Research reports

Contagious Interview steps outside the developer workflow

Jamf Threat Labs uncovers fake macOS installers tied to the same infrastructure behind past Git hook and VS Code task file attacks. September 3 2026 by Jamf Threat Labs By Allen Golbig Introduction Jamf Threat Labs identified a cluster of macOS disk images…

WeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentials

The OpenSourceMalware team spends a lot of time looking at malicious npm packages, and after a while you start seeing the same patterns over and over. So when something new and genuinely different shows up, it’ stopping for. That happened this week when we…

Supply chain

Beyond Lazarus: Organization of DPRK Cyber Capabilities

This research was conducted in partnership between Kudelski Security and Sekoia, with contributions from Clifford (Kudelski Security), Coline C., Saee V. and the Sekoia TDR Team. Key takeaways > The DPRK built its cyber capability as a deliberate extension of…

State-sponsored

[Joint Cybersecurity Advisory] Operation Double Barrel (The Relationship Between a State-Sponsored Threat Actor and the Gunra Ransomware Group)

This technical analysis report was prepared as part of the joint cybersecurity advisory titled “Advisory on Cyberattacks Targeting Korean Citizens and Businesses by State-Sponsored Hacking Groups” issued by the Republic of Korea’s National Intelligence…

RansomwareState-sponsored

Beyond Lazarus: Organization of DPRK cyber capabilities

This article was co-authored by Sekoia’s TDR team and Kudelski Security as part of a joint research effort. Introduction The Democratic People's Republic of Korea (DPRK) has established itself as one of the more prominent state actors in cyberspace. For…

State-sponsored

From fake interviews to malicious repositories: Disrupting Contagious Interview

Software developers and IT professionals are increasingly being targeted through fraudulent recruitment processes that exploit their trust in established development platforms. Candidates are invited to complete seemingly legitimate coding assessments hosted…

BlueDelta Targets Defense and Diplomacy with HOOKEDGE

Insikt Group identified Russian state- BlueDelta delivered HOOKEDGE, a sponsored group BlueDelta (APT28) lightweight batch-script successor targeting government, diplomatic, and to HEADLACE, via macro-enabled defense organizations in Romania, Spain, Word…

Vidar Virtual Machine-Based String Obfuscation

The following sections examine Vidar’s string deobfuscation process, including a lightweight virtual machine and custom stream cipher. Virtual machine deobfuscation In order to obfuscate the malware’s strings in versions 2.x and 3.x, the Vidar developer…

Infostealers

Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances

Cyberespionage has remained a constant feature of Russia’s war against Ukraine. ESET Research has long tracked Gamaredon, one of the most active Russia-aligned advanced persistent threat (APT) groups targeting Ukraine. The group, attributed by the Security…

State-sponsored

public-research/datasurge/report.md at main · deepfield/public-research

Most Mirai forks spread first and ask questions later. They brute-force telnet, chain CVEs, scan port ranges, and race to claim as many devices as possible before the next reboot clears them from memory. Datasurge does not. It has no propagation scanner, no…

Vulnerabilities

Killing me gently: Inside Gentlemen’s EDR killer framework

ESET researchers analyzed the robust EDR-killing toolset of the ransomware-as-a-service gang Gentlemen. Since the beginning of 2026, Gentlemen has emerged as one of the most active gangs in the ransomware ecosystem. The group distinguishes itself through a…

Ransomware

Beware the SparroWock: The backdoor that bites, the commands that catch

ESET Research’s ongoing monitoring of FamousSparrow has borne fruit once again. Our previous public report on FamousSparrow revealed that this China-aligned APT group had developed two new versions of its custom backdoor named SparrowDoor. This time, we…

Malware

The Latest Addition to Turla’s Intelligence Gathering Apparatus

Google Threat Intelligence Group (GTIG) has conducted an in-depth analysis of a .NET backdoor, tracked as STOCKSTAY, that has been continually developed and deployed by the Russia-linked threat actor Turla (aka SUMMIT, Secret Blizzard, VENOMOUS BEAR,…

State-sponsoredMalware

Рагнарёк: F6 исследовала атаки группировки вымогателей VantaCore

Специалисты Лаборатории цифровой криминалистики и исследования вредоносного кода компании F6 сообщают о новой угрозе российскому бизнесу. В августе 2026 года специалистами Лаборатории выявлена активность новой группировки, назвавшей себя VantaCore. Уточнённое…

Chess.com Leak Exposes 7.3 Million Users – Evidence Points to Scraping

7.3 million Chess.com profiles leaked online: the data is genuine, but evidence points to large-scale scraping, not a server breach. Free is a strange price for stolen data, and that’s exactly what makes this listing worth a second look. A 15.5 GB file…

Hackers claim breach of Russian election systems days before parliamentary vote

An anonymous hacking group claimed to have broken into computer systems connected to Russia’s election infrastructure just days before the country begins voting for a new parliament. The group, calling itself CikLeak, said it gained access to systems…

Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection

Anthropic on Thursday revealed it disrupted a campaign mounted by a Russian state-sponsored threat actor that abused Claude for developing an AI-assisted workflow to get ahead of the detection curve. The operation has been attributed to a cyber espionage…

State-sponsoredMalware

Casbaneiro: A Banking Trojan with Distributed Data-Receiving Servers

No excerpt available.

Malware

StealC-Malware-Analysis/Reports/StealC-V2-EN.md at main · Yavuzhanzgen/StealC-Malware-Analysis

This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. StealC V2 Malware Technical Analysis Static Analysis • Dynamic Analysis •…

MalwareInfostealers

Ping32 RMM and ValleyRAT

The VBScript then dropped the legitimate Remote Monitoring and Management (RMM) tool ManageEngine Endpoint Central. Fareed included the IOCs for the following Endpoint Central server IP addresses: 202.61.160.208 202.61.160.202 202.61.160.201 202.61.160.

Malware