Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,233 reports388 publishers50 added in the past week

261–280 of 353 reports · page 14 of 18 · Clear filters

Added Wed 8 Apr

Check Point · Web page · Published 31 Oct
From Albania to the Middle East: The Scarred Manticore is Listening
Check Point Research (CPR) is monitoring an ongoing Iranian espionage campaign by Scarred Manticore, an actor affiliated with the Ministry of Intelligence and Security (MOIS). The attacks rely on LIONTAIL, an advanced passive malware framework installed on…
Malware Original (new tab)

Added Tue 7 Apr

Check Point · Web page · Published 3 Jun
SharpPanda: Chinese APT Group Targets Southeast Asian Government With Previously Unknown Backdoor
Check Point Research identified an ongoing surveillance operation targeting a Southeast Asian government. The attackers use spear-phishing to gain initial access and leverage old Microsoft Office vulnerabilities together with the chain of in-memory loaders to…
State-sponsored Malware Original (new tab)

Added Mon 6 Apr

rsa.com · Web page · Added 6 Apr
pandemiya-emerges-new-malware-alternative-zeus-based
Malware Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Encrypted Channel, Technique T1573 - Enterprise
APT29 has used multiple layers of encryption within malware to protect C2 communication.[1] G1002 BITTER BITTER has encrypted their C2 communications.[2] S0631 Chaes Chaes has used encryption for its C2 channel.[3] S0498 Cryptoistic Cryptoistic can engage in…
State-sponsored Malware Botnets and DDoS Original (new tab)
dl.acm.org · Web page · Added 6 Apr
Rage against the virtual machine
Several features on this page require Premium Access. Information & Contributors Bibliometrics & Citations Reading Options References Figures Tables Media Share Abstract Antivirus companies, mobile application marketplaces, and the security research…
Malware Mobile Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Encrypted Channel, Technique T1573 - Enterprise
APT29 has used multiple layers of encryption within malware to protect C2 communication.[1] G1002 BITTER BITTER has encrypted their C2 communications.[2] S0631 Chaes Chaes has used encryption for its C2 channel.[3] S0498 Cryptoistic Cryptoistic can engage in…
State-sponsored Malware Botnets and DDoS Original (new tab)
ETDA Threat Group Cards · Web page · Added 6 Apr
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool Emdivi Tool: Emdivi Names Emdivi Newsripper Category Malware Type Backdoor Description (Kaspersky) The emdivi family stores important data about itself, including C2, API name, strings for…
Malware Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Software Discovery: Security Software Discovery, Sub-technique T1518.001 - Enterprise
ABK has the ability to identify the installed anti-virus product on the compromised host.[1] S1028 Action RAT Action RAT can identify AV products on an infected host using the following command: cmd.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2…
State-sponsored Malware Original (new tab)
ETDA Threat Group Cards · Web page · Added 6 Apr
Threat Group Cards: A Threat Actor Encyclopedia
Download this tool card in JSON format All groups using tool Jumpall Changed Name Country Observed APT groups APT 17, Deputy Dog, Elderwood, Sneaky Panda 2009-Jun 2024 APT 41 2012-Jul 2025 2 groups liste
State-sponsored Malware Original (new tab)
Malpedia · Web page · Added 6 Apr
Croxloader (Malware Family)
Source: https://malpedia.caad.fkie.fraunhofer.de/details/win.croxloader
Malware Original (new tab)
JPCERT/CC · Web page · Published 5 Mar
Malware “TSCookie”
Around 17 January 2018, there were some reports on the social media about malicious emails purporting to be from Ministry of Education, Culture, Sports, Science and Technology of Japan [1]. This email contains a URL leading to a malware called “TSCookie”.…
Malware Original (new tab)
objective-see.com · Web page · Added 6 Apr
OSX.EvilQuest Uncovered
Our research, tools, and writing, are supported by the "Friends of Objective-See" such as: 📝 👾 Want to play along? I’ve added the sample (‘OSX.EvilQuest’) to our malware collection (password: infect3d) …please don’t infect yourself! Background In part one…
Ransomware Malware Original (new tab)
BleepingComputer · Web page · Published 4 Jun
Google: Hackers target Salesforce accounts in data extortion attacks
Google has observed hackers claiming to be the ShinyHunters extortion group conducting social engineering attacks against multi-national companies to steal data from organizations' Salesforce platforms. According to Google's Threat Intelligence Group (GTIG),…
Ransomware Malware Original (new tab)
ETDA Threat Group Cards · Web page · Added 6 Apr
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool Gamaredon Tool: Gamaredon Names Gamaredon Category Malware Type Reconnaissance, Backdoor, Info stealer, Downloader Description (Palo Alto) The custom-developed malware is fully featured an…
State-sponsored Malware Original (new tab)
Unit 42 · Web page · Published 5 Oct
YiSpecter: First iOS Malware That Attacks Non-jailbroken Apple iOS Devices by Abusing Private APIs
We recently identified a new Apple iOS malware and named it YiSpecter. YiSpecter is different from previously seen iOS malware in that it attacks both jailbroken and non-jailbroken iOS devices through unique and harmful malicious behaviors. Specifically, it’s…
Malware Mobile Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
APT19, Codoso, C0d0so0, Codoso Team, Sunshop Group, Group G0073
APT19 used HTTP for C2 communications. APT19 also used an HTTP malware variant to communicate over HTTP for C2.[1][4] Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder An APT19 HTTP malware variant establishes…
State-sponsored Malware Original (new tab)
Malpedia · Web page · Added 6 Apr
RogueRobinNET (Malware Family)
Latest Target Attack of DarkHydruns Group Against Middle East RogueRobinNET DarkHydrus 2019-01-08 ⋅ paloalto Netoworks: Unit42 ⋅ Bryan Lee, Robert Falcone DarkHydrus delivers new Trojan that can use Google Drive for C2 c
Malware Original (new tab)
ETDA Threat Group Cards · Web page · Added 6 Apr
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool KARAE Tool: KARAE Names KARAE Category Malware Type Reconnaissance, Backdoor, Info stealer, Exfiltration Description (FireEye) Karae backdoors are typically used as first-stage malware after…
Malware Original (new tab)
Threatpost · Web page · Published 31 Jan
Chewbacca Point-of-Sale Malware Campaign Found in 10 Countries
A criminal campaign using the Tor-based Chewbacca Trojan, which includes memory-scraping malware and a keylogger, is responsible for the theft of more than 49,000 credit card numbers in 10 countries. Before you think that RAM scraper malware was a phenomenon…
Malware Original (new tab)
Wikipedia · Web page · Published 14 Apr
Havex
Havex malware, also known as Backdoor.Oldrea, is a Remote Access Trojan (RAT) employed by the Russian attributed APT group "Energetic Bear" or "Dragonfly".[1][2] Havex was discovered in 2013 and is one of five known ICS tailored malware developed in the past…
State-sponsored Malware Mobile Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.