Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,233 reports388 publishers50 added in the past week

241–260 of 353 reports · page 13 of 18 · Clear filters

Added Sun 12 Apr

Check Point · Web page · Published 8 Dec
Trickbot Rebirths Emotet: 140,000 Victims in 149 Countries in 10 Months
Check Point Research (CPR) warns of potential ransomware attacks, as it sees samples of Emotet fast-spreading via Trickbot. Since Emotet’s takedown by law enforcement, CPR estimates 140,000 victims of Trickbot, across 149 countries in only 10 months. New…
Ransomware Malware Takedowns and arrests Original (new tab)
Check Point · Web page · Published 9 Jul
New Joker variant hits Google Play with an old trick
Check Point’s researchers recently discovered a new variant of the Joker Dropper and Premium Dialer spyware in Google Play. Hiding in seemingly legitimate applications, we found that this updated version of Joker was able to download additional malware to the…
Malware Original (new tab)
Check Point · Web page · Published 3 Oct
3rd October – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 3rd October, please download our Threat Intelligence Bulletin. Top Attacks and Breaches Check Point Research identified an ongoing, mobile malware campaign that has consistently targeted Uyghurs for…
Malware Mobile Original (new tab)

Added Fri 10 Apr

kienmanowar.wordpress.com · Web page · Published 11 May
Quick analysis note about DealPly (Adware)
DealPly adware abuses Microsoft, McAfee services to evade detection Adware.DealPly The post focuses on the following main sections: Unpack wrapper/loader to get main Dll payload. Decrypt C2url and strings are used in the malware code. Sample: SHA-256:…
Malware Original (new tab)
US Department of Justice · Web page · Published 15 Feb
Foreign National Pleads Guilty to Role in Cybercrime Schemes Involving Tens of Millions of Dollars in Losses
A Ukrainian national pleaded guilty today to his role in two separate and wide-ranging malware schemes involving tens of millions of dollars in losses. “Vyacheslav Igorevich Penchukov was a leader of two prolific malware groups that infected thousands of…
Malware Takedowns and arrests Original (new tab)
SentinelOne · Web page · Published 12 Jul
Malware Discovered – SFG: Furtim Malware Analysis
Update, 14-July: There have been a number of stories published since the posting of this blog that have suggested this attack is specifically targeting SCADA energy management systems. We want to emphasize that we do not have any evidence that this is in fact…
Malware Original (new tab)
GitHub · Web page · Added 10 Apr
IoCs/Broadbased/frat.md at master · jeFF0Falltrades/IoCs
Note: I have not seen much coverage of this malware family. The name 'FRat' was derived from research by @James_inthe_box, seen in the linked Tweet thread below. If you have more information on this threat, please contact me on Twitter A RAT employing…
Malware Original (new tab)
BleepingComputer · Web page · Published 11 May
Stealthier version of Linux BPFDoor malware spotted in the wild
BPFDoor is a stealthy backdoor malware that has been active since at least 2017 but was only discovered by security researchers around 12 months ago. The malware gets its name from the use of the 'Berkley Packet Filter' (BPF) for receiving instructions while…
Malware Original (new tab)
Kaspersky · Web page · Published 4 May
Petya: the two-in-one trojan
Infecting the Master Boot Record (MBR) and encrypting files is nothing new in the world of malicious programs. Back in 1994, the virus OneHalf emerged that infected MBRs and encrypted the disk contents. However, that virus did not extort money. In 2011, MBR…
Ransomware Malware Original (new tab)
embee-research.ghost.io · Web page · Published 20 Oct
Cobalt Strike Malware Analysis With CyberChef and Emulation - .HTA Loader Example
In this post. we will demonstrate a process for decoding a simple .hta loader used to load cobalt strike shellcode. We will perform initial analysis using a text editor, and use CyberChef to extract embedded shellcode. From here we will validate the shellcode…
Malware Original (new tab)
quosecgmbh.github.io · Web page · Added 10 Apr
Navigating QakBot samples with grap
This post demonstrates how to use grap to quickly find and analyse documented features (based on public reports) in published QakBot samples: All features and IOC described here are already published (see References) Samples are from Malpedia: win.qakbot We…
Malware Original (new tab)
theregister.co.uk · Web page · Published 14 Sep
Malware burrows deep into computer BIOS to escape AV
Researchers have discovered one of the first pieces of malware ever used in the wild that modifies the software on the motherboard of infected computers to ensure the infection can't be easily eradicated. Known as Trojan.Mebromi, the rootkit reflashes the…
Malware Original (new tab)
vincss.net · Web page · Published 27 May
GuLoader AntiVM Techniques
Thời gian gần đây, Twitter của các chuyên gia nước ngoài liên tục xuất hiện hash tag #GuLoader, đây là một downloader phổ biến đang được các nhóm tin tặc sử dụng rộng rãi nhằm tải về mã độc chính lợi dụng các dịch vụ cloud của Google Drive và Microsoft…
Malware Original (new tab)
nur.pub · Web page · Published 16 Jun
Cerberus Analysis - Android Banking Trojan
Cerberus is an Android malware that emerged in 2019 but was allegedly used for special operations until two years ago. It has been determined by the analysts that it was not built on a banking trojan and the Anubis malware whose source code had leaked, or…
Malware Mobile Original (new tab)
splunk.com · Web page · Published 19 May
Threat Update: AcidRain Wiper
Splunk is committed to using inclusive and unbiased language. This blog post might contain terminology that we no longer use. For more information on our updated terminology and our stance on biased language, please visit our blog post. We appreciate your…
Malware Original (new tab)
bi.zone · Web page · Published 17 Dec
Arcane Werewolf revamps its arsenal with Loki 2.1 implant
In October and November 2025, BI.ZONE Threat Intelligence observed malicious activity by Arcane Werewolf (Mythic Likho) targeting Russian manufacturing enterprises. Retrospective analysis suggests that the threat actor most likely used phishing emails as the…
Malware Phishing Original (new tab)
myonlinesecurity.co.uk · Web page · Published 25 Jun
More AgentTesla Keylogger And Nanocore RAT In One Bundle
We are seeing a continuation of even more AgentTesla malspam campaigns again this morning. However today’s is somewhat different to usual and also delivers a Nanocore RAT. Actually the Nanocore RAT is downloading the AgentTesla keylogger. And after a bit of…
Malware Original (new tab)

Added Wed 8 Apr

Check Point · Web page · Published 15 Jul
MuddyWater Threat Group Deploys New BugSleep Backdoor
Check Point Research (CPR) warns that Iranian threat group MuddyWater has significantly increased its activities against Israel and is deploying a new, previously undocumented backdoor campaign. Key Findings MuddyWater, an Iranian threat group affiliated with…
State-sponsored Malware Original (new tab)
Check Point · Web page · Published 26 Nov
Bandook: Signed & Delivered
Check Point Research recently observed a new wave of campaigns against various targets worldwide that utilizes a strain of a 13-year old backdoor Trojan named Bandook. Bandook, which had almost disappeared from the threat landscape, was featured in 2015 and…
Malware Original (new tab)
Check Point · Web page · Published 12 Jun
Deep Dive into UPAS Kit vs. Kronos
In this post we will be analyzing the UPAS Kit and the Kronos banking Trojan, two malwares that have come under the spotlight recently due to the back story behind them. Background In May 2017, WannaCry wreaked havoc in over 150 countries and brought down…
Malware Takedowns and arrests Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.