Research reports

Microsoft · Web page · Published 25 Jun

Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access

By Microsoft Defender Security Research Team, Microsoft Defender Experts, Parth Jomadkar Microsoft Threat Intelligence has identified an active multi-stage intrusion campaign targeting organizations in the hospitality and hotel industry since April 2026.…

Symantec · Web page · Added 17 Jul

Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor

Backdoor.Daxin, the China-linked kernel-mode rootkit that Symantec first uncovered and exposed in 2022, is still operational. It was found running on a compromised host in Taiwan in 2026, more than four years after it was first uncovered. On the same machine,…

Expel · Web page · Published 15 Jul

Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident

Chinese cybercrime group, GoldenEyeDog, has been regularly updating their malware and tactics since 2015. We’ve observed them regularly leveraging code-signing certificates to bypass Windows’s SmartScreen since 2024. They leverage several malware, including…

Proofpoint · Web page · Published 6 Jul

One Email Closer to the Edge: UNK_MassTraction & the Physics of Exploitation

July 07, 2026 Greg Lesnewich, Mark Kelly, and the Proofpoint Threat Research Team Analyst note: Proofpoint uses the UNK_ designator to define clusters of activity that are still developing and have not been observed for long enough to receive a numerical TA…

Cisco Talos · Web page · Published 7 Jul

UAT-7810 continues building ORB networks using new malware

Cisco Talos is actively tracking infrastructure and malware associated with UAT-7810, an advanced persistent threat (APT) actor responsible for maintaining and proliferating the LapDogs Operational Relay Box (ORB) network, first disclosed by SecurityScorecard…

Fortinet · Web page · Published 1 Jul

Analysis of Ongoing Ousaban Attacks Targeting the Iberian Peninsula

In May 2026, FortiGuard Labs identified an attack targeting users in Spain and Portugal involving the banking Trojan Ousaban. This malware has been active in Brazil and is spread through an MSI downloader. The malicious payload involves a DLL file that is run…

Bitsight · Web page · Published 24 Jun

Amadey and StealC: Malware-as-a-Service Unavailable

On June 24, 2026, demonstrating the power of public-private collaboration, Europol and the Microsoft Digital Crimes Unit, alongside our team and other global partners, executed a coordinated disruption as part of Operation Endgame, impacting two of the most…

flare.io · Web page · Published 5 Feb

Threat Alert: TeamPCP, An Emerging Force in the Cloud Native and Ransomware Landscape

cstromblad.com · Web page · Published 22 Mar

Threat Assessment: TeamPCP - CanisterWorm & Kubernetes Wiper Campaign

raw.githubusercontent.com · Web page · Added 8 Jul

raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json

.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNamin "Threat actor name": "Amethyst Rain", "Origin/Threat": "Lebanon", "Other names": "VolcanicTimber, Volatile Cedar" "Threat actor name": "Antique Typhoon", "Origin/Threat": "China",…

FBI IC3 · PDF · Added 7 Jul

260702.pdf

ESET · PDF · Added 20 Jun

eset-apt-activity-report-q4-2025-q1-2026.pdf

MONITORING OIL SHIPMENTS, TARGETING DRONE MAKERS October 2025 – March 2026 Report ESET APT ACTIVITY REPORT OCTOBER 2025 - MARCH 2026 | 2 Contents Executive summary3 Attackers and targets5 China7 SteppeDriver: From Mongolia to Syria8 PhiliKit, a new implant in…

ESET · PDF · Added 20 Jun

eset-apt-activity-report-q2-2025-q3-2025.pdf

APT down – the North Korea files 17 Russia 18 RomCom uses WinRAR zero day 19 Gamaredon

MITRE ATT&CK · PDF · Added 16 Jun

techdoc_lite-deliverables-numbered option.dotx

Authors: Christopher A. Korban Douglas P. Miller Adam Pennington Cody B. Thomas September 2017 MT R 1 7 04 4 6 MIT R E T E C H N IC A L R E P OR T Dept. No.: J83L Project No.: 0717MM09-AA The views, opinions and/or findings contained in this report are those…

NIST · PDF · Added 16 Jun

Guide to Industrial Wireless Systems Deployments

Walter Copan, NIST Director and Undersecretary of Commerce for Standards and Technology Gu

bacnet.org · PDF · Added 16 Jun

Newman_2010.pdf

B 8 B A C n et ® To d a y | A Su p p l em e nt to AS H R A E Jo u r n a l N o v em b e r 20 1 0 About the Author H. Michael Newman is manager of the Building Automation and Control Systems Integration group in the Facilities Operations department at Cornell…

NIST · PDF · Added 16 Jun

Guidelines for securing Wireless Local Area Networks (WLANs)

Recommendations of the National Institute of Standards and Technology Murugiah Souppaya Karen Scarfone Special Publication 800-153 NIST Special Publication 800-153 Guidelines for Securing Wireless Local Area Networks (WLANs) Recommendations of the National…

NIST · PDF · Added 16 Jun

Guide to Operational Technology (OT) Security

NIST Special Publication NIST SP 800-82r3 Guide to Operational Technology (OT) Security Keith Stouffer Michael Pease CheeYee Tang Timothy Zimmerman Victoria Pillitteri Suzanne Lightman Adam Hahn Stephanie Saravia Aslam Sherule Michael Thompson This…

NIST · PDF · Added 16 Jun

Guidelines on firewalls and firewall policy

Special Publication 800-41 Revision 1 Guidelines on Firewalls and Firewall Policy Recommendations of the National Institute of Standards and Technology Karen Scarfone Paul Hoffman Guidelines on Firewalls and Firewall Policy Recommendations of the National…

NIST · PDF · Added 16 Jun

Security and Privacy Controls for Federal Information Systems and Organizations

The attached publication has been withdrawn (archived) and is provided solely for historical purposes. It may have been superseded by another publication (indicated below). Withdrawn Publication Series/Number NIST Special Publication 800-53 Rev. 4 Title…