Research reports
1,224 reports from 387 publishers45 added in the past week
294 reports, newest added first
Added Mon 6 Apr
Software Discovery: Security Software Discovery, Sub-technique T1518.001 - Enterprise
ABK has the ability to identify the installed anti-virus product on the compromised host.[1] S1028 Action RAT Action RAT can identify AV products on an infected host using the following command: cmd.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2…
State-sponsoredMalware
Threat Group Cards: A Threat Actor Encyclopedia
Download this tool card in JSON format All groups using tool Jumpall Changed Name Country Observed APT groups APT 17, Deputy Dog, Elderwood, Sneaky Panda 2009-Jun 2024 APT 41 2012-Jul 2025 2 groups liste
State-sponsoredMalware
Croxloader (Malware Family)
Source: https://malpedia.caad.fkie.fraunhofer.de/details/win.croxloader
Malware
Malware “TSCookie”
Around 17 January 2018, there were some reports on the social media about malicious emails purporting to be from Ministry of Education, Culture, Sports, Science and Technology of Japan [1]. This email contains a URL leading to a malware called “TSCookie”.…
Malware
OSX.EvilQuest Uncovered
Our research, tools, and writing, are supported by the "Friends of Objective-See" such as: 📝 👾 Want to play along? I’ve added the sample (‘OSX.EvilQuest’) to our malware collection (password: infect3d) …please don’t infect yourself! Background In part one…
RansomwareMalware
Google: Hackers target Salesforce accounts in data extortion attacks
Google has observed hackers claiming to be the ShinyHunters extortion group conducting social engineering attacks against multi-national companies to steal data from organizations' Salesforce platforms. According to Google's Threat Intelligence Group (GTIG),…
RansomwareMalware
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool Gamaredon Tool: Gamaredon Names Gamaredon Category Malware Type Reconnaissance, Backdoor, Info stealer, Downloader Description (Palo Alto) The custom-developed malware is fully featured an…
State-sponsoredMalware
YiSpecter: First iOS Malware That Attacks Non-jailbroken Apple iOS Devices by Abusing Private APIs
We recently identified a new Apple iOS malware and named it YiSpecter. YiSpecter is different from previously seen iOS malware in that it attacks both jailbroken and non-jailbroken iOS devices through unique and harmful malicious behaviors. Specifically, it’s…
MalwareMobile
APT19, Codoso, C0d0so0, Codoso Team, Sunshop Group, Group G0073
APT19 used HTTP for C2 communications. APT19 also used an HTTP malware variant to communicate over HTTP for C2.[1][4] Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder An APT19 HTTP malware variant establishes…
State-sponsoredMalware
RogueRobinNET (Malware Family)
Latest Target Attack of DarkHydruns Group Against Middle East RogueRobinNET DarkHydrus 2019-01-08 ⋅ paloalto Netoworks: Unit42 ⋅ Bryan Lee, Robert Falcone DarkHydrus delivers new Trojan that can use Google Drive for C2 c
Malware
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool KARAE Tool: KARAE Names KARAE Category Malware Type Reconnaissance, Backdoor, Info stealer, Exfiltration Description (FireEye) Karae backdoors are typically used as first-stage malware after…
Malware
Chewbacca Point-of-Sale Malware Campaign Found in 10 Countries
A criminal campaign using the Tor-based Chewbacca Trojan, which includes memory-scraping malware and a keylogger, is responsible for the theft of more than 49,000 credit card numbers in 10 countries. Before you think that RAM scraper malware was a phenomenon…
Malware
Havex
Havex malware, also known as Backdoor.Oldrea, is a Remote Access Trojan (RAT) employed by the Russian attributed APT group "Energetic Bear" or "Dragonfly".[1][2] Havex was discovered in 2013 and is one of five known ICS tailored malware developed in the past…
State-sponsoredMalwareMobile
Evolving Tactics of SLOW#TEMPEST: A Deep Dive Into Advanced Malware Techniques
In late 2024, we discovered a malware variant related to the SLOW#TEMPEST campaign. In this research article, we explore the obfuscation techniques employed by the malware authors. We deep dive into these malware samples and highlight methods and code that…
Malware
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool Sword2033 Tool: Sword2033 Names Sword2033 Category Malware Type Backdoor, Downloader, Exfiltration Description (Palo Alto) Pivoting on the C2 domain, we identified one additional sample that…
Malware
FinFisher (Malware Family)
Source: https://malpedia.caad.fkie.fraunhofer.de/details/apk.finfisher
MalwareMobile
A Totally Tubular Treatise on TRITON and TriStation
In December 2017, FireEye's Mandiant discussed an incident response involving the TRITON framework. The TRITON attack and many of the publicly discussed ICS intrusions involved routine techniques where the threat actors used only what is necessary to succeed…
Malware
New ServHelper Variant Employs Excel 4.0 Macro to drop Singed Payload
ServHelper is a recently discovered backdoor associated with TA505. A veteran threat group that has also been associated with the infamous Dridex banking malware, the GlobeIimposter ransomware, and other high-profile malware campaigns. Deep Instinct Threat…
Malware
Added Sun 5 Apr
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool Karkoff Tool: Karkoff Names Karkoff MailDropper DropperBackdoor CACTUSPIPE OILYFACE Category Malware Type Backdoor, Dropper Description (Talos) In April, Cisco Talos identified an…
Malware
contagio
Contagio is a collection of the historic malware samples, threats, observations, and analyses. Malware samples are available for download by any responsible whitehat researcher. By downloading the samples, anyone waives all rights to claim punitive,…
Malware
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.