Skip to content

Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,233 reports388 publishers50 added in the past week

221–240 of 353 reports · page 12 of 18 · Clear filters

Added Thu 23 Apr

Cybernews · Web page · Published 14 Mar
New destructive wiper malware deployed in Ukraine
Cybersecurity company ESET warned about the discovery of a 3rd destructive wiper malware deployed in Ukraine. ESET first observed this new malware dubbed CaddyWiper on Monday, around 9h38 UTC. CaddyWiper erases user data and partition information from…
Malware Original (new tab)
Cleafy · Web page · Added 23 Apr
Mirax: a new Android RAT turning infected devices into potential residential proxy nodes
New Maas spreading: Mirax has emerged as a sophisticated Malware-as-a-Service (MaaS) offering, specifically targeting Android devices across Europe. It is actively marketed and distributed through underground malware forums. At the time of writing, Cleafy…
Malware Mobile Original (new tab)
K7 Labs · Web page · Published 23 Jul
Threat actors target recent Election Results
Recently, we saw a tweet about a document claiming to be reporting about the recent “Indian Election Results”. On analysis, we found that it was dropping a “Crimson RAT” payload. This RAT, mostly used by the Transparent Tribe APT, is capable of stealing…
State-sponsored Malware Original (new tab)
Check Point · Web page · Published 22 Sep
7 Years of Scarlet Mimic’s Mobile Surveillance Campaign Targeting Uyghurs
In 2022, Check Point Research (CPR) observed a new wave of a long-standing campaign targeting the Uyghur community, a Turkic ethnic group originating from Central Asia, one of the largest minority ethnic groups in China. This malicious activity, which we…
Malware Mobile Original (new tab)
Check Point · Web page · Published 25 Jun
In the Wild: Malware Prototype with Embedded Prompt Injection
In this write-up we present a malware sample found in the wild that boasts a novel and unusual evasion mechanism — an attempted prompt injection (”Ignore all previous instructions…”) aimed to manipulate AI models processing the sample. The sample gives the…
Malware AI Original (new tab)

Added Wed 22 Apr

Check Point · Web page · Published 12 Mar
Vicious Panda: The COVID Campaign
Check Point Research discovered a new campaign against the Mongolian public sector, which takes advantage of the current Coronavirus scare, in order to deliver a previously unknown malware implant to the target. A closer look at this campaign allowed us to…
State-sponsored Malware Original (new tab)

Added Tue 21 Apr

Check Point · Web page · Published 16 May
VSCode Security: Malicious Extensions Detected- More Than 45,000 Downloads- PII Exposed, and Backdoors Enabled
VSCode (short for Visual Studio Code) is a popular and free source code editor developed by Microsoft. It’s an efficient and customizable coding environment that can support a wide range of programming languages, frameworks, and tools. VSCode has gained muc
Malware Original (new tab)

Added Sun 19 Apr

Check Point · Web page · Published 23 Jan
A Whale of a Tale: HummingBad Returns
Check Point researchers have found a new variant of the HummingBad malware hidden in more than 20 apps on Google Play. The infected apps in this campaign were downloaded several million times by unsuspecting users. Check Point informed the Google Security…
Malware Original (new tab)

Added Sat 18 Apr

Check Point · Web page · Published 31 Jul
Osiris: An Enhanced Banking Trojan
Following our recent analysis of the Kronos banking Trojan, we discovered that Kronos has also now been enhanced to hide its communication with C&C server using Tor. While the author of Kronos continues to remain an issue of controversy, the new banking…
Malware Vulnerabilities Original (new tab)
Check Point · Web page · Published 22 Jun
Beyond the Horizon: Traveling the World on Camaro Dragon’s USB Flash Drives
In early 2023, the Check Point Incident Response Team (CPIRT) team investigated a malware incident at a European healthcare institution involving a set of tools mentioned in the Avast report in late 2022. The incident was attributed to Camaro Dragon, a…
State-sponsored Malware Original (new tab)

