Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,232 reports388 publishers49 added in the past week

321–340 of 353 reports · page 17 of 18 · Clear filters

Added Tue 22 Apr 2025

NVISO · PDF · Added 22 Apr
NVISO-BRICKSTORM-Report.pdf
China-nexus cluster UNC5221. NVISO investigates newly identified Windows-based BRICKSTORM variants, expanding on its previous presence in Linux environments. These backdoor samples, linked to long-term espionage campaigns, target European industries in key…
State-sponsored Malware Original (new tab)

SecurityScorecard · PDF · Added 23 Feb
Operation-Marstech-Mayhem-Report_021025_03.pdf
SecurityScorecard.com info@securityscorecard.com Background In the wake of Operation99 and Operation Phantom Circuit, STRIKE uncovered that the Lazarus Group had engineered an advanced implant, codenamed "marstech1." This state-of-the-art tool marks a…
State-sponsored Malware Original (new tab)

CISA · PDF · Added 2 Feb
Contec CMS8000 Contains a Backdoor
Introduction The Cybersecurity and Infrastructure Security Agency (CISA) analyzed three versions of firmware for the Contec CMS8000, a patient monitor used by the Healthcare and Public Health sector, and discove
Malware Original (new tab)

Recorded Future · PDF · Added 28 Dec
BlueAlpha Abuses Cloudflare Tunneling Service for GammaDrop Staging Infrastructure
BlueAlpha continues to target Ukrainian entities with spearphishing campaigns, leveraging HTML smuggling attachments to deliver Visual Basic Script (VBScript)-based malware. BlueAlpha continues to use domain name system (DNS) fast-fluxing of GammaLoad…
Malware Original (new tab)

Virus Bulletin · PDF · Added 14 Dec
Let's go door with KCP
In 2022 we observed the use of new APT malware by an unknown China-based APT actor across several incidents in Japan. The malware uses KCP protocol for backdoor communication and was coded in Golang on multiple platform operating systems – we named it…
State-sponsored Malware Original (new tab)

Virus Bulletin · PDF · Added 10 Dec
CrackedCantil-a-malware-symphony-delivered-by-cracked-software-performed-by-loaders-infostealers-ransomware-et-al.pdf
The digital landscape teems with diverse malware families, each engineered with distinct capabilities – ranging from data theft, deployment of additional malicious payloads, to destruction of data and more. Yet, beneath their varied functionalities, these…
Ransomware Malware Infostealers Original (new tab)

NCSC (UK) · PDF · Added 13 Nov
ncsc-mar-pygmy-goat.pdf
Pygmy Goat Network Device Backdoor. Executive summary • Uses LD_PRELOAD to get loaded into /bin/sshd and hook its accept function. • Listens on a raw socket for incoming ICMP packets to trigger a connect back, or uses the hooked accept function to search for…
Malware Original (new tab)

Mandiant (Google) · PDF · Added 1 Nov
Poison Ivy Malware Analysis
Malware Original (new tab)
Mandiant (Google) · PDF · Added 1 Nov
M-Trends Report - 2020
Monetizing Ransomware 35 Crimeware as a Service 36 Threats From Within 40 4 SPECIAL REPORT M-TRE
Malware Original (new tab)
logpoint.com · PDF · Added 1 Nov
logpoint-etpr-pikabot.pdf
In the ever-changing environment of cybersecurity threats, the introduction of sophisticated malware presents substantial challenges to enterprises globally. Pikabot, a backdoor trojan that first appeared in early 2023, is one of these threats displaying a…
Malware Original (new tab)

hitcon.org · PDF · Added 24 Oct
Pirates_of_The_Nang_Hai_Follow_the_Artifacts_of_Tropic_Trooper,_No_One_Knows.pdf
ITOCHU Cyber & Intelligence inc. Who are we? Company: ITOCHU Cyber & Intelligence Inc. Suguru Ishimaru Sr. Cybersecurity Researcher HITCON 2021, 2019, 2017 and 2016 Yusuke Niwa Lead Cybersecurity Researcher VB2023, Botconf, JSAC etc. 2 Motohiko Sato X:…
Malware Original (new tab)

Recorded Future · PDF · Added 28 Sep
Rhadamanthys Stealer Adds
Detections and preventative measures unveiled for Rhadamanthys Stealer v0.7.0 provide an effective defense against this evolving threat, offering organizations strategies to prevent data theft and strengthen security. Rhadamanthys Stealer v0.7.0 is a global…
Malware Infostealers Original (new tab)

ria.ee · PDF · Added 17 Sep
Microsoft Word - tale_of_gamaredon_infection.docx
Gamaredon (Russian state sponsored) APT group has been active from 2013 and mostly known to target Ukrainian government and military officials with intention to gain access to information. Since the beginning of 2020 there are reports that APT group has taken…
State-sponsored Malware Original (new tab)

Dragos · PDF · Added 28 Aug
Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_.pdf
What Is the Modbus Protocol? FrostyGoop ICS Malware Capabilities Optional Command Line Execution Arguments Configuration File Modbus Network Traffic Logging Capabilities 2024 OT Cyber Attack Impacting Communities in Lviv, Ukraine Assessing the Broader Impact…
Malware Original (new tab)

app.box.com · Web page · Added 1 Aug
Operation ShadowCat: Targeting Indian Political Observers via a Stealthy RAT
Cyble Research and Intelligence Labs (CRIL) came across an intriguing shortcut (.LNK) file masquerading as a legitimate Office document. When the user executes the LNK file, it triggers the infection process, which runs a PowerShell command to drop and…
Malware Original (new tab)

GitHub · PDF · Added 26 Jul
New BugSleep Backdoor Deployed in Recent MuddyWater Campaigns - Check Point Research
MuddyWater, an Iranian threat group affiliated with the Ministry of Intelligence and Security (MOIS), has significantly increased its activities in Israel since the beginning of the Israel-Hamas war in October 2023. This parallels with activities against…
State-sponsored Malware Phishing Original (new tab)

JPCERT/CC · PDF · Added 25 Jul
JSAC2023_1_6_minakawa-saika-kubokawa_en.pdf
Overview 4 n Campaign using LODEINFO malware p Continuously observed for about 3 years since Dec. 2019 p Chinese state-backed APT group is behind (APT10?) n What we talk about to
State-sponsored Malware Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.