Research reports

SecurityScorecard · PDF · Added 29 Oct

A Deep Dive into Medusa Ransomware

Medusa ransomware appeared in June 2021, and it became more active this year by launching the “Medusa Blog” containing data leaked from victims that didn’t pay the ransom. The malware stops a list of services and processes decrypted at runtime and deletes the…

logpoint.com · PDF · Added 24 Oct

logpoint-etpr-a-comprehensive-overview-on-stealer-malware-families-1.pdf?hsLang=en

Over the years, the Logpoint Security Research Team has dedicated efforts on researching emerging threats in the Cybersecurity landscape. As we move into 2024, one trend continues to remains as a significant threat: Stealer Malware also known as Info…

botconf.eu · PDF · Added 16 Oct

Botconf2022-19-FaouCoteCyr.pdf

Operation Cache Panda: Zero-Day in Financial Software Exploited by China-Linked Threat Group Valentine’s Day this year saw the end of a truly toxic relationship — a prolonged supply chain attack targeting the Taiwan financial and securities trading sector…

2655225.fs1.hubspotusercontent-na1.net · PDF · Added 10 Sep

cyber

StealeriumPy: A Stealerium variant distributed through ClickFix Executive Summary Key Takeaways Infection Chain Summary of the Analysis Technical Analysis Part 1: Analysis of the Stealerium Loader Part 2: Analysis of the Stealerium Payload Modules…

Anthropic · PDF · Added 30 Aug

b2a76c6f6992465c09a6f2fce282f6c0cea8c200.pdf

Vibe hacking: how cybercriminals are using AI coding agents to scale data 4 extortion operations Remote worker fraud: how North Korean IT workers are scaling fraudulent 11 employment with AI No-code malware: selling AI-generated ransomware-as-a-service 15…

Sonatype · PDF · Added 17 Aug

How-North-Korea-Backed-Lazarus-Group-is-Weaponizing-Open-Source-Whitepaper.pdf

How North Korea-Backed Lazarus Group Is Weaponizing Open Source to Target Developers 1 How North Korea-Backed Lazarus Group Is Weaponizing Open Source to Target Developers Sonatype Security Research How North Korea-Backed Lazarus Group Is Weaponizing Open…

quickheal.co.in · PDF · Added 16 Aug

Whitepaper_HowToPM_QuickHeal

3.1 How Emotet is compromising websites and using it as a threat distributor? 03 3.2 How malware are evading Detections on webservers: 03 3.2.1 Initial Infection Scripts: 04 A. Edit.php: 04 B. Remote.php: 05 C. Settings.php: 05 D. Minify.php: 05 E.…

prod.website-files.com · PDF · Added 29 Jul

CTM360 Report: PlayPraetor Trojan - Clear TLP

A large-scale scam campaign has been uncovered, actively targeting users through fraudulent Google Play Store download pages. Detected by CTM360, this scheme involves meticulously crafted fake Play Store websites that closely mi

vblocalhost.com · PDF · Added 22 Jul

VB2020 paper: SilentFade: unveiling a malware ecosystem that targeted the Facebook ad platform

2 VIRUS BULLETIN CONFERENCE SEPT - OCT 2020 INTRODUCTION All successful malware campaigns require a medium for proliferation. Originally, malware relied on emails, software piracy over peer-to-peer services, and autorun functionality from removable drives,…

SecurityScorecard · PDF · Added 18 Jul

How to Analyze Java Malware – A Case Study of STRRAT

STRRAT is a Java-based malware that executes multiple commands transmitted by the C2 server. The JAR file was obfuscated using the Allatori obfuscator. It establishes persistence on the host by copying to the Startup folder and creating a scheduled task and a…

Recorded Future · PDF · Added 8 Jul

GrayAlpha Uses Diverse Infection Vectors to Deploy PowerNet Loader and NetSupport RAT

Insikt Group identified three GrayAlpha infection vectors: fake browser updates, fake 7-Zip sites, and the use of the TDS TAG-124 network, which had not been publicly linked to GrayAlpha until now. Insikt Group discovered PowerNet, a new PowerShell loader,…

logpoint.com · PDF · Added 26 Jun

logpoint-etpr-a-comprehensive-overview-on-stealer-malware-families.pdf

Over the years, the Logpoint Security Research Team has dedicated efforts on researching emerging threats in the Cybersecurity landscape. As we move into 2024, one trend continues to remains as a significant threat: Stealer Malware also known as Info…

WithSecure · PDF · Added 22 May

W_Intel_Research_KeePass_Trojanised_Malware_Campaign.pdf

Recorded Future · PDF · Added 10 May

TerraStealerV2 and TerraLogger: Golden Chickens’ New Malware Families Discovered

CYBER THREAT ANALYSIS TerraLogger represents the first observed use of a keylogging capability in malware developed by Golden Chickens. Insikt Group observed ten distinct TerraStealerV2 distribution samples between January and March 2025, delivered in varied…

zambo99.github.io · PDF · Added 26 Apr

s&p2024.pdf

Luis Salazar∗, Sebastián R. Castro∗, Juan Lozano∗, Keerthi Koneru∗, Emmanuele Zambon† Bing Huang‡, Ross Baldick‡, Marina Krotofil§, Alonso Rojas¶ and Alvaro A. Cardenas∗ ∗University of California, Santa Cruz †Eindhoven University of Technology ‡The…

Black Hat · PDF · Added 23 Apr

us-17-Bohannon-Revoke-Obfuscation-PowerShell-Obfuscation-Detection-And Evasion-Using-Science-wp.pdf

Revoke-Obfuscation is the result of industry research collaboration between Daniel Bohannon - Senior Applied Security Researcher at Mandiant / FireEye, and Lee Holmes – Lead Security Architect of Azure Management at Microsoft. Background By far the most…

Mandiant (Google) · PDF · Added 23 Apr

apt37-reaper-the-overlooked-north-korean-actor.pdf

On Feb. 2, 2018, we published a blog detailing the use of an Adobe Flash zero-day vulnerability (CVE-2018-4878) by a suspected North Korean cyber espionage group that we now track as APT37 (Reaper). Recent examination of this group’s activities by FireEye…

Dragos · PDF · Added 23 Apr

Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_r2.pdf

What Is the Modbus Protocol? FrostyGoop ICS Malware Capabilities Optional Command Line Execution Arguments Configuration File Modbus TCP Network Traffic Logging Capabilities 2024 OT Cyber Attack Impacting Communities in Ukraine Assessing the Broader Impact on…

cdn2.hubspot.net · PDF · Added 23 Apr

CopyKittens.pdf

papers.put.as · PDF · Added 23 Apr

RSA_2016.key

“leverages the best combina1on of humans and technology to discover security vulnerabili1es in our customers’ web apps, mobile apps, IoT devices and infrastructure endpoints” @patrickwardle security for the 21st century career hobby OUTLINE steps to a…