Research reports
1,224 reports from 387 publishers45 added in the past week
166 reports, newest added first
Added Sat 19 Sep
Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection
Anthropic on Thursday revealed it disrupted a campaign mounted by a Russian state-sponsored threat actor that abused Claude for developing an AI-assisted workflow to get ahead of the detection curve. The operation has been attributed to a cyber espionage…
State-sponsoredMalware
Added Tue 8 Sep
Mirage Kitten targets Middle East and Africa region with new malware
Mirage Kitten – also known as UNC1549, Smoke Sandstorm, and Nimbus Manticore – is an advanced persistent threat (APT) group focused on cyber-espionage operations against aerospace, aviation, defense, and telecommunications sectors across the Middle East and…
State-sponsoredMalware
Added Thu 3 Sep
Trapping a Mustang Panda
As of mid-2026, IBM X-Force continues to monitor cyber campaigns conducted by ITG27, a China-aligned state-sponsored espionage group whose victims align with China’s regional strategic interests. In collaboration with Deception.Pro, X-Force captured live…
State-sponsored
Added Sat 22 Aug
SilkParasite: Tracking a China-Nexus APT Across Central Asia
TL;DR: SilkParasite is a cyberespionage operation, assessed at medium confidence as China-nexus, that targeted government bodies across Central Asia. Bitdefender Labs found seven remote access tool (RAT) families in use, five of which were previously…
State-sponsored
Added Tue 18 Aug
Jewelbug: APT Group Runs Espionage and Crypto Fraud Operations Side by Side
Jewelbug is a China-based hackers-for-hire group that runs parallel operations: espionage against governments and militaries across the Middle East, Southeast Asia and South Asia, and a for-profit cryptocurrency fraud business. Both missions are administered…
State-sponsored
Added Thu 6 Aug
The Eye of the Tiger
Cyber espionage has been a hot topic through the last years. Computer attacks known as “APT” (Advanced Persistent Threat) have become widely reported and emphasized by the media, damages are now considered as real and strategic trends are moving in cyber…
State-sponsored
Added Tue 4 Aug
CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft
Since early May 2026, Microsoft Threat Intelligence has observed Storm-2945, a sub-cluster of Midnight Blizzard, conducting widespread but targeted traffic manipulation attacks involving hospitality sector networks served by captive portals worldwide. Despite…
State-sponsoredMalware
Added Tue 28 Jul
Latest Cyber Threat Intelligence & Security Insights
The cyber threat landscape has witnessed the emergence of the Scattered LAPSUS$ Hunters (SLSH), a highly effective threat actor collective formalized in 2025. SLSH represents a dangerous fusion of methodologies and personnel from Scattered Spider…
State-sponsored
Armored Likho's new weapon: BusySnake Stealer
During our routine threat monitoring, we uncovered a new phishing campaign tied to a previously unknown APT group that we dubbed Armored Likho (also known as Eagle Werewolf based on circumstantial evidence). This targeted campaign focuses heavily on…
State-sponsoredInfostealers
Added Sat 25 Jul
TA488 Targets Zimbra Mailservers with Half-Click Exploits
By Greg Lesnewich, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly, and the Proofpoint Threat Research Team July 23, 2026 Greg Lesnewich, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly, and the Proofpoint Threat Research Team…
State-sponsoredVulnerabilities
Added Thu 23 Jul
[QuickNote] Mustang Panda ToneShell (APT S1239) Beacon Shellcode – RE Analysis
Sample: 32-bit Windows shellcode, position-independent (decoded and loaded via SolidPDFCreator.dll – see Campaign 3 DLL report) Family: Mustang Panda ToneShell (APT tracking: S1239 / Hive0154 / Earth Preta) Note on the ToneShell similarity: It is a ToneShell…
State-sponsored
Beyond the Archive: CVE-2025-8088 Stealer Targeting Ukraine
This report details a targeted cyber-espionage campaign conducted by the Russia-aligned threat actor group APT SHADOW-EARTH-066 (also tracked by CERT-UA as UAC-0226), delivering an updated variant of the GIFTEDCROOK information stealer against Ukrainian…
State-sponsoredInfostealersVulnerabilities
Added Wed 22 Jul
Anomali Cyber Watch: F5 Breach, Mysterious Elephant APT, Malicious MCP Servers, and More
Jewelbug APT Executes Five-Month Espionage Against Russian IT Provider When Trusted AI Connections Turn Hostile LinkPro Linux Rootkit Exposes Deep Stealth Threat to Cloud & Linux Environments Silver Fox Expands Winos 4.0 Attacks to Japan and Malaysia via…
State-sponsoredMalware
Added Wed 8 Jul
raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json
.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNamin "Threat actor name": "Amethyst Rain", "Origin/Threat": "Lebanon", "Other names": "VolcanicTimber, Volatile Cedar" "Threat actor name": "Antique Typhoon", "Origin/Threat": "China",…
State-sponsored
Added Sat 20 Jun
eset-apt-activity-report-q4-2025-q1-2026.pdf
MONITORING OIL SHIPMENTS, TARGETING DRONE MAKERS October 2025 – March 2026 Report ESET APT ACTIVITY REPORT OCTOBER 2025 - MARCH 2026 | 2 Contents Executive summary3 Attackers and targets5 China7 SteppeDriver: From Mongolia to Syria8 PhiliKit, a new implant in…
State-sponsored
eset-apt-activity-report-q2-2025-q3-2025.pdf
APT down – the North Korea files 17 Russia 18 RomCom uses WinRAR zero day 19 Gamaredon
State-sponsored
Added Wed 10 Jun
Tracking APT28 PixyNetLoader: Evolutions from 2024 to 2026
Analysis of ~90 PixyNetLoader samples and grouping them into 4 sub-families using code similarities sharing Enabling unified detection through a single YARA rule Exposing the latest steganography mechanisms used in the 2026 March-April versions Provinding PNG…
State-sponsored
RemotePE: The Lazarus RAT that lives in memory
Last year, we published research1 about a North Korean Lazarus subgroup targeting financial and cryptocurrency organizations, encountered during multiple incident response engagements. This Lazarus subgroup overlaps with activity linked to AppleJeus2, Citrine…
State-sponsoredMalware
GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations
GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations - WithSecure™ By Authors Executive Summary WithSecure identified an ongoing and persistent set of activity targeting Ukraine and Ukraine-related entities since at least August 2025.…
State-sponsored
Added Thu 4 Jun
GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations
GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations - WithSecure™ By Authors Executive Summary WithSecure identified an ongoing and persistent set of activity targeting Ukraine and Ukraine-related entities since at least August 2025.…
State-sponsored
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.