Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,259 reports391 publishers75 added in the past week

261–280 of 1,259 reports · page 14 of 63

Added Sun 13 Sep

Bitdefender · Web page · Published 11 Mar
Bitdefender Threat Debrief
This edition of the Bitdefender Threat Debrief covers several developments in the threat landscape, including the reemergence of AtomSIlo, a surge in 0APT’s claimed attacks, a threat emerging as tensions in the Iran war escalate, and more. As ransomware…
Ransomware Original (new tab)
redpacketsecurity.com · Web page · Published 25 Feb
[SHADOWBYT3$] - Ransomware Victim: UMSA
NOTE: No files or stolen information are exfiltrated, downloaded, taken, hosted, seen, reposted, or disclosed by RedPacket Security. Any legal issues relating to the content should be directed at the attackers, not RedPacket Security. This blog is an…
Ransomware Original (new tab)

Added Tue 8 Sep

aachum.github.io · Web page · Published 27 Mar
What We Thought Was SMOKELOADER: Introducing REMUS
Executive Summary REMUS is a previously undocumented malware family combining infostealer and loader capabilities with a C2 resolution mechanism based on the Ethereum blockchain. At runtime, REMUS queries a public Ethereum RPC endpoint and extracts the C2…
Malware Original (new tab)
Medium · Web page · Published 3 Aug
Lx(Base) RAT: A Technical Deep Dive
During a recent malware analysis, I encountered an interesting sample ( 256 : 5a26fd462a809c89b0448318591cb98a77a7b96fca658815dc0f547a51958bed an embedded PowerShell script and Base64-encoded payload that ultimately deploys the sophisticated LxBase .NET RAT.…
Malware Original (new tab)
Bitsight · Web page · Published 18 Aug
Who Invited Aisuru to the LAN Party?
Bitsight TRACE has been actively monitoring the Aisuru botnet since February 2026. Through our dedicated infrastructure, we have observed the specific commands issued to the botnet and operational patterns orchestrated by the botnet's operators. This…
Botnets and DDoS Original (new tab)
neso.re · Web page · Added 8 Sep
Borrowed Machinery: SnappyClient, HijackLoader, and a Shared Codebase?
SnappyClient has only ever been seen delivered by HijackLoader, but what sits between the two varies. In some samples HijackLoader loads the payload directly. In others its config carries a 32-bit PE that unpacks SnappyClient and runs it first. Zscaler have…
Original (new tab)
guitmz.com · Web page · Published 18 May
Linux.Nasty: Assembly x64 ELF virus
This code was originally published in the first issue of tmp.0ut zine - an ELF Research Group founded by me and a super talented group of friends in early 2021. This project was finished literally minutes before the deadline we set. Living on the edge! In…
Original (new tab)
Elastic Security Labs · Web page · Published 2 Sep
Credential harvesting that survives takedowns: REVSTEALER
Elastic Security Labs is tracking an emerging infostealer, REVSTEALER, under REF2859. This family has gained momentum in recent months, with higher distribution volume, and has emerged as a formidable threat, featuring a comprehensive credential harvester, an…
Phishing Original (new tab)
Kaspersky · Web page · Published 28 Jul
Mirage Kitten targets Middle East and Africa region with new malware
Mirage Kitten – also known as UNC1549, Smoke Sandstorm, and Nimbus Manticore – is an advanced persistent threat (APT) group focused on cyber-espionage operations against aerospace, aviation, defense, and telecommunications sectors across the Middle East and…
State-sponsored Malware Original (new tab)
eSentire · Web page · Added 8 Sep
Amatera Stealer 4.0.2 Beta: What's New in This Variant
What did we find? In late April 2026, eSentire's Threat Response Unit (TRU) intercepted an attempted delivery of Amatera Stealer within a customer environment in the Finance industry. Amatera Stealer is a rebranded version of ACR (AcridRain) Stealer, a C++…
Infostealers Original (new tab)
Elastic Security Labs · Web page · Published 20 Mar
Shedding light on the ABYSSWORKER driver
Cybercriminals are increasingly bringing their own drivers — either exploiting a vulnerable legitimate driver or using a custom-built driver to disable endpoint detection and response (EDR) systems and evade detection or prevention capabilities. Elastic…
Malware Original (new tab)
CrowdStrike · Web page · Published 6 May
How CrowdStrike Analyzes macOS Malware to Optimize Automated Detection
Ransomware (43% of analyzed threat data), backdoors (35%) and trojans (17%) were the most popular macOS malware categories spotted by CrowdStrike researchers in 2021 OSX.EvilQuest (ransomware), OSX.FlashBack (backdoor) and OSX.Lador (trojan) were the most…
Ransomware Malware Original (new tab)
malwareinfo.app · Web page · Published 2 Sep
Fake GlobalProtect MSI Targets Myanmar Using Cloudflare and Google Sheets as C2
An organization received an email containing a link to a Google Sites landing page that presented a download as Palo Alto Networks GlobalProtect. To protect the organization and its personnel, this article does not reproduce the email, identify the recipient,…
Original (new tab)
hackingbutlegal.com · Web page · Published 15 Jul
North Korea Is Hiring
In short: a North Korean intelligence operation tried to take over my business partner's laptop with a fake job offer. The technique, "Contagious Interview," turns a recruiter's coding "test" into malware that runs the instant you open the project folder.…
Original (new tab)
Microsoft · Web page · Published 16 Jul
ACR Stealer: Two observed intrusion chains amid increased threat activity
From late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity across customer environments. These campaigns are successfully using ClickFix lures to steal browser credentials, authentication tokens, and sensitive…
Infostealers Original (new tab)
SentinelOne · Web page · Published 19 Sep
Prompts as Code & Embedded Keys
This is an abridged version of the LABScon 2025 presentation “LLM-Enabled Malware In the Wild” by the authors. A LABScon Replay video of the full talk will be released in due course. As Large Language Models (LLMs) are increasingly incorporated into…
Malware AI Original (new tab)
Gen Digital · Web page · Published 18 Aug
WordlistLoader Delivering Amatera via ClearFake Campaigns
Gen Threat Labs has identified WordlistLoader, a new loader used to deliver Amatera Stealer via ClearFake campaigns. Amatera has been actively developed over the past few months and has gradually become one of the most prevalent infostealers in our user base.…
Infostealers Original (new tab)

Added Fri 4 Sep

NCC Group · Web page · Added 4 Sep
NCC Group Monthly Threat Pulse – Review of July 2026
Ransomware volume rose 22% month-on-month, with 894 cases recorded in July Industrials remain top target as sector takes over a quarter (28%) of attacks Western regions are still most targeted with North America experiencing 41%, and Europe 29%, of all…
Ransomware Original (new tab)

Added Thu 3 Sep

t0asts.com · Web page · Published 28 Jul
Download Meccha Chameleon Cheats, Get Malware
Over the past month, I’ve been playing this game called Meccha Chameleon, which is a hybrid between hide-and-seek and prop hunt, except instead of transforming into a map prop, you paint yourself to blend in with the environment. A group of hunter players…
Malware Original (new tab)
socprime.com · Web page · Added 3 Sep
SmartApeSG ClickFix Campaign Delivers Unknown RAT
The SmartApeSG campaign uses the ClickFix technique to trick users into running malicious commands through fake CAPTCHA or human verification pages. This action launches an HTA file that downloads and extracts a malicious ZIP archive. The final payload is an…
Malware Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.