Research reports

public-research/reports/2026-07-24-jackskid-residential-proxy-upnp.md at main · deepfield/public-research

Most residential-proxy malware works hard to stay invisible. The infected device dials out to a director, holds the connection open, and tunnels customer traffic back through it. Nothing listens; nothing is reachable from the internet; the only footprint is…

MalwareAnalysisReports/LockBit5.0/Lockbit 5.0 loader analysis.md at main · VenzoV/MalwareAnalysisReports

By VenzoV Sample Information SHA256 180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38 Summary of execution flow JMP address values iare obfuscated using opaque predicates and MBA. Antidebug checks( NtGlobalFlag,PEB-> BeingDebugged,…

RansomwareMalware

GitHub - muhammadzidane632/Hopeless: Ransomware Wiper Bootkit Hybrid (Real Author Only Zdn2Pwn) Look at Date the Initial Commit

A C-based malware research framework designed to demonstrate advanced multi-stage system compromise techniques on Windows. This project is intended solely for educational purposes, security research, and understanding offensive techniques in a controlled…

RansomwareMalware

public-research/jackskid/report.md at main · deepfield/public-research

Reverse-engineering Jackskid: from bare-bones Mirai fork to persistent TV box botnet Nokia Deepfield Emergency Response Team (ERT) and Comcast Threat Research Lab (CTRL) First published: 2026-03-24 Content warning: This report quotes malware artifacts…

Botnets and DDoS

GitHub - es3n1n/defendnot: An even funnier way to disable windows defender. (through WSC api)

Using this tool to facilitate malware distribution, cybercrime, unauthorized access, evading detection, or any illegal activity is strictly prohibited. Users assume all legal responsibility for how they use this tool and any consequences thereof. You must…

GitHub - vxaboveground/Overlord: Overlord

Hello, I made this project for fun. The server is TypeScript on Node/Bun. The client is Go. Operators talk to the server through a web panel or the Electron desktop app, and agents connect over encrypted WebSockets. Docker is the easiest way to run it. Quick…

MacProStorage02:_2018ROW:Bitdefender-Whitepaper-Inexsmar-crea1598-A4-en_EN:Bitdefender-Whitepaper-Inexsmar-crea1598-A4-en_EN.indd

FOR MORE INFORMATION VISIT: enterprise.bitdefender.com Bitdefender is a global security technology company that delivers solutions in more than 100 countries through a network of value-added alliances, distributors and reseller partners. Since 2001,…

IoCs/Broadbased/frat.md at master · jeFF0Falltrades/IoCs

Note: I have not seen much coverage of this malware family. The name 'FRat' was derived from research by @James_inthe_box, seen in the linked Tweet thread below. If you have more information on this threat, please contact me on Twitter A RAT employing…

Malware

GitHub - mauronz/binja-emotet

Deobufscate API calls and strings in unpacked Emotet samples. Description: Helper plugin for the analysis of unpacked Emotet samples. Locate dynamically imported API functions and add tags to make them easily searchable.

APT41 Has Arisen From the DUST

Written by: Mike Stokkel, Pierre Gerlings, Renato Fontana, Luis Rocha, Jared Wilson, Stephen Eckels, Jonathan Lepore Executive Summary In collaboration with Google’s Threat Analysis Group (TAG), Mandiant has observed a sustained campaign by the advanced…

State-sponsored

MoonWalk | ThreatLabz

No excerpt available.

DodgeBox | ThreatLabz

No excerpt available.

Arid Viper poisons Android apps with AridSpy

ESET researchers discovered Arid Viper espionage campaigns spreading trojanized apps to Android users in Egypt and Palestine Lukas Stefanko 13 Jun 2024 • 25 min. read ESET researchers have identified five campaigns targeting Android users with trojanized…

State-sponsoredMobile

New BugSleep Backdoor Deployed in Recent MuddyWater Campaigns - Check Point Research

MuddyWater, an Iranian threat group affiliated with the Ministry of Intelligence and Security (MOIS), has significantly increased its activities in Israel since the beginning of the Israel-Hamas war in October 2023. This parallels with activities against…

State-sponsoredMalwarePhishing

i-soon-data-leaks-en

On Feb. 16, 2024, someone uploaded data to GitHub that included possible internal company communications, sales-related materials and product manuals belonging to the Chinese IT security services company i-Soon, also known as Anxun Information Technology. The…

State-sponsored

Pawn Storm Uses Brute Force and Stealth Against High-Value Targets

Pawn Storm Uses Brute Force and Stealth Against High-Value Targets | Trend Micro (US) APT & Targeted Attacks Pawn Storm Uses Brute Force and Stealth Against High-Value Targets To help defenders learn more about Pawn Storm's activities and adjust their…

State-sponsored

Earth Lusca Uses Geopolitical Lure to Target Taiwan Before Elections

Earth Lusca Uses Geopolitical Lure to Target Taiwan Before Elections | Trend Micro (US) APT & Targeted Attacks Earth Lusca Uses Geopolitical Lure to Target Taiwan Before Elections During our monitoring of Earth Lusca, we noticed a new campaign that used…

i-soon-data-leaks-jp

2024 年 2 月 16 日、中国の IT セキュリティ サービス会社 i-Soon (別名 Anxun Information Technology) に属する可能性のある社内通信、セールス関連資料、製品マニュアルを含むデータが何者かによって GitHub にアップロードされました。漏えいした資料は、ある営利団体が、中国とつながりのある脅威アクターを支援するサイバー スパイ ツールをどのように開発・サポートしたかを示すもののようです。漏えいデータの初期調査の一環として、Unit 42…

State-sponsored

chinese-apts-target-asean-entities-en

The first APT group, Stately Taurus, created two malware packages we believe targeted entities in Myanmar, the Philippines, Japan and Singapore. The timing of these campaigns coincided with the ASEAN-Australia Special Summit, held March 4-6, 2024. The second…

State-sponsored

payloads-in-malicious-onenote-samples-jp

ファイルを悪用するさいに使う埋め込みペイロードの種類について取り上げます。私たちが WildFire から得た約 6,000 件の悪質な OneNote サンプルを分析したところ、これらのサンプルにはフィッシングに似たテーマが存在することが明らかになりました。これらのサ ンプルでは、攻撃者らが、1 つ以上の画像を使ってユーザーに OneNote ファイルをクリックまたは操作させようとします。その後、そうしたやり取りが埋め込まれた悪意のあるペイロードを実行します 。 Office…