Research reports
TopicAll topics
PublisherAll publishers
- All publishers1,259
- Check Point99
- DataBreaches.net51
- GitHub50
- MITRE ATT&CK44
- Mandiant (Google)33
- Microsoft31
- Group-IB29
- Recorded Future22
- ETDA Threat Group Cards20
- Medium20
- Unit 4220
- Trend Micro19
- CISA18
- ESET17
- Malpedia15
- Team Cymru15
- ANSSI (CERT-FR)13
- Intezer13
- US Department of Justice13
- FBI IC312
- Virus Bulletin11
- PhishLabs10
- Elastic Security Labs9
- Intrinsec9
- SecurityScorecard9
- Cisco Talos8
- Kaspersky8
- Proofpoint8
- SOCRadar8
- The Hacker News8
SortNewest added
321–340 of 1,259 reports · page 17 of 63
Added Thu 6 Aug
aquasec.com · Web page · Published 1 Apr
Update: Ongoing Investigation and Continued Remediation
Over the past week, we have nearly finalized our investigation and are now in the final stages of documentation and review. There continues to be no indication that Aqua’s commercial products have been affected. As part of this process, we identified…
FBI IC3 · Web page · Published 15 May
Internet Crime Complaint Center (IC3)
The Federal Bureau of Investigation (FBI) is providing this Public Service Announcement (PSA) to warn of potential future impacts related to a cyber-attack that affected an online Learning Management System (LMS), resulting in an interruption of service to…
spycloud.com · Web page · Published 11 Jun
Kali365: Anatomy of a Microsoft 365 Phishing-as-a-Service Kit – From Telegram Hype to FBI Takedown Theater
The operators of Kali365 maintain an active marketing Telegram channel which has actively posted about the kit and advertised its features, including in this post first seen on 12 March 2026: Notably, Kali365 advertised two phishing methods that are…
Mandiant (Google) · Web page · Published 23 Oct
TRITON Attribution: Russian Government-Owned Lab Most Likely Built Custom Intrusion Tools for TRITON Attackers « TRITON Attribution: Russian Government-Owned Lab Most Likely Built Custom Intrusion Tools for TRITON Attackers
In a previous blog post we detailed the TRITON intrusion that impacted industrial control systems (ICS) at a critical infrastructure facility. We now track this activity set as TEMP.Veles. In this blog post we provide additional information linking TEMP.Veles…
Aikido · Web page · Published 22 Mar
CanisterWorm Gets Teeth: TeamPCP's Kubernetes Wiper Targets Iran
We found a new payload in the TeamPCP arsenal, and this one doesn't just steal credentials or install backdoors. It wipes entire Kubernetes clusters. The script uses the exact same ICP canister ( tdtqy-oyaaa-aaaae-af2dq-cai[.]raw[.]icp0[.]io ) we documented…
Aikido · Web page · Published 27 Mar
Popular telnyx package compromised on PyPI by TeamPCP
The pattern is consistent: steal credentials from a trusted security tool, use those credentials to push malicious versions of whatever that tool had access to, collect whatever's running in the next environment, repeat. Where This Fits in the Campaign A…
Wiz · Web page · Published 23 Mar
KICS GitHub Action Compromised: TeamPCP Strikes Again in Supply Chain Attack
The KICS GitHub Action was compromised with credential-stealing malware by TeamPCP, the same group behind the Trivy attack. KICS is an open source infrastructure as code security scanner by Checkmarx. Between 12:58 and 16:50 UTC on March 23rd, any users of…
phoenix.security · Web page · Published 20 May
TeamPCP Wave Four: GitHub Breach via Poisoned VS Code Extension, durabletask PyPI Worm, and ~4,000 Internal Repositories Exfiltrated
On May 19–20, 2026, two events landed within hours of each other. Wiz and Endor Labs documented three malicious versions of durabletask (1.4.1, 1.4.2, and 1.4.3) pushed to PyPI within a 35-minute window on May 19, the official Microsoft Azure Python SDK for…
NCC Group · Web page · Added 6 Aug
LAPSUS$: Recent techniques, tactics and procedures
This research was conducted by David Brown, Michael Matthews and Rob Smallridge from NCC Group Cyber Incident Response Team. You can find more here Incident Response – NCC Group tl;dr This post describes the techniques, tactics and procedures we observed…
