Research reports

Netresec · Web page · Published 27 Jul

PureLogs, PureRAT and misleading zgRAT

Censys · Web page · Published 26 Jun

AsyncRAT Family Threat Overview

AsyncRAT is a family of open-source Windows remote access trojans (RATs): an original codebase that has been forked repeatedly into dozens of descendant malware families. Its most prolific descendant, DCRAT (also known as DarkCrystal RAT), spawned a second…

securereading.com · Web page · Added 28 Jul

JadePuffer Becomes the First Ransomware Campaign to Let an AI Agent Run the Entire Attack

neso.re · Web page · Added 28 Jul

ClickFix × HijackLoader: Dissecting a Live Stealer Campaign - Part 2

In Part 1, I walked through the full delivery chain, from the ClickFix lure through the MSI package, both loader stages, and into the ti64 orchestrator. By the end, the syscall table was built, ntdll was unhooked, and TinyCallProxy64 was loaded into the…

GitHub · Web page · Published 24 Jul

public-research/reports/2026-07-24-jackskid-residential-proxy-upnp.md at main · deepfield/public-research

Most residential-proxy malware works hard to stay invisible. The infected device dials out to a director, holds the connection open, and tunnels customer traffic back through it. Nothing listens; nothing is reachable from the internet; the only footprint is…

neso.re · Web page · Added 28 Jul

ClickFix × HijackLoader: Dissecting a Live Stealer Campaign - Part 1

While browsing, I randomly came across an ad telling me that human verification was required. Curious, I followed it. The site it led to was simple. Just a lonely button, asking me to click it to prove I was human. Once I did, I was given instructions: press…

GitHub · Web page · Added 28 Jul

MalwareAnalysisReports/LockBit5.0/Lockbit 5.0 loader analysis.md at main · VenzoV/MalwareAnalysisReports

By VenzoV Sample Information SHA256 180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38 Summary of execution flow JMP address values iare obfuscated using opaque predicates and MBA. Antidebug checks( NtGlobalFlag,PEB-> BeingDebugged,…

Gen Digital · Web page · Published 19 Mar

VoidStealer: Debugging Chrome to Steal Its Secrets

VoidStealer is the first infostealer observed in the wild adopting a novel debugger-based Application-Bound Encryption (ABE) bypass technique that leverages hardware breakpoints to extract the v20_master_key directly from browser memory. The bypass requires…

Check Point · Web page · Published 6 Jul

Cavern Manticore: Exposing Iran-Linked Modular C2 Framework

Note: SysAid was not compromised, and no SysAid vulnerability was involved. The attacker had already gained access to the victim environment and abused a legitimate software-deployment feature to deploy malware onto another machine within it. Key Points Check…

falconfeeds.io · Web page · Added 28 Jul

Latest Cyber Threat Intelligence & Security Insights

The cyber threat landscape has witnessed the emergence of the Scattered LAPSUS$ Hunters (SLSH), a highly effective threat actor collective formalized in 2025. SLSH represents a dangerous fusion of methodologies and personnel from Scattered Spider…

Volexity · Web page · Published 17 Jul

Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation

In early July 2026, Volexity was engaged to perform an incident response investigation where it discovered a threat actor had successfully compromised SonicWall Secure Mobile Access (SMA) VPN appliances through a chain of multiple zero-day exploits in the…

polyswarm.io · Web page · Added 28 Jul

Multiple Threat Actors Leveraging CVE-2025-55182 (React2Shell)

Executive Summary Multiple vendors have observed active exploitation of CVE-2025-55182, a critical remote code execution vulnerability in React Server Components and frameworks like Next.js. Multiple threat actors, including China-nexus and North Korea-nexus…

nsfocusglobal.com · Web page · Published 7 Jul

AI Security Incident Case: JadePuffer Ransomware Leverages AI Agent to Automate Attacks

In early July 2026, security firm Sysdig publicly disclosed a new type of ransomware attack. After gaining initial access by exploiting a Langflow vulnerability (CVE-2025-3248), the JadePuffer ransomware leveraged a Large Language Model (LLM) agent to…

Cisco Talos · Web page · Published 16 Jul

UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign

Cisco Talos is disclosing UAT-11795, a sophisticated, Russian-speaking, financially motivated adversary that has been conducting a malicious campaign targeting users in the U.S. and Europe since at least June 2025. Talos has discovered that the actor in this…

Symantec · Web page · Added 28 Jul

GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses

Analysis of a recent GodDamn ransomware attack indicates that this seemingly new ransomware is in fact the latest rebrand of the Beast ransomware, which in itself was a rebrand of the Monster ransomware, which was first seen in 2022. The Symantec Threat…

Resecurity · Web page · Published 25 Sep

Resecurity | Trinity of Chaos: The LAPSUS$, ShinyHunters, and Scattered Spider Alliance Embarks on Global Cybercrime Spree

LAPSUS$, Scattered Spider, and ShinyHunters are three of the most notorious English-speaking cybercrime groups operating today. While each group has its own distinct origins and operational history, recent developments (especially since 2023 to 2025) reveal…

Kaspersky · Web page · Published 3 Jul

Armored Likho's new weapon: BusySnake Stealer

During our routine threat monitoring, we uncovered a new phishing campaign tied to a previously unknown APT group that we dubbed Armored Likho (also known as Eagle Werewolf based on circumstantial evidence). This targeted campaign focuses heavily on…

Krebs on Security · Web page · Published 26 Nov

Meet Rey, the Admin of ‘Scattered Lapsus$ Hunters’

A prolific cybercriminal group that calls itself “Scattered LAPSUS$ Hunters” has dominated headlines this year by regularly stealing data from and publicly mass extorting dozens of major corporations. But the tables seem to have turned somewhat for “Rey,” the…

pushsecurity.com · Web page · Published 13 Nov

Analyzing "Scattered Lapsus$ Hunters" breaches since 2021

The biggest cybersecurity story this year (so far) has been the emergence of “Scattered Lapsus$ Hunters” and their record-breaking worldwide hacking spree. Scattered Lapsus$ Hunters is part of “The Com”, the name for the broad community of English-speaking…

picussecurity.com · Web page · Published 17 Oct

Scattered LAPSUS$ Hunters: 2025's Most Dangerous Cybercrime Supergroup

In 2025, the cybersecurity world witnessed the sudden emergence of a new threat actor alliance dubbed Scattered Lapsus$ Hunters—a group that unites elements of three well-known cybercrime entities: Scattered Spider, LAPSUS$, and ShinyHunters. This convergence…