Research reports

INC Ransom: Infrastructure Analysis, Operational Tradecraft, and Detection Opportunities

The study was prepared in cooperation with Piotr Chęciński. Executive Summary INC Ransom is an active cybercriminal group operating under the Ransomware-as-a-Service (RaaS) model and has been observed since mid-2023. The group primarily conducts double…

Ransomware

GitHub - muhammadzidane632/Hopeless: Ransomware Wiper Bootkit Hybrid (Real Author Only Zdn2Pwn) Look at Date the Initial Commit

A C-based malware research framework designed to demonstrate advanced multi-stage system compromise techniques on Windows. This project is intended solely for educational purposes, security research, and understanding offensive techniques in a controlled…

RansomwareMalware

Beyond the Archive: CVE-2025-8088 Stealer Targeting Ukraine

This report details a targeted cyber-espionage campaign conducted by the Russia-aligned threat actor group APT SHADOW-EARTH-066 (also tracked by CERT-UA as UAC-0226), delivering an updated variant of the GIFTEDCROOK information stealer against Ukrainian…

State-sponsoredInfostealersVulnerabilities

Operation Turb00 — Part 3: Unmasking the SnappyClient RAT

The orchestrator behind the first chain, WizardDa42.exe (the legitimate Radmin VPN process), also launches this second one. Beyond that shared parent process, the two have nothing in common, as

Malware

Dissecting CrashFix: KongTuke's New Toy

In January 2026, Huntress Senior Security Operations Analyst Tanner Filip observed threat actors using a malicious browser extension to display a fake security warning, claiming the browser had "stopped abnormally" and prompting users to run a “scan” to…

public-research/jackskid/report.md at main · deepfield/public-research

Reverse-engineering Jackskid: from bare-bones Mirai fork to persistent TV box botnet Nokia Deepfield Emergency Response Team (ERT) and Comcast Threat Research Lab (CTRL) First published: 2026-03-24 Content warning: This report quotes malware artifacts…

Botnets and DDoS

ClaudeFix: Shared Claude Chats Meet ClickFix

Guarda Crypto Wallet bhhhlbepdkbapadjdnnojkbgioiodbic Solflare Wallet

When IT Support Calls: Dissecting a ModeloRAT Campaign from Teams to Domain Compromise

Attackers do not need to break into the front door when they can convince employees to open it for them through the tools they already trust. In April 2026, Rapid7 investigated an enterprise intrusion that began with a Microsoft Teams message from a fake “IT…

The Blueprint of a North Korean Attack on Open-Source

Just in the last 7 days, we've seen LiteLLM and axios impacted by supply chain attacks. Recently with Bereket Engida, the creator of the popular JS auth library: Better-Auth. He observed repeated attempts by a contributor to add malicious code directly via a…

SnappyClient

SnappyClient is a C++-based C2 implant first identified in December 2025, delivered through the HijackLoader malware loader. It combines remote access (terminal, process control, file management) with data theft (keylogging, screenshots, browser and crypto…

Malware

Anomali Cyber Watch: F5 Breach, Mysterious Elephant APT, Malicious MCP Servers, and More

Jewelbug APT Executes Five-Month Espionage Against Russian IT Provider When Trusted AI Connections Turn Hostile LinkPro Linux Rootkit Exposes Deep Stealth Threat to Cloud & Linux Environments Silver Fox Expands Winos 4.0 Attacks to Japan and Malaysia via…

State-sponsoredMalware

New North Korean campaign uses fake coding interviews to steal developer credentials

Elastic Security Labs found a new Contagious Interview campaign, tracked as REF9403, hiding malware inside SVG image files using steganography. To our knowledge, this specific infection chain has not been previously documented. We found it after the…

Infostealers

ChainVeil: A Malicious npm Supply Chain Attack by SuccessKey

Checkmarx Zero’s ongoing research into malicious open-source libraries has uncovered and reported a targeted supply chain campaign that bears strong indications of being operated by a threat actor known as “SuccessKey” (no apparent relationship to several…

Supply chain

Sequel to ChainVeil npm malware: ViteVenom

When we published our ChainVeil report in June 2026, we noted something that didn’t fit: the SuccessKey campaign’s Command and Control (Command and Control (C2)) infrastructure contained a secondary server at 198.105.127[.]210 and a tertiary server at…

MalwareSupply chain

ChainVeil and ViteVenom are DPRK’s PolinRider Campaign

On June 16, 2026, Checkmarx Zero published a detailed breakdown of an npm supply chain campaign they named "ChainVeil." It's careful work: they pulled together nine malicious packages, a 77KB remote access trojan (RAT), a four-tier blockchain command channel…

MalwareSupply chain

TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry

Attackers are targeting employees of Booking.com partner companies in Japan, using phishing emails that impersonate guest complaints and review requests to trick hotel staff into executing malicious files. Multiple email delivery methods were observed,…

MalwarePhishing

Malware-Slop: Crypto Stealer Impersonating Polymarket Exposes Its Own Credentials

Then Exposes Its Own GitLab Credentials Overview The OX Research team recently discovered a malicious npm package cryptocurrency theft and credential exfiltration campaign. The package specifically impersonates target high-value crypto users. In a new…

MalwareInfostealersSupply chain

ホテル業界を標的とした不審メールの分析（パート2: 技術詳細編）

ホテル業界を標的とした不審メールの分析 編） 攻撃の概要（全体像） 攻撃手法の詳細分析 多段スクリプト JavaScript ファイル（TonRAT） TonRAT の通信プロトコル 通信先の分析 まとめ Appendix IoC（ファイル） IoC（通信先） 本記事はパート1「キャンペーン概要編」の続編です。パート や攻撃キャンペーンの全体像を解説しました。パート 的な分析結果を解説します。 パート1の記事はこちらです。 攻撃の概要（全体像） パート1で解説した通り、今回確認された攻撃の流れは以下の通りです。…

PolinRider Confirmed Footprint Grows 6.5x Since March

In the three months since we discovered the PolinRider campaign, we've observed it growing to become a major source of malicious activity. We recently completed a fresh hunt that surfaced an entire new wave of victims: Our July hunt uncovered 2,417…

ホテル業界を標的とした不審メールの分析（パート1: キャンペーン概要編）

ホテル業界を標的とした不審メールの分析 ーン概要編 背景 Booking.com 攻撃の全体像 まとめ Appendix ） を詐称した不審メール メールヘッダーの分析 送信元インフラの一致 送信者名の偽装 Reply-To 添付ファイル（ メール本文のリンクの分析 ショートカットファイルの分析 IoC（ファイル） IoC（通信先） 本記事は2部構成です。パート 詳細分析を解説します。 パート2の記事はこちらです。 背景 宿泊施設のネット予約サービスを提供する す。このサイバー攻撃は、Booking.com…