Research reports
1,224 reports from 387 publishers45 added in the past week
294 reports, newest added first
Added Wed 29 Apr
PowerPoint Presentation
Unmasking HiddenFace MirrorFace’s most complex backdoor yet Dominik Breitenbacher Malware Researcher Unmasking NOOPDOOR MirrorFace’s most complex backdoor yet Dominik Breitenbacher Malware Researcher Dominik Breitenbacher • Malware researcher @ ESET since…
State-sponsoredMalware
Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization
Recent cyberattacks attributed to Iranian threat actors extend beyond typical network disruption. Rather than an isolated incident of sabotage, this type of attack sits within a broader context defined by Iran's reliance on asymmetric retaliation and…
Malware
MuddyWater: Snakes by the riverbank
ESET researchers have identified new MuddyWater activity primarily targeting organizations in Israel, with one confirmed target in Egypt. MuddyWater, also referred to as Mango Sandstorm or TA450, is an Iran-aligned cyberespionage group known for its…
State-sponsoredMalware
Turla/Belugasturgeon Compromises Government
Turla, identified internally by Accenture Cyber Threat Intelligence as Belugasturgeon, continues to target government organizations using custom malware, including updated legacy tools, designed to maintain persistence through overlapping backdoor access…
State-sponsoredMalware
GlassWorm Loader Hits Open VSX via Developer Account Compromise
Socket proactively blocks malicious open source packages in your code. Install Socket’s Threat Research team identified a developer-compromise supply chain attack distributed via the Open VSX Registry, specifically a compromise of the developer’s publishing…
Malware
Added Sun 26 Apr
Bumblebee: increasing its capacity and evolving its TTPs
The spring of 2022 saw a spike in activity of Bumblebee loader, a recent threat that has garnered a lot of attention due to its many links to several well-known malware families. In this piece we outline the conclusions of our research into this piece of…
Malware
Added Sat 25 Apr
The Evolution of Transparent Tribe’s New Malware
The ElizaRAT campaigns first executed the same function to verify that the system was set to India Standard Time, indicating that the campaigns targeted Indian systems. Transparent Tribe, otherwise known as APT36, is a Pakistan-affiliated threat actor that…
State-sponsoredMalware
Added Fri 24 Apr
Charger Malware Calls and Raises the Risk on Google Play
Several weeks ago, Check Point Mobile Threat Prevention detected and quarantined the Android device of an unsuspecting customer employee who downloaded and installed a 0day mobile ransomware from Google Play dubbed “Charger.” This incident demonstrates how…
RansomwareMalwareMobile
The Emergence of the New Azorult 3.3
During the past week, Check Point Research spotted a new version of Azorult in the wild being delivered through the RIG exploit kit, as well as other sources. Azorult is a long known information stealer and malware downloader, with this particular version…
MalwareInfostealers
Added Thu 23 Apr
iranian-hackers-targeting-turkey-and-arabian-peninsula-in-new-malware-campaign
Buy this domain. Network Security System Managed Security Service Providers Cloud Cyber Security Solutions Network Security Solutions Cyber Security Managed Services
Malware
Turning Telegram toxic: ‘ToxicEye’ RAT is the latest to use Telegram for command & control
Remote access trojan exploits Telegram communications to steal data from victims and update itself to perform additional malicious activities Research by: Omer Hofman Telegram, the cloud-based IM platform has enjoyed a surge in popularity this year because of…
Malware
Albiriox Exposed: A New RAT Mobile Malware Targeting Global Finance and Crypto Wallets
Two-stage deployment chain: The malware leverages dropper applications distributed through social engineering lures, combined with packing techniques, to evade static detection and deliver its payload. On-Device Fraud capabilities: Albiriox exhibits the core…
MalwareMobile
When Trust Becomes a Weapon: Google Cloud Storage Phishing Deploying Remcos RAT
Modern phishing campaigns increasingly abuse legitimate services. Cloud platforms, file-sharing tools, trusted domains, and widely used SaaS applications are now part of the attacker’s toolkit. Instead of breaking trust, attackers borrow it. This shift…
MalwarePhishing
New destructive wiper malware deployed in Ukraine
Cybersecurity company ESET warned about the discovery of a 3rd destructive wiper malware deployed in Ukraine. ESET first observed this new malware dubbed CaddyWiper on Monday, around 9h38 UTC. CaddyWiper erases user data and partition information from…
Malware
Mirax: a new Android RAT turning infected devices into potential residential proxy nodes
New Maas spreading: Mirax has emerged as a sophisticated Malware-as-a-Service (MaaS) offering, specifically targeting Android devices across Europe. It is actively marketed and distributed through underground malware forums. At the time of writing, Cleafy…
MalwareMobile
Threat actors target recent Election Results
Recently, we saw a tweet about a document claiming to be reporting about the recent “Indian Election Results”. On analysis, we found that it was dropping a “Crimson RAT” payload. This RAT, mostly used by the Transparent Tribe APT, is capable of stealing…
State-sponsoredMalware
7 Years of Scarlet Mimic’s Mobile Surveillance Campaign Targeting Uyghurs
In 2022, Check Point Research (CPR) observed a new wave of a long-standing campaign targeting the Uyghur community, a Turkic ethnic group originating from Central Asia, one of the largest minority ethnic groups in China. This malicious activity, which we…
MalwareMobile
In the Wild: Malware Prototype with Embedded Prompt Injection
In this write-up we present a malware sample found in the wild that boasts a novel and unusual evasion mechanism — an attempted prompt injection (”Ignore all previous instructions…”) aimed to manipulate AI models processing the sample. The sample gives the…
MalwareAI
Added Wed 22 Apr
Vicious Panda: The COVID Campaign
Check Point Research discovered a new campaign against the Mongolian public sector, which takes advantage of the current Coronavirus scare, in order to deliver a previously unknown malware implant to the target. A closer look at this campaign allowed us to…
State-sponsoredMalware
Added Tue 21 Apr
VSCode Security: Malicious Extensions Detected- More Than 45,000 Downloads- PII Exposed, and Backdoors Enabled
VSCode (short for Visual Studio Code) is a popular and free source code editor developed by Microsoft. It’s an efficient and customizable coding environment that can support a wide range of programming languages, frameworks, and tools. VSCode has gained muc
Malware
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.