Research reports
1,224 reports from 387 publishers45 added in the past week
1,015 reports, newest added first
Added Tue 28 Jul
Resecurity | Trinity of Chaos: The LAPSUS$, ShinyHunters, and Scattered Spider Alliance Embarks on Global Cybercrime Spree
LAPSUS$, Scattered Spider, and ShinyHunters are three of the most notorious English-speaking cybercrime groups operating today. While each group has its own distinct origins and operational history, recent developments (especially since 2023 to 2025) reveal…
Armored Likho's new weapon: BusySnake Stealer
During our routine threat monitoring, we uncovered a new phishing campaign tied to a previously unknown APT group that we dubbed Armored Likho (also known as Eagle Werewolf based on circumstantial evidence). This targeted campaign focuses heavily on…
State-sponsoredInfostealers
Meet Rey, the Admin of ‘Scattered Lapsus$ Hunters’
A prolific cybercriminal group that calls itself “Scattered LAPSUS$ Hunters” has dominated headlines this year by regularly stealing data from and publicly mass extorting dozens of major corporations. But the tables seem to have turned somewhat for “Rey,” the…
Analyzing "Scattered Lapsus$ Hunters" breaches since 2021
The biggest cybersecurity story this year (so far) has been the emergence of “Scattered Lapsus$ Hunters” and their record-breaking worldwide hacking spree. Scattered Lapsus$ Hunters is part of “The Com”, the name for the broad community of English-speaking…
Scattered LAPSUS$ Hunters: 2025's Most Dangerous Cybercrime Supergroup
In 2025, the cybersecurity world witnessed the sudden emergence of a new threat actor alliance dubbed Scattered Lapsus$ Hunters—a group that unites elements of three well-known cybercrime entities: Scattered Spider, LAPSUS$, and ShinyHunters. This convergence…
The Golden Scale: Bling Libra and the Evolving Extortion Economy
Scattered Lapsus$ Hunters: What Retail and Hospitality Organizations Should Know In recent months, threat actors claiming to be part of a new conglomerate dubbed Scattered Lapsus$ Hunters (aka SP1D3R HUNTERS, SLSH) have asserted responsibility for laying…
Ransomware
Threat Intelligence Report: JADEPUFFER Agentic Ransomware and Automated Extortion
Threat type: Agentic ransomware, destructive extortion, cloud and application compromise Activity status: Emerging Attribution: Unattributed Confidence: Moderate Primary source: Sysdig Threat Research Team Intended audience: Security leadership, threat…
Ransomware
CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure
Throughout 2025, we observed a cluster of activity targeting government entities and critical infrastructure in Southeast Asia. Specifically, the activity targeted state-owned enterprises in the energy and government sectors. The Chinese-speaking attackers…
JADEPUFFER: The Dawn of Agentic Ransomware Operations
A landmark report from the Sysdig Threat Research Team has documented the first known case of a truly “agentic” ransomware campaign, orchestrated by a threat actor dubbed JADEPUFFER. Unlike traditional attacks where a human sits behind a terminal, JADEPUFFER…
Ransomware
China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182)
December 29, 2025: The blog post was updated to add options for AWS Network Firewall. December 12, 2025: The blog post was updated to clarify when customers need to update their ReactJS version. Within hours of the public disclosure of CVE-2025-55182…
Vulnerabilities
New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack
Researchers at Sysdig have linked a second attack on the same Langflow server to JADEPUFFER, the AI-agent-driven operator it first documented earlier this month. The same operator has now been spotted deploying ENCFORGE, a new compiled Go ransomware designed…
Ransomware
Scattered LAPSUS$ Hunters: the cybercrime alliance that will shake global businesses in 2025
Launched in August 2025, the Scattered LAPSUS$ Hunters (SLSH) collective has rapidly established itself as one of the most formidable threats on today’s cybercriminal landscape. This alliance brings together three of the most notorious English-speaking…
Scattered LAPSUS$ Hunters: Anatomy of a Federated Cybercriminal Brand
Trustwave SpiderLabs’ Cyber Threat Intelligence team is tracking the emergence and communication dynamics of the cybercriminal brand known as Scattered LAPSUS$ Hunters (SLH), consolidating observed activity across public platforms to provide updated insights…
Added Sat 25 Jul
NSA and Partners Alert Zimbra Collaboration Suite Users of a Russian State-Supported Phish
NSA and Partners Alert Zimbra Collaboration Suite Users of a Russian State-Supported Phishing Campaign PHOTO INFORMATION FORT MEADE, Md. (July 23, 2026) — Today, the National Security Agency (NSA) in collaboration with partners, is releasing a Cybersecurity…
Phishing
Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT
Update: We have updated the malware attribution for this blog to SectopRAT due to the presence of HVNC in the .NET payload after closer inspection of the related Command and Control services revealed in the Ethereum BSC transactions. Background Between July…
JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake
In mid-April 2026, an exposed directory on an operator-owned Alibaba Cloud server gave us a complete view into an active China-nexus operation. The server with bash history, toolkits, webshell paths against victims, and staged phishing packages were all…
Phishing
ta458 roundpress exploits
By Greg Lesnewich, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly, and the Proofpoint Threat Research Team July 23, 2026 Greg Lesnewich, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly, and the Proofpoint Threat Research Team This…
Vulnerabilities
TA488 Targets Zimbra Mailservers with Half-Click Exploits
By Greg Lesnewich, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly, and the Proofpoint Threat Research Team July 23, 2026 Greg Lesnewich, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly, and the Proofpoint Threat Research Team…
State-sponsoredVulnerabilities
Added Thu 23 Jul
[QuickNote] Mustang Panda ToneShell (APT S1239) Beacon Shellcode – RE Analysis
Sample: 32-bit Windows shellcode, position-independent (decoded and loaded via SolidPDFCreator.dll – see Campaign 3 DLL report) Family: Mustang Panda ToneShell (APT tracking: S1239 / Hive0154 / Earth Preta) Note on the ToneShell similarity: It is a ToneShell…
State-sponsored
Fast16: Pre-Stuxnet Sabotage Tool Was Built to Subvert Nuclear Weapons Simulations
Fast16’s hook engine is selectively interested in high-explosive simulations inside LS-DYNA and AUTODYN. All evidence suggests that attackers were specifically targeting simulations of nuclear detonations. The malware checks for the density of the material…
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.