Research reports
TopicAll topics
PublisherAll publishers
- All publishers1,259
- Check Point99
- DataBreaches.net51
- GitHub50
- MITRE ATT&CK44
- Mandiant (Google)33
- Microsoft31
- Group-IB29
- Recorded Future22
- ETDA Threat Group Cards20
- Medium20
- Unit 4220
- Trend Micro19
- CISA18
- ESET17
- Malpedia15
- Team Cymru15
- ANSSI (CERT-FR)13
- Intezer13
- US Department of Justice13
- FBI IC312
- Virus Bulletin11
- PhishLabs10
- Elastic Security Labs9
- Intrinsec9
- SecurityScorecard9
- Cisco Talos8
- Kaspersky8
- Proofpoint8
- SOCRadar8
- The Hacker News8
SortNewest added
281–300 of 1,259 reports · page 15 of 63
Added Thu 3 Sep
thecybersecguru.com · Web page · Published 17 Aug
Azure Data Exfiltration: TheHatman Campaign Exposes Millions of Records
The modern enterprise security perimeter has fundamentally collapsed, shifting away from fortified network firewalls and landing squarely on the fragile concept of digital identity. A sprawling and sophisticated data exfiltration campaign currently unfolding…
zerotracelab.com · Web page · Added 3 Sep
The QTFY Hunt: How Chinese Hackers Were Tracked and How the Internet Became the Sensor
QTFY is better understood as an infrastructure quartermaster than a conventional hacking group: its role appears to be providing reconnaissance, access and obfuscation capabilities as reusable services to multiple state customers. Much of its concealment…
IBM X-Force · Web page · Published 20 Aug
Trapping a Mustang Panda
As of mid-2026, IBM X-Force continues to monitor cyber campaigns conducted by ITG27, a China-aligned state-sponsored espionage group whose victims align with China’s regional strategic interests. In collaboration with Deception.Pro, X-Force captured live…
Group-IB · Web page · Published 31 Aug
Anatomy of BraZetsu: How Cybercriminals Fuel the Underground Ecosystem
The Group-IB Threat Intelligence team has identified BraZetsu, a sophisticated Python-based Windows malware framework that we attribute, with high confidence, to the Brazilian threat actor known as Exilware. Unlike the standard infostealer model, BraZetsu is…
hendryadrian.com · Web page · Published 1 Sep
Financially Motivated Threat Actor BREEZE COMET Targets Brazil
BREEZE COMET is a financially motivated threat actor that targets Brazilian financial services, retail, and eCommerce organizations by abusing compromised websites, custom malware, and stolen credentials to manipulate payment systems and fraudulent transfers.…
Added Wed 2 Sep
Trend Micro · Web page · Added 2 Sep
Prompting the Payload: How an npm Supply Chain Attack Delivers the RedC2 AI-Powered Linux Implant
RedC2 extends its control layer with an AI-driven component called Red post-exploitation tasks, from network reconnaissance to credential dumping, using natu
Added Tue 1 Sep
Microsoft · Web page · Published 29 Aug
TerminalFix campaign deploys a reverse tunnel through multistage intrusion
By Microsoft Security Research, Sagar Patil, Suriyaraj Natarajan, Parasharan Raghavan Microsoft Threat Intelligence has observed a TerminalFix campaign, a variant of ClickFix, targeting organizations across multiple industries. The campaign uses compromised…
GitHub · Web page · Published 21 Mar
public-research/cecbot/report.md at main · deepfield/public-research
Medium · Web page · Published 30 Aug
Reverse Engineering the Auto-Color Linux Backdoor
Static and dynamic analysis of Auto-Color’s execution flow, C2 communication, and LD_PRELOAD rootkit. Auto-Color in a Nutshell Auto-Color is an emerging Linux backdoor first documented by Palo Alto Networks Unit 42 in February 2025. The earliest known samples…
Proofpoint · Web page · Published 25 Aug
Carry-On Compromise: TA4922 Packs PackClient
August 27, 2026 Kyle Cucci, Rob Kinner, Tony Robinson and the Proofpoint Threat Research Team Key Findings Proofpoint identified a command and control (C2) framework called PackClient sold on Telegram. It is being used by at least one threat actor,…
quetzal.bitso.com · Web page · Published 21 Aug
North Korea’s Crypt: Hunting Ghosts
Here we are again. The Quetzal Team just returned from DEF CON Las Vegas after delivering talks and workshops about North Korean malware at the Adversary, Red Team, and Malware Villages, and having the honour of conquering the Main Stage. Nelson Colón from…
Added Sat 29 Aug
fieldeffect.com · Web page · Published 24 Aug
A ClickFix cluster: Observed activity from recent ClickFix campaigns
As ClickFix has become one of the most common infection techniques over the last few years, adversaries continue to refine and adapt their delivery mechanisms. Earlier this summer, the Field Effect team observed a ClickFix campaign employing three distinct…
antonioparata.blogspot.com · Web page · Added 29 Aug
shrun, apiwatcher, and argus: three malware analysis tools built with Claude
It has been a while since my last blog post. In this one I'll present my experiment with using build three Rust-based tools that ease my malware analysis workflow The Malware: Lorem Ipsum I'll present three tools I built with Claude to analyze the Lorem Ipsum…
Added Tue 25 Aug
aryaka.com · PDF · Added 25 Aug
Beyond the Batch File: Analysis of a Multi‑Stage DonutLoader Infection Chain
Persistence Mechanism 11 Secondary PowerShell Payload Recovery 13 Shellcode Recovery and Target Process Selection 13 Process
LevelBlue · PDF · Added 25 Aug
CNCMahineRMS
A ClickFix lure. A legitimately signed IBM SPSS IDE. Four side-loaded DLLs. A date formatting API used as a trampoline. And at the end of it all, a 1.14 MB implant that calls itself Most writeups of a BabaDeda intrusion stop at the loader and conclude with a…
Netresec · Web page · Published 21 Aug
CNCMachineRMS C2 Protocol
This post describes the binary command-and-control (C2) protocol used by CNCMachineRMS, a recently identified remote access trojan (RAT). We cover how the protocol was discovered, how its infrastructure was identified, and how network defenders can detect it.…
Added Sat 22 Aug
AhnLab · Web page · Published 10 Aug
Attack Cases for Domestic Web Servers Running SoftEther VPN in Korea
The AhnLab SEcurity intelligence Center (ASEC) recently identified attack cases in which attackers targeted web servers in Korea to install SoftEther VPN. Attack cases involving the installation of SoftEther VPN, an open-source VPN, were previously discussed…
presse.economie.gouv.fr · Web page · Published 14 Aug
[[overtitle]] Accès illégitimes au système d’information de la Direction générale des Finances publiques[[cp_subtitle1]]
COMMUNIQUÉ DE PRESSE Paris, le 14 août 2026 N°953 Accès illégitimes au système d'information de la Direction générale des Finances publiques Mercredi 12 et jeudi 13 août 2026, un acteur malveillant a revendiqué des accès illégit
Bitdefender · Web page · Published 19 Aug
SilkParasite: Tracking a China-Nexus APT Across Central Asia
TL;DR: SilkParasite is a cyberespionage operation, assessed at medium confidence as China-nexus, that targeted government bodies across Central Asia. Bitdefender Labs found seven remote access tool (RAT) families in use, five of which were previously…
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.