Research reports

BleepingComputer · Web page · Published 17 Aug

French tax authority data breach affects 678,000 individuals

The French Ministry of the Economy and Finance has disclosed a data breach after an attacker accessed the General Directorate of Public Finances (DGFiP) systems and stole data belonging to 678,000 individuals. This incident was discovered after a threat actor…

Zscaler · Web page · Published 17 Aug

C2Looper Backdoor Uses GitHub for C2

In the following sections, ThreatLabz examines the technical details of the identified C2Looper variants, including their features, network communication protocols and commands. String encryption and Windows API resolution All identified C2Looper variants use…

Symantec · Web page · Added 18 Aug

Jewelbug: APT Group Runs Espionage and Crypto Fraud Operations Side by Side

Jewelbug is a China-based hackers-for-hire group that runs parallel operations: espionage against governments and militaries across the Middle East, Southeast Asia and South Asia, and a for-profit cryptocurrency fraud business. Both missions are administered…

securelist.ru · Web page · Published 7 Aug

Head Mare доставляет бэкдоры PhantomCore и PhantomGraph через необновленный сервер TrueConf

UPD 10.08.2026: добавлены правила для защиты компаний, использующих нашу SIEM-систему Kaspersky Unified Monitoring and Analysis Platform (KUMA), а также события для разработки собственных правил детектирования или проведения threat hunting. UPD 07.08.2026:…

broadcom.com · Web page · Added 14 Aug

Gunra Ransomware

Another ransomware actor operating under the name Gunra has recently surfaced, allegedly claiming several victims in the healthcare, electronics, and beverage manufacturing sectors, as listed on their onion website. In recent activity, the ransomware they…

Elastic Security Labs · Web page · Published 16 Jul

TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains

Elastic Security Labs is tracking an emerging threat named TELEPUZ, which we have discovered spreading widely via a CLICKFIX-VIDAR chain. This malware is in active development and has been operating since late April 2026, according to the infrastructure…

Sonatype · Web page · Published 10 Aug

Six npm Packages Use Ethereum Transactions to Retrieve Malicious Payloads

Sonatype Research Labs identified six npm packages delivering the same malicious payload: three hijacked legitimate packages and three additional malicious packages, tracked as sonatype-2026-005899 and sonatype-2026-005901. The malware uses the same Ethereum…

Unit 42 · Web page · Added 10 Aug

UNIT 42 PLAYBOOK VIEWER

SOCRadar · Web page · Published 28 Jul

Dark Web Profile: ExfilSquad

ExfilSquad is an emerging data-extortion group that surfaced with a rapid wave of public claims and a Tor-hosted Data Leak Site (DLS). The group is associated with an “only exfiltration” model, suggesting a focus on data theft rather than confirmed file…

SOCRadar · Web page · Published 18 Mar

Dark Web Profile: ShinyHunters

[Update] July 31, 2025: “ShinyHunters Behind CRM Attacks on Qantas, Adidas, and Others” Within the obscured world of the Deep/Dark Web, where cybercrime flourishes amidst databases, initial access brokers, and a plethora of illegal activities, there exists a…

SOCRadar · Web page · Added 10 Aug

orova Ransomware Group Profile

Orova is a newly emerged ransomware extortion group that has been active since mid-2026. They focus on compromising corporate networks and leveraging data exfiltration to enforce ransom payments, utilizing a dedicated data leak site on the dark web to publish…

SOCRadar · Web page · Added 9 Aug

gammax Ransomware Group Profile

Gammax is a newly emerged extortion and crypto-ransomware operation that began in July 2026, focusing on commercial enterprises and utilities. The group employs a double-extortion model by exfiltrating sensitive data before encrypting files, using a dedicated…

Proofpoint · Web page · Published 28 Jul

Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit

By By Greg Lesnewich, Stuart Del Caliz, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly, and the Proofpoint Threat Research Team July 29, 2026 By Greg Lesnewich, Stuart Del Caliz, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly, and…

AhnLab · Web page · Published 24 Jul

Case Study: Targeted Attack Case on an MS-SQL Server Involving the Installation of GotoHTTP and SoftEther VPN

While monitoring attack cases targeting MS-SQL servers, the AhnLab SEcurity intelligence Center (ASEC) identified an instance in which the Larva-26009 threat actor installed the XMRig CoinMiner. While the installation of CoinMiner is common in attack cases…

AhnLab · Web page · Published 3 Aug

Analysis of the Connection Between Xctdoor and Past CRAT Attack Cases (Larva-26005)

AhnLab SEcurity intelligence Center (ASEC) recently confirmed that the Larva-26005 threat actor is distributing Xctdoor to users in Korea. Xctdoor was disclosed through the ASEC blog in 2024, and [1] In March 2026, Hauri disclosed an attack case in which the…

AhnLab · Web page · Published 2 Aug

Analysis of a Phishing Email Attack Case by the Larva-24009 Threat Actor

The Larva-24009 threat actor has been active since at least 2023, carrying out phishing email attacks targeting users both in Korea and globally to install malware. ASEC (AhnLab SEcurity intelligence Center (ASEC) has previously disclosed attack cases by this…

Mandiant (Google) · Web page · Published 24 Jul

Updated Cyber Threat Actor Naming System

Update (July 30): A table listing the new names of select prominent threat actors was appended to this post. Introduction Today, Google Threat Intelligence Group (GTIG) will begin rolling out a unified naming schema for tracking threat actors. This new naming…

cybersecuritynews.com · Web page · Published 3 Aug

ModernStealer Threat Actor Linked to Government and Defense Data-Leak Claims

ModernStealer is the name behind underground posts claiming to offer military, government, nuclear, and aerospace material. The posts appeared on dark web forums and Telegram, making a single alias a concern for public-sector and defence teams. The activity…

stealthmole-intelligence-hub.blogspot.com · Web page · Added 7 Aug

Tracing an Underground Military Data Network

Underground data markets are filled with sellers offering stolen databases, compromised credentials, and confidential records. But military and defence-related data sits in a different category. Claims involving classified documents, military personnel,…

Intel 471 · Web page · Published 22 Oct

Here’s how to guard your enterprise against ShinyHunters

There is a group in the cybercriminal underground that is trying to collect troves of enterprise data the same way that millions of gamers collect Pokémon. Since surfacing in April 2020, the group — which refers to itself as ShinyHunters — has been behind…