Research reports
1,224 reports from 387 publishers45 added in the past week
294 reports, newest added first
Added Fri 10 Apr
Stealthier version of Linux BPFDoor malware spotted in the wild
BPFDoor is a stealthy backdoor malware that has been active since at least 2017 but was only discovered by security researchers around 12 months ago. The malware gets its name from the use of the 'Berkley Packet Filter' (BPF) for receiving instructions while…
Malware
Petya: the two-in-one trojan
Infecting the Master Boot Record (MBR) and encrypting files is nothing new in the world of malicious programs. Back in 1994, the virus OneHalf emerged that infected MBRs and encrypted the disk contents. However, that virus did not extort money. In 2011, MBR…
RansomwareMalware
Cobalt Strike Malware Analysis With CyberChef and Emulation - .HTA Loader Example
In this post. we will demonstrate a process for decoding a simple .hta loader used to load cobalt strike shellcode. We will perform initial analysis using a text editor, and use CyberChef to extract embedded shellcode. From here we will validate the shellcode…
Malware
Navigating QakBot samples with grap
This post demonstrates how to use grap to quickly find and analyse documented features (based on public reports) in published QakBot samples: All features and IOC described here are already published (see References) Samples are from Malpedia: win.qakbot We…
Malware
Malware burrows deep into computer BIOS to escape AV
Researchers have discovered one of the first pieces of malware ever used in the wild that modifies the software on the motherboard of infected computers to ensure the infection can't be easily eradicated. Known as Trojan.Mebromi, the rootkit reflashes the…
Malware
GuLoader AntiVM Techniques
Thời gian gần đây, Twitter của các chuyên gia nước ngoài liên tục xuất hiện hash tag #GuLoader, đây là một downloader phổ biến đang được các nhóm tin tặc sử dụng rộng rãi nhằm tải về mã độc chính lợi dụng các dịch vụ cloud của Google Drive và Microsoft…
Malware
Cerberus Analysis - Android Banking Trojan
Cerberus is an Android malware that emerged in 2019 but was allegedly used for special operations until two years ago. It has been determined by the analysts that it was not built on a banking trojan and the Anubis malware whose source code had leaked, or…
MalwareMobile
Threat Update: AcidRain Wiper
Splunk is committed to using inclusive and unbiased language. This blog post might contain terminology that we no longer use. For more information on our updated terminology and our stance on biased language, please visit our blog post. We appreciate your…
Malware
Arcane Werewolf revamps its arsenal with Loki 2.1 implant
In October and November 2025, BI.ZONE Threat Intelligence observed malicious activity by Arcane Werewolf (Mythic Likho) targeting Russian manufacturing enterprises. Retrospective analysis suggests that the threat actor most likely used phishing emails as the…
MalwarePhishing
More AgentTesla Keylogger And Nanocore RAT In One Bundle
We are seeing a continuation of even more AgentTesla malspam campaigns again this morning. However today’s is somewhat different to usual and also delivers a Nanocore RAT. Actually the Nanocore RAT is downloading the AgentTesla keylogger. And after a bit of…
Malware
Added Wed 8 Apr
MuddyWater Threat Group Deploys New BugSleep Backdoor
Check Point Research (CPR) warns that Iranian threat group MuddyWater has significantly increased its activities against Israel and is deploying a new, previously undocumented backdoor campaign. Key Findings MuddyWater, an Iranian threat group affiliated with…
State-sponsoredMalware
Bandook: Signed & Delivered
Check Point Research recently observed a new wave of campaigns against various targets worldwide that utilizes a strain of a 13-year old backdoor Trojan named Bandook. Bandook, which had almost disappeared from the threat landscape, was featured in 2015 and…
Malware
Deep Dive into UPAS Kit vs. Kronos
In this post we will be analyzing the UPAS Kit and the Kronos banking Trojan, two malwares that have come under the spotlight recently due to the back story behind them. Background In May 2017, WannaCry wreaked havoc in over 150 countries and brought down…
MalwareTakedowns and arrests
From Albania to the Middle East: The Scarred Manticore is Listening
Check Point Research (CPR) is monitoring an ongoing Iranian espionage campaign by Scarred Manticore, an actor affiliated with the Ministry of Intelligence and Security (MOIS). The attacks rely on LIONTAIL, an advanced passive malware framework installed on…
Malware
Added Tue 7 Apr
SharpPanda: Chinese APT Group Targets Southeast Asian Government With Previously Unknown Backdoor
Check Point Research identified an ongoing surveillance operation targeting a Southeast Asian government. The attackers use spear-phishing to gain initial access and leverage old Microsoft Office vulnerabilities together with the chain of in-memory loaders to…
State-sponsoredMalware
Added Mon 6 Apr
Encrypted Channel, Technique T1573 - Enterprise
APT29 has used multiple layers of encryption within malware to protect C2 communication.[1] G1002 BITTER BITTER has encrypted their C2 communications.[2] S0631 Chaes Chaes has used encryption for its C2 channel.[3] S0498 Cryptoistic Cryptoistic can engage in…
State-sponsoredMalwareBotnets and DDoS
Rage against the virtual machine
Several features on this page require Premium Access. Information & Contributors Bibliometrics & Citations Reading Options References Figures Tables Media Share Abstract Antivirus companies, mobile application marketplaces, and the security research…
MalwareMobile
Encrypted Channel, Technique T1573 - Enterprise
APT29 has used multiple layers of encryption within malware to protect C2 communication.[1] G1002 BITTER BITTER has encrypted their C2 communications.[2] S0631 Chaes Chaes has used encryption for its C2 channel.[3] S0498 Cryptoistic Cryptoistic can engage in…
State-sponsoredMalwareBotnets and DDoS
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool Emdivi Tool: Emdivi Names Emdivi Newsripper Category Malware Type Backdoor Description (Kaspersky) The emdivi family stores important data about itself, including C2, API name, strings for…
Malware
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.