Research reports
1,224 reports from 387 publishers45 added in the past week
294 reports, newest added first
Added Sun 18 Oct
Ragnar Loader
(a.k.a. Ragnar Locker) ransomware group, which has been inflicting targeted cyberattacks on organizations since its emergence in 2020. The Ragnar Loader, frequently identified within the threat landscape as the Ragnar Framework by its associated actors,…
RansomwareMalware
Andromeda Bot Analysis part 2
Now, you get the original Andromeda build file. Load the unpacked sample at OllyDBG. As before, after the stack frame at the EP, you see that the malware is looking to load API's address using the PEB_LDR_DATA structure, but this time instead of kernel32.dll;…
Malware
Netwalker malware: What it is, how it works and how to prevent it
Netwalker is a data encryption malware that represents an evolution of the well-known Kokoklock ransomware and has been active since September 2019. This article will detail the specific technical features of the Netwalker ransomware. We will analyze what…
RansomwareMalware
New ATM Malware Captures PINs and Cash -- Updated
Security researchers have found malware planted on ATMs in Eastern Europe that captures PINs and magnetic stripe data from the machine's memory and instructs the machines to spit out cash, eliminating the need for primitive skimming devices and advancing the…
Malware
GitHub - GhostPack/SafetyKatz: SafetyKatz is a combination of slightly modified version of @gentilkiwi's Mimikatz project and @subtee's .NET PE Loader
First, the MiniDumpWriteDump Win32 API call is used to create a minidump of LSASS to C:\Windows\Temp\debug.bin. Then @subtee's PELoader is used to load a customized version of Mimikatz that runs sekurlsa::logonpasswords and sekurlsa::ekeys on the minidump…
Malware
Kazuar (Malware Family)
There is no description at this point. References 2026-06-25 ⋅ Google ⋅ Google Threat Intelligence Group The Latest Addition to Turla’s Intelligence Gathering Apparatus Kazuar 2026-05-14 ⋅ Microsoft ⋅ Microsoft Threat Intelligence Kazuar: Anatomy of a…
State-sponsoredMalware
Jackpotting malware
Jackpotting malware is not well known because it exclusively targets automated teller machines (ATMs). This means it usually doesn’t directly affect a large number of people. However, this type of malware may seriously harm the reputation and the financial…
Malware
Animal Farm APT and the Shadow of French Intelligence
Almost every government is working to improve its cyber-capabilities. The majority of them already have in their arsenal powerful espionage malware and hacking platforms. We read about the techniques and tactics implemented by a number of APT groups from…
State-sponsoredMalware
Added Fri 16 Oct
cti/runster/readme.md at main · cert-orangecyberdefense/cti
Update (2026-06-17): our related "Payload C" is likely tied to MetaStealer and was recently detailed by Huntress, which named it Potemkin loader. Another blog by Walmart on this new DGA is available here. Orange Cyberdefense CERT has been tracking a…
Malware
A signed PDF viewer that quietly takes orders: the QuartzLine “zenith” backdoor
About this post: This analysis and write-up were produced by Claude (Opus 5.5), an AI model by Anthropic, working as an agent in Claude Code on a REMnux analysis VM. Tools used: Malcat (including KesaKode), capstone, Python, capa, FLOSS, StringSifter,…
Malware
Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent Data
Gen Threat Labs has been tracking Warden Stealer, an emerging and actively developed malware-as-a-service (MaaS) infostealer written in the Rust programming language that has, within just a few months, already become one of the most prevalent infostealers in…
MalwareInfostealers
Added Wed 14 Oct
Shai-Hulud Goes Open Source: Malware Creators Leak Their Own Code to GitHub
Breaking News: TeamPCP has gone open source — and the copycats are already here. The group behind Shai-Hulud has leaked their own malware code to GitHub, and independent threat actors have already begun modifying it and expanding its reach. OX Security is…
Malware
ClickFix Style Attack Uses Grok, ChatGPT for Malware Delivery
A new attack uses SEO poisoning and popular AI models to deliver infostealer malware, all while leveraging legitimate domains. ClickFix attacks have gained significant popularity over the past year, using otherwise benign CAPTCHA-style prompts to lure users…
MalwareAI
Attackers Target Agents via The Skill Supply Chain
An active malware campaign used typosquatted skills, trojanized packages, and remote loaders to target users of popular AI tools. TL;DR We disrupted an active malware campaign targeting agents through typosquatted skills. It targets users of popular AI tools…
MalwareSupply chainAI
Unmasking a Multi-Stage Loader: AutoIt Abuse Leading to Vidar Stealer Command-and-Control Communication
LevelBlue’s Security Services issues Threat Analysis reports to inform on impacting threats. The Threat Analysis reports investigate these threats and provide practical recommendations for protecting against them. In this Threat Analysis report, we…
MalwareInfostealers
Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation
In April 2026, Unit 42 researchers identified a financially motivated campaign delivering Vidar stealer and the XMRig cryptocurrency miner to consumer and small- and medium-sized business victims worldwide. Attackers lure victims via malvertising to pages for…
MalwareInfostealers
When 30 Water Utilities Get Hit in 48 Hours, the Lesson Isn’t “Better Malware” — It’s “No Front Door”
Originally published July 31, 2026. Last updated August 10, 2026 as reporting expanded beyond Minnesota and identified the controller families and configuration changes involved. Key Takeaway: In July 2026, a coordinated attack disrupted more than 30…
Malware
Added Tue 13 Oct
Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT
If you're interested in a deeper technical analysis of PHANTOMPULSE itself, covering its injection engines, persistence internals, and C2 protocol in greater detail, check out this follow-on analysis of the PHANTOMPULSE malware. Preamble Elastic Security Labs…
Malware
NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
Microsoft Threat Intelligence has identified NeedyMantis, a modular post-compromise malware family observed in a limited number of targeted operations affecting telecommunications organizations, universities, medical nonprofits, intergovernmental…
Malware
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.