Research reports

Introducing LX RAT: ITR Phishing Targets Finance and Tech

ZeroBEC researchers uncovered a prolonged phishing and malware campaign that uses Indian Income Tax Return (ITR) refund lures to deliver a multi-stage AutoIt infection chain. The campaign targeted financial and technology organizations and successfully evaded…

MalwarePhishing

Koktevrat – wieloetapowy Android RAT dystrybuowany pod przykrywką aplikacji MandatGO

No excerpt available.

MalwareMobile

The ToxicPanda Never Sleeps: ToxicPanda 2.0 Prepares its Next Strike on Mobile

The zLabs team recently identified an updated variant of ToxicPanda, the Android banking Trojan known to have primarily targeted Europe, that introduces significant enhancements, including a comprehensive command set of 167 remote commands and substantially…

Mobile

AsyncRAT-Malware-Analysis/Reports/AsyncRAT-EN.md at main · Yavuzhanzgen/AsyncRAT-Malware-Analysis

This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. -EN.md at main · -Malware-Analysis AsyncRAT Technical Analysis Report…

Malware

BabylonRAT-Malware-Analysis/Reports/BabylonRAT-EN.md at main · Yavuzhanzgen/BabylonRAT-Malware-Analysis

This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All analyses were conducted in an isolated laboratory environment. -EN.md at -Malware-Analysis BabylonRAT Technical Analysis Report Static…

Malware

Bitdefender Threat Debrief

This edition of the Bitdefender Threat Debrief covers several developments in the threat landscape, including the reemergence of AtomSIlo, a surge in 0APT’s claimed attacks, a threat emerging as tensions in the Iran war escalate, and more. As ransomware…

Ransomware

[SHADOWBYT3$] - Ransomware Victim: UMSA

NOTE: No files or stolen information are exfiltrated, downloaded, taken, hosted, seen, reposted, or disclosed by RedPacket Security. Any legal issues relating to the content should be directed at the attackers, not RedPacket Security. This blog is an…

Ransomware

What We Thought Was SMOKELOADER: Introducing REMUS

Executive Summary REMUS is a previously undocumented malware family combining infostealer and loader capabilities with a C2 resolution mechanism based on the Ethereum blockchain. At runtime, REMUS queries a public Ethereum RPC endpoint and extracts the C2…

Malware

Lx(Base) RAT: A Technical Deep Dive

During a recent malware analysis, I encountered an interesting sample ( 256 : 5a26fd462a809c89b0448318591cb98a77a7b96fca658815dc0f547a51958bed an embedded PowerShell script and Base64-encoded payload that ultimately deploys the sophisticated LxBase .NET RAT.…

Malware

Who Invited Aisuru to the LAN Party?

Bitsight TRACE has been actively monitoring the Aisuru botnet since February 2026. Through our dedicated infrastructure, we have observed the specific commands issued to the botnet and operational patterns orchestrated by the botnet's operators. This…

Botnets and DDoS

Borrowed Machinery: SnappyClient, HijackLoader, and a Shared Codebase?

SnappyClient has only ever been seen delivered by HijackLoader, but what sits between the two varies. In some samples HijackLoader loads the payload directly. In others its config carries a 32-bit PE that unpacks SnappyClient and runs it first. Zscaler have…

Linux.Nasty: Assembly x64 ELF virus

This code was originally published in the first issue of tmp.0ut zine - an ELF Research Group founded by me and a super talented group of friends in early 2021. This project was finished literally minutes before the deadline we set. Living on the edge! In…

Credential harvesting that survives takedowns: REVSTEALER

Elastic Security Labs is tracking an emerging infostealer, REVSTEALER, under REF2859. This family has gained momentum in recent months, with higher distribution volume, and has emerged as a formidable threat, featuring a comprehensive credential harvester, an…

Phishing

Mirage Kitten targets Middle East and Africa region with new malware

Mirage Kitten – also known as UNC1549, Smoke Sandstorm, and Nimbus Manticore – is an advanced persistent threat (APT) group focused on cyber-espionage operations against aerospace, aviation, defense, and telecommunications sectors across the Middle East and…

State-sponsoredMalware

Amatera Stealer 4.0.2 Beta: What's New in This Variant

What did we find? In late April 2026, eSentire's Threat Response Unit (TRU) intercepted an attempted delivery of Amatera Stealer within a customer environment in the Finance industry. Amatera Stealer is a rebranded version of ACR (AcridRain) Stealer, a C++…

Infostealers

Shedding light on the ABYSSWORKER driver

Cybercriminals are increasingly bringing their own drivers — either exploiting a vulnerable legitimate driver or using a custom-built driver to disable endpoint detection and response (EDR) systems and evade detection or prevention capabilities. Elastic…

Malware

How CrowdStrike Analyzes macOS Malware to Optimize Automated Detection

Ransomware (43% of analyzed threat data), backdoors (35%) and trojans (17%) were the most popular macOS malware categories spotted by CrowdStrike researchers in 2021 OSX.EvilQuest (ransomware), OSX.FlashBack (backdoor) and OSX.Lador (trojan) were the most…

RansomwareMalware

Fake GlobalProtect MSI Targets Myanmar Using Cloudflare and Google Sheets as C2

An organization received an email containing a link to a Google Sites landing page that presented a download as Palo Alto Networks GlobalProtect. To protect the organization and its personnel, this article does not reproduce the email, identify the recipient,…

North Korea Is Hiring

In short: a North Korean intelligence operation tried to take over my business partner's laptop with a fake job offer. The technique, "Contagious Interview," turns a recruiter's coding "test" into malware that runs the instant you open the project folder.…

ACR Stealer: Two observed intrusion chains amid increased threat activity

From late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity across customer environments. These campaigns are successfully using ClickFix lures to steal browser credentials, authentication tokens, and sensitive…

Infostealers