Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,259 reports391 publishers75 added in the past week

381–400 of 1,259 reports · page 20 of 63

Added Tue 28 Jul

Unit 42 · Web page · Published 10 Oct
The Golden Scale: Bling Libra and the Evolving Extortion Economy
Scattered Lapsus$ Hunters: What Retail and Hospitality Organizations Should Know In recent months, threat actors claiming to be part of a new conglomerate dubbed Scattered Lapsus$ Hunters (aka SP1D3R HUNTERS, SLSH) have asserted responsibility for laying…
Ransomware Original (new tab)
krypt3ia.wordpress.com · Web page · Published 13 Jul
Threat Intelligence Report: JADEPUFFER Agentic Ransomware and Automated Extortion
Threat type: Agentic ransomware, destructive extortion, cloud and application compromise Activity status: Emerging Attribution: Unattributed Confidence: Moderate Primary source: Sysdig Threat Research Team Intended audience: Security leadership, threat…
Ransomware Original (new tab)
Unit 42 · Web page · Published 25 Jun
CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure
Throughout 2025, we observed a cluster of activity targeting government entities and critical infrastructure in Southeast Asia. Specifically, the activity targeted state-owned enterprises in the energy and government sectors. The Chinese-speaking attackers…
Original (new tab)
Medium · Web page · Published 4 Jul
JADEPUFFER: The Dawn of Agentic Ransomware Operations
A landmark report from the Sysdig Threat Research Team has documented the first known case of a truly “agentic” ransomware campaign, orchestrated by a threat actor dubbed JADEPUFFER. Unlike traditional attacks where a human sits behind a terminal, JADEPUFFER…
Ransomware Original (new tab)
aws.amazon.com · Web page · Published 5 Dec
China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182)
December 29, 2025: The blog post was updated to add options for AWS Network Firewall. December 12, 2025: The blog post was updated to clarify when customers need to update their ReactJS version. Within hours of the public disclosure of CVE-2025-55182…
Vulnerabilities Original (new tab)
The Hacker News · Web page · Published 21 Jul
New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack
Researchers at Sysdig have linked a second attack on the same Langflow server to JADEPUFFER, the AI-agent-driven operator it first documented earlier this month. The same operator has now been spotted deploying ENCFORGE, a new compiled Go ransomware designed…
Ransomware Original (new tab)
sosransomware.com · Web page · Published 1 Dec
Scattered LAPSUS$ Hunters: the cybercrime alliance that will shake global businesses in 2025
Launched in August 2025, the Scattered LAPSUS$ Hunters (SLSH) collective has rapidly established itself as one of the most formidable threats on today’s cybercriminal landscape. This alliance brings together three of the most notorious English-speaking…
Original (new tab)
LevelBlue · Web page · Published 4 Nov
Scattered LAPSUS$ Hunters: Anatomy of a Federated Cybercriminal Brand
Trustwave SpiderLabs’ Cyber Threat Intelligence team is tracking the emergence and communication dynamics of the cybercriminal brand known as Scattered LAPSUS$ Hunters (SLH), consolidating observed activity across public platforms to provide updated insights…
Original (new tab)

Added Sat 25 Jul

NSA · Web page · Published 23 Jul
NSA and Partners Alert Zimbra Collaboration Suite Users of a Russian State-Supported Phish
NSA and Partners Alert Zimbra Collaboration Suite Users of a Russian State-Supported Phishing Campaign PHOTO INFORMATION FORT MEADE, Md. (July 23, 2026) — Today, the National Security Agency (NSA) in collaboration with partners, is releasing a Cybersecurity…
Phishing Original (new tab)
Huntress · Web page · Published 22 Jul
Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT
Update: We have updated the malware attribution for this blog to SectopRAT due to the presence of HVNC in the .NET payload after closer inspection of the related Command and Control services revealed in the Ethereum BSC transactions. Background Between July…
Original (new tab)
Group-IB · Web page · Published 23 Jul
JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake
In mid-April 2026, an exposed directory on an operator-owned Alibaba Cloud server gave us a complete view into an active China-nexus operation. The server with bash history, toolkits, webshell paths against victims, and staged phishing packages were all…
Phishing Original (new tab)
Proofpoint · Web page · Published 15 Jul
ta458 roundpress exploits
By Greg Lesnewich, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly, and the Proofpoint Threat Research Team July 23, 2026 Greg Lesnewich, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly, and the Proofpoint Threat Research Team This…
Vulnerabilities Original (new tab)
Proofpoint · Web page · Published 15 Jul
TA488 Targets Zimbra Mailservers with Half-Click Exploits
By Greg Lesnewich, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly, and the Proofpoint Threat Research Team July 23, 2026 Greg Lesnewich, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly, and the Proofpoint Threat Research Team…
State-sponsored Vulnerabilities Original (new tab)

Added Thu 23 Jul

kienmanowar.wordpress.com · Web page · Published 21 Jul
[QuickNote] Mustang Panda ToneShell (APT S1239) Beacon Shellcode – RE Analysis
Sample: 32-bit Windows shellcode, position-independent (decoded and loaded via SolidPDFCreator.dll – see Campaign 3 DLL report) Family: Mustang Panda ToneShell (APT tracking: S1239 / Hive0154 / Earth Preta) Note on the ToneShell similarity: It is a ToneShell…
State-sponsored Original (new tab)
Symantec · Web page · Added 23 Jul
Fast16: Pre-Stuxnet Sabotage Tool Was Built to Subvert Nuclear Weapons Simulations
Fast16’s hook engine is selectively interested in high-explosive simulations inside LS-DYNA and AUTODYN. All evidence suggests that attackers were specifically targeting simulations of nuclear detonations. The malware checks for the density of the material…
Original (new tab)
Medium · Web page · Published 20 Jul
INC Ransom: Infrastructure Analysis, Operational Tradecraft, and Detection Opportunities
The study was prepared in cooperation with Piotr Chęciński. Executive Summary INC Ransom is an active cybercriminal group operating under the Ransomware-as-a-Service (RaaS) model and has been observed since mid-2023. The group primarily conducts double…
Ransomware Original (new tab)
GitHub · Web page · Added 23 Jul
GitHub - muhammadzidane632/Hopeless: Ransomware Wiper Bootkit Hybrid (Real Author Only Zdn2Pwn) Look at Date the Initial Commit
A C-based malware research framework designed to demonstrate advanced multi-stage system compromise techniques on Windows. This project is intended solely for educational purposes, security research, and understanding offensive techniques in a controlled…
Ransomware Malware Original (new tab)
bluecyber.hashnode.dev · Web page · Published 22 Jul
Beyond the Archive: CVE-2025-8088 Stealer Targeting Ukraine
This report details a targeted cyber-espionage campaign conducted by the Russia-aligned threat actor group APT SHADOW-EARTH-066 (also tracked by CERT-UA as UAC-0226), delivering an updated variant of the GIFTEDCROOK information stealer against Ukrainian…
State-sponsored Infostealers Vulnerabilities Original (new tab)

Added Wed 22 Jul

Medium · Web page · Published 2 Jul
Operation Turb00 — Part 3: Unmasking the SnappyClient RAT
The orchestrator behind the first chain, WizardDa42.exe (the legitimate Radmin VPN process), also launches this second one. Beyond that shared parent process, the two have nothing in common, as
Malware Original (new tab)
Huntress · Web page · Published 16 Jan
Dissecting CrashFix: KongTuke's New Toy
In January 2026, Huntress Senior Security Operations Analyst Tanner Filip observed threat actors using a malicious browser extension to display a fake security warning, claiming the browser had "stopped abnormally" and prompting users to run a “scan” to…
Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.