Research reports
1,224 reports from 387 publishers45 added in the past week
294 reports, newest added first
Added Sun 5 Apr
Inside The Lab
Identifier: TRR250601. Summary This report examines recent activities we attribute to the XDSpy threat actor, focusing on an ongoing campaign targeting Eastern European and Russian governmental entities using the XDigo malware, dating back to March 2025. Our…
State-sponsoredMalware
LockBit 2.0 Ransomware Becomes LockFile Ransomware with a Never-Before-Seen Encryption Method
Threat actors are constantly improving their attack mechanisms to gain an advantage over cybersecurity defenses. Sometimes this involves new malware; other times this means making iterative adjustments to previously successful malware to exploit new…
RansomwareMalwareVulnerabilities
TA505’s modified loader means new attack campaign could be coming
After months of inactivity, hacking group TA505's Get2 Loader has sprung back into operation, possibly signaling that the group is ready for a new round of malicious activity. On December 14, 2020, the Get2 loader had resurfaced with new download and execute…
Malware
Analysis of New Agent Tesla Spyware Variant
Recently, FortiGuard Labs captured a new malware sample that was spread via Microsoft Word documents. After some quick research, I discovered that this was a new variant of the Agent Tesla spyware. I analyzed another sample of this spyware last June and…
Malware
Added Thu 2 Apr
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool Janeleiro Tool: Janeleiro Names Janeleiro Category Malware Type Banking trojan, Backdoor, Keylogger, Info stealer, Credential stealer Description (ESET) This new threat, which we’ve named…
MalwareInfostealers
Added Wed 1 Apr
Operation Poisoned News: Hong Kong Users Targeted with Mobile Malware via Local News Links
By Elliot Cao, Joseph C. Chen, William Gamazo Sanchez, Lilang Wu, and Ecular Xu Contents 1 Attack Chain 1.1 Watering hole attack tactic 1.2 Infection chain 2 Exploits Analyses 2.1 The JavaScriptCore exploit 2.1.1 Bug triggering 2.1.2 The addrof/fakeobj…
MalwareVulnerabilitiesMobile
Added Tue 24 Mar
Google-Calendar-as-C2-infrastructure-a-China-nexus-campaign-with-stealthy-tactics.pdf
GOOGLE CALENDAR AS C2 INFRASTRUCTURE: A CHINA-NEXUS CAMPAIGN... CHEN & HSU 2 VIRUS BULLETIN CONFERENCE SEPTEMBER 2025 ABSTRACT In recent years, China-nexus threat groups have increasingly adopted tactics to obscure their malware footprint, particularly…
Malware
Added Thu 5 Mar
ClearSky report on BadPaw and MeowMeow Russian malware
P a g e 2 ClearSky Team has identified a targeted Russian cyber campaign against Ukraine utilizing two novel malware strains, BadPaw and MeowMeow. The attack chain initiates with a phishing email containing a link to a ZIP archive. Once extracted, an initial…
Malware
Added Wed 7 Jan
Pulsar RAT Technical Malware Analysis Report
" Ge ANTI VM & SANDBOX PERSISTENCE i: PULSAR RAT schtask.exe A VICTIM C2 SERVER PULSAR RAT TECHNICAL & MALWARE ANALYSIS DIAMOND MODEL Adversary NW Open Source / Public Project YV Pulsar - Github QP Kingkoot - Lead Developer Capabilities Infrastructure NW Cre
Malware
Added Wed 31 Dec 2025
Beyond Potentially Unwanted Apps: Malware Behind Fake PDF Converters
Author: Serkan Sirmaci, Cyber Security Analyst @ Controlware CSIRT Contact: threatreport@controlware.de www.controlware.de blog.controlware.de Author: Serkan Sirmaci Version: 1.2 Classification: EXTERN Status: December 2025 Status: Final Page 2 von 19…
Malware
Added Wed 26 Nov 2025
DAMASCENED PEACOCK
Windows, delivered via spear-phishing. DAMASCENED PEACOCK A lightweight, staged downloader targeting Windows, delivered via spear-phishing. Executive summary • DAMASCENED PEACOCK is a lightweight downloader targeting Windows. • The analysed sample was for…
MalwarePhishing
Added Sat 22 Nov 2025
SQ_White Paper_Wrap
Warp is a potent malware written in the GO programming language, designed to load payloads and ex-filtrate sensitive information via Telegram. As new variants emerge daily in the current threat landscape to steal sensitive information from infected systems,…
MalwareInfostealers
Added Thu 30 Oct 2025
Added Wed 29 Oct 2025
A Deep Dive into Medusa Ransomware
Medusa ransomware appeared in June 2021, and it became more active this year by launching the “Medusa Blog” containing data leaked from victims that didn’t pay the ransom. The malware stops a list of services and processes decrypted at runtime and deletes the…
RansomwareMalware
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.