Research reports
1,224 reports from 387 publishers45 added in the past week
143 reports, newest added first
Added Fri 25 Sep
[Joint Cybersecurity Advisory] Operation Double Barrel (The Relationship Between a State-Sponsored Threat Actor and the Gunra Ransomware Group)
This technical analysis report was prepared as part of the joint cybersecurity advisory titled “Advisory on Cyberattacks Targeting Korean Citizens and Businesses by State-Sponsored Hacking Groups” issued by the Republic of Korea’s National Intelligence…
RansomwareState-sponsored
Added Wed 23 Sep
Killing me gently: Inside Gentlemen’s EDR killer framework
ESET researchers analyzed the robust EDR-killing toolset of the ransomware-as-a-service gang Gentlemen. Since the beginning of 2026, Gentlemen has emerged as one of the most active gangs in the ransomware ecosystem. The group distinguishes itself through a…
Ransomware
Added Sun 13 Sep
Bitdefender Threat Debrief
This edition of the Bitdefender Threat Debrief covers several developments in the threat landscape, including the reemergence of AtomSIlo, a surge in 0APT’s claimed attacks, a threat emerging as tensions in the Iran war escalate, and more. As ransomware…
Ransomware
[SHADOWBYT3$] - Ransomware Victim: UMSA
NOTE: No files or stolen information are exfiltrated, downloaded, taken, hosted, seen, reposted, or disclosed by RedPacket Security. Any legal issues relating to the content should be directed at the attackers, not RedPacket Security. This blog is an…
Ransomware
Added Tue 8 Sep
How CrowdStrike Analyzes macOS Malware to Optimize Automated Detection
Ransomware (43% of analyzed threat data), backdoors (35%) and trojans (17%) were the most popular macOS malware categories spotted by CrowdStrike researchers in 2021 OSX.EvilQuest (ransomware), OSX.FlashBack (backdoor) and OSX.Lador (trojan) were the most…
RansomwareMalware
Added Fri 4 Sep
NCC Group Monthly Threat Pulse – Review of July 2026
Ransomware volume rose 22% month-on-month, with 894 cases recorded in July Industrials remain top target as sector takes over a quarter (28%) of attacks Western regions are still most targeted with North America experiencing 41%, and Europe 29%, of all…
Ransomware
Added Fri 14 Aug
Gunra Ransomware
Another ransomware actor operating under the name Gunra has recently surfaced, allegedly claiming several victims in the healthcare, electronics, and beverage manufacturing sectors, as listed on their onion website. In recent activity, the ransomware they…
Ransomware
Added Mon 10 Aug
orova Ransomware Group Profile
Orova is a newly emerged ransomware extortion group that has been active since mid-2026. They focus on compromising corporate networks and leveraging data exfiltration to enforce ransom payments, utilizing a dedicated data leak site on the dark web to publish…
Ransomware
Added Sun 9 Aug
gammax Ransomware Group Profile
Gammax is a newly emerged extortion and crypto-ransomware operation that began in July 2026, focusing on commercial enterprises and utilities. The group employs a double-extortion model by exfiltrating sensitive data before encrypting files, using a dedicated…
Ransomware
Added Thu 6 Aug
ShinyHunters Calling: Financially Motivated Data Extortion Group Targeting Enterprise Cloud Applications
EclecticIQ analysts assess with high confidence that ShinyHunters is expanding its operations by combining AI-enabled voice phishing, supply chain compromises, and leveraging malicious insiders, such as employees or contractors, who can provide direct access…
RansomwarePhishing
Added Wed 5 Aug
Disrupting Fox Tempest: A cybercrime service that turned “verified” software into a pathway for ransomware
Every day, we decide what software to trust in seconds guided by simple labels such as “verified,” “secure,” and “safe to install.” The problem is that those signs can be manipulated. Today, Microsoft unsealed a legal case in the US District Court for the…
RansomwareMalware
Microsoft disrupts Fox Tempest malware-signing-as-a-service platform tied to ransomware gangs
Microsoft said it took down a critical service that helped cybercriminals slip through defenses by making malware look like legitimate software. The company unsealed a legal case in U.S. District Court on Tuesday detailing the disruption of Fox Tempest — a…
RansomwareMalware
Added Tue 28 Jul
JadePuffer Becomes the First Ransomware Campaign to Let an AI Agent Run the Entire Attack
No excerpt available.
RansomwareVulnerabilities
MalwareAnalysisReports/LockBit5.0/Lockbit 5.0 loader analysis.md at main · VenzoV/MalwareAnalysisReports
By VenzoV Sample Information SHA256 180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38 Summary of execution flow JMP address values iare obfuscated using opaque predicates and MBA. Antidebug checks( NtGlobalFlag,PEB-> BeingDebugged,…
RansomwareMalware
AI Security Incident Case: JadePuffer Ransomware Leverages AI Agent to Automate Attacks
In early July 2026, security firm Sysdig publicly disclosed a new type of ransomware attack. After gaining initial access by exploiting a Langflow vulnerability (CVE-2025-3248), the JadePuffer ransomware leveraged a Large Language Model (LLM) agent to…
RansomwareVulnerabilitiesAI
GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses
Analysis of a recent GodDamn ransomware attack indicates that this seemingly new ransomware is in fact the latest rebrand of the Beast ransomware, which in itself was a rebrand of the Monster ransomware, which was first seen in 2022. The Symantec Threat…
Ransomware
The Golden Scale: Bling Libra and the Evolving Extortion Economy
Scattered Lapsus$ Hunters: What Retail and Hospitality Organizations Should Know In recent months, threat actors claiming to be part of a new conglomerate dubbed Scattered Lapsus$ Hunters (aka SP1D3R HUNTERS, SLSH) have asserted responsibility for laying…
Ransomware
Threat Intelligence Report: JADEPUFFER Agentic Ransomware and Automated Extortion
Threat type: Agentic ransomware, destructive extortion, cloud and application compromise Activity status: Emerging Attribution: Unattributed Confidence: Moderate Primary source: Sysdig Threat Research Team Intended audience: Security leadership, threat…
Ransomware
JADEPUFFER: The Dawn of Agentic Ransomware Operations
A landmark report from the Sysdig Threat Research Team has documented the first known case of a truly “agentic” ransomware campaign, orchestrated by a threat actor dubbed JADEPUFFER. Unlike traditional attacks where a human sits behind a terminal, JADEPUFFER…
Ransomware
New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack
Researchers at Sysdig have linked a second attack on the same Langflow server to JADEPUFFER, the AI-agent-driven operator it first documented earlier this month. The same operator has now been spotted deploying ENCFORGE, a new compiled Go ransomware designed…
Ransomware
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.