Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,259 reports391 publishers75 added in the past week

221–240 of 1,259 reports · page 12 of 63

Added Fri 2 Oct

Microsoft · Web page · Published 22 Sep
Unmasking EvilTokens: Getting to the root of device code phishing
By Microsoft Threat Intelligence, Microsoft Defender Experts, Microsoft Security Research Following its emergence in February 2026, EvilTokens quickly became one of the most widely used phishing-as-a-service (PhaaS) platforms, providing cybercriminals with AI…
Phishing Original (new tab)

Added Tue 29 Sep

Cisco Talos · Web page · Published 22 Sep
The Closed Quorum: Inside the first reported autonomous AI C2 implant
CLOSEDQUORUM, a malware binary discovered through Cisco Talos’ CAIRN project, exhibits fully autonomous command and control (C2). While we do not have confirmation of in-the-wild deployment, artifacts from the binary were used to connect the developer to…
Malware Original (new tab)

Added Sat 26 Sep

GitHub · Web page · Added 26 Sep
Amadey-Malware-Analysis/Reports/Amadey_EN.md at main · Yavuzhanzgen/Amadey-Malware-Analysis
This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. Amadey Technical Analysis Report Static Analysis • Dynamic Analysis •…
Malware Original (new tab)
GitHub · Web page · Published 28 Mar
public-research/drifter/report.md at main · deepfield/public-research
What distinguishes Drifter is how it hides. Its C2 domains are named after IP camera brands ( cctv[.]su , nvms9000[.]su ), chosen to blend with the traffic of devices that
Botnets and DDoS Original (new tab)
cyderes.com · Web page · Published 4 Feb
RenEngine Loader and HijackLoader: Dual-Stage Attack Chain
Our analysis indicates that more than 400,000 global victims have been impacted, with the operation continuing to infect over 5,000 new victims per day. The threat actors blend compelling social‑engineering techniques with a stealthy, multi‑stage execution…
Malware Original (new tab)
GitHub · Web page · Added 26 Sep
ValleyRAT-Malware-Analysis/Reports/ValleyRat-EN.md at main · Yavuzhanzgen/ValleyRAT-Malware-Analysis
This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. ValleyRAT Technical Analysis Report Static Analysis • Dynamic Analysis •…
Malware Original (new tab)
d01a.github.io · Web page · Published 5 Sep
The road to Xloader
Xloader is a stealer that was built on the FormBook malware family that first emerged in 2016; the rebranded Xloader was introduced in 2020. It is highly sophisticated malware that uses a combination of anti-analysis and obfuscation techniques, and it’s…
Malware Original (new tab)
GitHub · Web page · Added 26 Sep
KoiLoader-Malware-Analysis/Reports/KoiLoader-EN.md at main · Yavuzhanzgen/KoiLoader-Malware-Analysis
This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. KoiLoader Technical Analysis Report Static Analysis • Dynamic Analysis •…
Malware Original (new tab)
GitHub · Web page · Published 20 May
public-research/potassium/report.md at main · deepfield/public-research
Content warning: This report quotes malware artifacts verbatim, including domain names, URL paths, campaign tags, and embedded strings chosen by the threat actor. Some contain crude or offensive language, including an antisemitic slur. These are reproduced…
Botnets and DDoS Original (new tab)
acronis.com · Web page · Published 13 Sep
Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit
Acronis Threat Research Unit (TRU) uncovered a multinational campaign in which a Chinese-speaking threat actor, tracked as Red Heron, rapidly weaponized CVE-2026-60004 to compromise internet-facing instances of Gitea, a self-hosted source-code management…
Malware Vulnerabilities Original (new tab)
GitHub · Web page · Added 26 Sep
XWorm-Malware-Analysis/Reports/XWorm_v3.1_Report_EN.md at main · Yavuzhanzgen/XWorm-Malware-Analysis
This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples have been analyzed in an isolated laboratory environment. XWorm V3.1 Malware T Static Analysis • Dynamic Analysis • Reverse…
Malware Original (new tab)
GitHub · Web page · Added 26 Sep
XoriumStealer-Malware-Analysis/Reports/XoriumStealer-EN.md at main · Yavuzhanzgen/XoriumStealer-Malware-Analysis
This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. Xorium Stealer Malware T Static Analysis • Dynamic Analysis • Reverse…
Malware Original (new tab)

Added Fri 25 Sep

Check Point · Web page · Published 11 Aug
Shattering the Dream - When a Job Offer Becomes a Zero-Day Attack
Check Point Research is tracking a long‑running campaign called Operation Dream Job, targeting organizations worldwide, with a particular focus on the defense sector. The campaign is affiliated to DPRK-linked Lazarus group and its latest wave focuses on the…
Vulnerabilities Original (new tab)
NSA · Web page · Published 10 Aug
NSA Joins FBI and Others in Releasing Guidance to Defend Against Gunra Ransomware
FORT MEADE, Md. — Today, the National Security Agency (NSA) joins the Federal Bureau of Investigation (FBI) and others in releasing a joint Cybersecurity Advisory, “#StopRansomware: Gunra Ransomware,” as an ongoing effort to publish information about…
Ransomware Takedowns and arrests Original (new tab)
SentinelOne · Web page · Published 18 Sep
Don’t Call Us, We’ll Call Your APIs
Following disclosure of the TraderTraitor attack against LayerZero Labs in April 2026, SentinelOne identified an additional victim with the same macOS backdoors. Our analysis explores the mechanics of these backdoors and the expanded targeting against a…
Malware Original (new tab)
jamf.com · Web page · Added 25 Sep
Contagious Interview steps outside the developer workflow
Jamf Threat Labs uncovers fake macOS installers tied to the same infrastructure behind past Git hook and VS Code task file attacks. September 3 2026 by Jamf Threat Labs By Allen Golbig Introduction Jamf Threat Labs identified a cluster of macOS disk images…
Original (new tab)
opensourcemalware.com · Web page · Published 17 Sep
WeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentials
The OpenSourceMalware team spends a lot of time looking at malicious npm packages, and after a while you start seeing the same patterns over and over. So when something new and genuinely different shows up, it’ stopping for. That happened this week when we…
Supply chain Original (new tab)
Kudelski Security · Web page · Added 25 Sep
Beyond Lazarus: Organization of DPRK Cyber Capabilities
This research was conducted in partnership between Kudelski Security and Sekoia, with contributions from Clifford (Kudelski Security), Coline C., Saee V. and the Sekoia TDR Team. Key takeaways > The DPRK built its cyber capability as a deliberate extension of…
State-sponsored Original (new tab)
AhnLab · Web page · Published 29 Jul
[Joint Cybersecurity Advisory] Operation Double Barrel (The Relationship Between a State-Sponsored Threat Actor and the Gunra Ransomware Group)
This technical analysis report was prepared as part of the joint cybersecurity advisory titled “Advisory on Cyberattacks Targeting Korean Citizens and Businesses by State-Sponsored Hacking Groups” issued by the Republic of Korea’s National Intelligence…
Ransomware State-sponsored Original (new tab)
Sekoia · Web page · Published 7 Sep
Beyond Lazarus: Organization of DPRK cyber capabilities
This article was co-authored by Sekoia’s TDR team and Kudelski Security as part of a joint research effort. Introduction The Democratic People's Republic of Korea (DPRK) has established itself as one of the more prominent state actors in cyberspace. For…
State-sponsored Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.