harmj0y.net · Web page · Published 22 Sep
Mimikatz and DCSync and ExtraSids, Oh My
Benjamin Delpy is constantly adding new features to Mimikatz. In June, he added the ability to include ExtraSids in golden tickets. This was built in coordination with Sean Metcalf‘s work on the subject, and something I talked about here. Benjamin also…
Mandiant (Google) · Web page · Published 30 Jan
Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft
Mandiant has identified an expansion in threat activity that uses tactics, techniques, and procedures (TTPs) consistent with prior ShinyHunters-branded extortion operations. These operations primarily leverage sophisticated voice phishing (vishing) and…
Arctic Wolf · Web page · Published 2 Jun
From Token Bingo to MAX Takeover: Kali365 Operator Expands Operation Across Microsoft Outlook, Okta, Xerox DocuShare, and Other Services
In our previous post, Token Bingo: Don’t Let Your Code Be the Winner, we documented Kali365, a phishing-as-a-service (PhaaS) kit abusing Microsoft’s OAuth 2.0 device authorization flow to steal Entra ID tokens. In this follow-up report, we track the same…
hunt.io · Web page · Published 14 May
How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account
When Wiz Research published their analysis of the Mini Shai-Hulud supply chain campaign, the focus was on the trojanized npm and PyPI packages used to reach developer machines. What happened after delivery got considerably less coverage. The second-stage…
IBM X-Force · Web page · Published 4 Dec
New Destructive Wiper ZeroCleare Targets Energy Sector in the Middle East
IBM X-Force has been researching and tracking destructive malware in the Middle East for some time now, particularly in the industrial and energy sectors. Since the first Shamoon attacks that started impacting organizations in the region in the summer of…
Mandiant (Google) · Web page · Published 11 Jun
ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit
Mandiant and Google Threat Intelligence Group (GTIG) have identified an active compromise and extortion campaign attributed to UNC6240 (ShinyHunters) targeting Oracle PeopleSoft application infrastructure. The activity was observed between May 27, 2026, and…
Unit 42 · Web page · Published 31 Mar
Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure
Between late February and March 2026, threat group TeamPCP conducted a highly calculated, escalating sequence of supply chain threats. It systematically compromised widely trusted open-source security tools, including the vulnerability scanners Trivy and KICS…
GitHub · Web page · Added 6 Aug
Trivy ecosystem supply chain temporarily compromised
On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in aquasecurity/setup-trivy On March 22, 2026, a threat actor used compromised credentials to publish a malicious…
airbus-cyber-security.com · Web page · Published 11 Jul
The Eye of the Tiger
Cyber espionage has been a hot topic through the last years. Computer attacks known as “APT” (Advanced Persistent Threat) have become widely reported and emphasized by the media, damages are now considered as real and strategic trends are moving in cyber…
FBI IC3 · Web page · Published 21 May
Internet Crime Complaint Center (IC3)
The Federal Bureau of Investigation (FBI) is issuing this Public Service Announcement (PSA) to warn the public about an emerging Phishing1-as-a-Service2 (PhaaS) platform called Kali365, first seen in April 2026. Kali365 has primarily been distributed via…
Wiz · Web page · Published 20 Mar
Trivy Compromised: Everything You Need to Know about the Latest Supply Chain Attack
Update March 23, 17:40 UTC: Wiz Research has identified a parallel compromise of kics-github-action On March 19, 2026, threat actors compromised Aqua Security's Trivy vulnerability scanner, injecting credential-stealing malware into official releases and…
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.