Added Fri 17 Apr

Recorded Future · Web page · Added 17 Apr
GrayCharlie Hijacks Law Firm Sites in Suspected Supply-Chain Attack
Insikt Group has been monitoring GrayCharlie, a threat actor overlapping with SmartApeSG and active since mid-2023, for some time, and is now publishing its first report on the group. GrayCharlie compromises WordPress sites and injects them with links to…
Malware Supply chain Original (new tab)
Cisco Talos · Web page · Published 8 Apr
New Lua-based malware “LucidRook” observed in targeted attacks against Taiwanese organizations
Cisco Talos uncovered a cluster of activity we track as UAT-10362 conducting spear-phishing campaigns against Taiwanese non-governmental organizations (NGOs) and suspected universities to deliver a newly identified malware family, “LucidRook.” LucidRook is a…
Malware Original (new tab)

Added Thu 16 Apr

Check Point · Web page · Published 4 Feb
SpeakUp: A New Undetected Backdoor Linux Trojan
Check Point Research has discovered a new campaign exploiting Linux servers to implant a new Backdoor Trojan. Dubbed ‘SpeakUp’, the new Trojan exploits known vulnerabilities in six different Linux distributions. The attack targets worldwide servers including…
Malware Vulnerabilities Original (new tab)

Added Wed 15 Apr

Check Point · Web page · Published 15 Jul
New BugSleep Backdoor Deployed in Recent MuddyWater Campaigns
MuddyWater, an Iranian threat group affiliated with the Ministry of Intelligence and Security (MOIS), has significantly increased its activities in Israel since the beginning of the Israel-Hamas war in October 2023. This parallels with activities against…
State-sponsored Malware Phishing Original (new tab)
Check Point · Web page · Published 17 Oct
Pony’s C&C servers hidden inside the Bitcoin blockchain
Redaman is a form of banking malware distributed by phishing campaigns that target mostly Russia language speakers. First seen in 2015 and reported as the RTM banking Trojan, new versions of Redaman appeared in 2017 and 2018. In September 2019, Check Point…
Malware Original (new tab)
Check Point · Web page · Published 16 May
Check Point Research reveals a malicious firmware implant for TP-Link routers, linked to Chinese APT group
Check Point Research (CPR) exposes a malicious firmware implant for TP-Link routers which allowed attackers to gain full control of infected devices and access compromised networks while evading detection. CPR attributes the attacks to a Chinese…
State-sponsored Malware Original (new tab)

Added Tue 14 Apr

Check Point · Web page · Published 16 May
The Dragon Who Sold His Camaro: Analyzing Custom Router Implant
Research by: Itay Cohen, Radoslaw Madej, and the Threat Intelligence Team Over the past few months, Check Point Research has closely monitored a series of targeted attacks aimed at European foreign affairs entities. These campaigns have been linked to a…
State-sponsored Malware Original (new tab)

Added Mon 13 Apr

Check Point · Web page · Published 6 Jun
Banking Trojans Under Development
Although banks themselves have taken measures to strengthen the security of their authentication processes, Banker Trojans, however, are still a popular tool for stealing user’s financial details and draining bank accounts. The Check Point Research team…
Malware Original (new tab)
Check Point · Web page · Published 30 Nov
More Than 1 Million Google Accounts Breached by Gooligan
As a result of a lot of hard work done by our security research teams, we revealed today a new and alarming malware campaign. The attack campaign, named Gooligan, breached the security of over one million Google accounts. The number continues to rise at an…
Malware Original (new tab)
Check Point · Web page · Published 22 Sep
Iranian Threat Actor Nimbus Manticore Expands Campaigns into Europe with Advanced Malware and Fake Job Lures
Check Point Research is actively tracking Iranian threat actor Nimbus Manticore. Our latest findings show it is expanding operations into Europe and now targeting the defense, telecom, and aerospace sectors. The group uses fake job portals and spear‑phishing…
Malware Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.