Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,233 reports388 publishers50 added in the past week

201–220 of 353 reports · page 11 of 18 · Clear filters

Added Sun 3 May

BleepingComputer · Web page · Published 11 Oct
Nemty 1.6 Ransomware Released and Pushed via RIG Exploit Kit
The RIG exploit kit is now pushing a cocktail of malware that includes a new variant of the Nemty Ransomware. First spotted by exploit kit researcher mol69, a malvertising campaign is redirecting users to the RIG exploit kit to target enterprise users who are…
Ransomware Malware Vulnerabilities Original (new tab)
Medium · Web page · Published 21 May
Winnti: More than just Windows and Gates
The Winnti malware family was first reported in 2013 by Kaspersky Lab¹. Since then, threat actors leveraging Winnti malware have victimized a diverse set of targets for varied motivations. While the name ‘Winnti’ in public reporting was previously used to…
Malware Original (new tab)

Added Fri 1 May

app.box.com · Web page · Added 1 May
UAC-0056 cyberattack on Ukrainian authorities using GraphSteel and GrimPlant malware
The Governmental Computer Emergency Response Team of Ukraine CERT-UA received information on the distribution of e-mails on the topic "Wage arrears" among government agencies of Ukraine. Attached to the letter is the document "Wage arrears.xls", which…
Malware Original (new tab)
ESET · PDF · Added 1 May
gopherwhisper-burrow-full-malware.pdf
Malware Original (new tab)
Medium · Web page · Published 8 Feb
Kimsuky disguised as a Korean company signed with a valid certificate to distribute Troll Stealer…
S2W threat research and intelligence center Talon has hunted for and analyzed a sample of what is believed to be a new malware from the Kimsuky group on VirusTotal. — The malware was found to be distributed from a page that redirects users to a specific site…
State-sponsored Malware Infostealers Original (new tab)
Group-IB · Web page · Added 1 May
Gustuff: Weapon of Mass Infection
“Serious product for individuals with skills and experience,” — that’s how Gustuff was advertised by its seller nicknamed Bestoffer on an underground forum in December 2018. Although the Trojan was developed by a Russian-speaking cybercriminal, Gustuff…
Malware Original (new tab)
Mandiant (Google) · Web page · Published 23 Apr
How UNC6692 Employed Social Engineering to Deploy a Custom Malware Suite
Google Threat Intelligence Group (GTIG) identified a multistage intrusion campaign by a newly tracked threat group, UNC6692, that leveraged persistent social engineering, a custom modular malware suite, and deft pivoting inside the victim’s environment to…
State-sponsored Malware Original (new tab)

Added Wed 29 Apr

JPCERT/CC · PDF · Added 29 Apr
PowerPoint Presentation
Unmasking HiddenFace MirrorFace’s most complex backdoor yet Dominik Breitenbacher Malware Researcher Unmasking NOOPDOOR MirrorFace’s most complex backdoor yet Dominik Breitenbacher Malware Researcher Dominik Breitenbacher • Malware researcher @ ESET since…
State-sponsored Malware Original (new tab)
Unit 42 · Web page · Published 16 Mar
Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization
Recent cyberattacks attributed to Iranian threat actors extend beyond typical network disruption. Rather than an isolated incident of sabotage, this type of attack sits within a broader context defined by Iran's reliance on asymmetric retaliation and…
Malware Original (new tab)
ESET · Web page · Added 29 Apr
MuddyWater: Snakes by the riverbank
ESET researchers have identified new MuddyWater activity primarily targeting organizations in Israel, with one confirmed target in Egypt. MuddyWater, also referred to as Mango Sandstorm or TA450, is an Iran-aligned cyberespionage group known for its…
State-sponsored Malware Original (new tab)
accenture.com · Web page · Added 29 Apr
Turla/Belugasturgeon Compromises Government
Turla, identified internally by Accenture Cyber Threat Intelligence as Belugasturgeon, continues to target government organizations using custom malware, including updated legacy tools, designed to maintain persistence through overlapping backdoor access…
State-sponsored Malware Original (new tab)
Socket · Web page · Published 31 Jan
GlassWorm Loader Hits Open VSX via Developer Account Compromise
Socket proactively blocks malicious open source packages in your code. Install Socket’s Threat Research team identified a developer-compromise supply chain attack distributed via the Open VSX Registry, specifically a compromise of the developer’s publishing…
Malware Original (new tab)

Added Sun 26 Apr

Check Point · Web page · Published 3 Oct
Bumblebee: increasing its capacity and evolving its TTPs
The spring of 2022 saw a spike in activity of Bumblebee loader, a recent threat that has garnered a lot of attention due to its many links to several well-known malware families. In this piece we outline the conclusions of our research into this piece of…
Malware Original (new tab)

Added Sat 25 Apr

Check Point · Web page · Published 4 Nov
The Evolution of Transparent Tribe’s New Malware
The ElizaRAT campaigns first executed the same function to verify that the system was set to India Standard Time, indicating that the campaigns targeted Indian systems. Transparent Tribe, otherwise known as APT36, is a Pakistan-affiliated threat actor that…
State-sponsored Malware Original (new tab)

Added Fri 24 Apr

Check Point · Web page · Published 24 Jan
Charger Malware Calls and Raises the Risk on Google Play
Several weeks ago, Check Point Mobile Threat Prevention detected and quarantined the Android device of an unsuspecting customer employee who downloaded and installed a 0day mobile ransomware from Google Play dubbed “Charger.” This incident demonstrates how…
Ransomware Malware Mobile Original (new tab)
Check Point · Web page · Published 17 Oct
The Emergence of the New Azorult 3.3
During the past week, Check Point Research spotted a new version of Azorult in the wild being delivered through the RIG exploit kit, as well as other sources. Azorult is a long known information stealer and malware downloader, with this particular version…
Malware Infostealers Original (new tab)

Added Thu 23 Apr

rootdaemon.com · Web page · Added 23 Apr
iranian-hackers-targeting-turkey-and-arabian-peninsula-in-new-malware-campaign
Buy this domain. Network Security System Managed Security Service Providers Cloud Cyber Security Solutions Network Security Solutions Cyber Security Managed Services
Malware Original (new tab)
Check Point · Web page · Published 22 Apr
Turning Telegram toxic: ‘ToxicEye’ RAT is the latest to use Telegram for command & control
Remote access trojan exploits Telegram communications to steal data from victims and update itself to perform additional malicious activities Research by: Omer Hofman Telegram, the cloud-based IM platform has enjoyed a surge in popularity this year because of…
Malware Original (new tab)
Cleafy · Web page · Added 23 Apr
Albiriox Exposed: A New RAT Mobile Malware Targeting Global Finance and Crypto Wallets
Two-stage deployment chain: The malware leverages dropper applications distributed through social engineering lures, combined with packing techniques, to evade static detection and deliver its payload. On-Device Fraud capabilities: Albiriox exhibits the core…
Malware Mobile Original (new tab)
ANY.RUN · Web page · Published 14 Apr
When Trust Becomes a Weapon: Google Cloud Storage Phishing Deploying Remcos RAT
Modern phishing campaigns increasingly abuse legitimate services. Cloud platforms, file-sharing tools, trusted domains, and widely used SaaS applications are now part of the attacker’s toolkit. Instead of breaking trust, attackers borrow it. This shift…
Malware Phishing Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.