Worse, threat actors often…
Ransomware Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.