Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,224 reports387 publishers45 added in the past week

401–420 of 1,015 reports · page 21 of 51 · Clear filters

Added Tue 16 Jun

5943619.hs-sites.com · PDF · Added 16 Jun
Dragos-2026-OT-Cybersecurity-Report-A-Year-in-Review.pdf?hsCtaAttrib=205683189348
Hafia Bay Port Water-Hole Attacks 21 Tips for Hunting 23 Tips for Hunting 31 Ivanti Endpoin
Original (new tab)
5943619.hs-sites.com · PDF · Added 16 Jun
dragos-2025-poland-attack-report.pdf
ELECTRUM: CYBER ATTACK ON POLAND’S ELECTRIC SYSTEM 2025 UPDATED JANUARY 2026 Executive Summary Why We’re Publishing This Report On December 29, 2025, a coordinated cyberattack targeted multiple sites across the Polish power grid, specifically those connected…
Original (new tab)
NIST · PDF · Added 16 Jun
Guide to general server security
Special Publication 800-123 Guide to General Server Security Recommendations of the National Institute of Standards and Technology Karen Scarfone Wayne Jansen Miles Tracy Guide to General Server Security Recommendations of the National Institute of Standards…
Original (new tab)

Added Fri 12 Jun

teamt5.org · Web page · Published 10 Jun
Alert: Exploitation of CVE-2026-34197 in Apache ActiveMQ
SLIME88 積極利用。我們的調查顯示，SLIME88 在利用該漏洞後部署了 SoxAgent RAT ，以入侵 Linux 設備並建置 ORB 網路。我們目前以臨時名稱 GOBLIN14 追蹤該 ORB 網路。 SLIME88 最早的攻擊可以追溯到 4 月 7 日。 SLIME88 攻擊活動的受害者包括美國以及韓國、印度、法國和美國的 IT 與製造業。本文詳細說明攻擊手法與情況。 The following blog post is based on our 2026 April H2…
Vulnerabilities Original (new tab)
thecyberexpress.com · Web page · Published 18 Apr
Cyberattacks on Jordan: BlackMaskers Target Crucial Entities
Amidst the complexities of the Israel-Iran conflict, the Middle East is witnessing another form of strife: cyber warfare. Jordan finds itself at the forefront of this battle, facing a barrage of alleged cyberattacks orchestrated by various hacktivist groups.…
Original (new tab)
Proofpoint · Web page · Published 1 Jun
TA4922: The Suspected Chinese Crime Group is Going Global
TA4922 is a highly sophisticated threat actor demonstrating a rapid operational tempo and continually evolving malware arsenal. The group has been observed using multiple malware families including Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT…
Malware Original (new tab)

Added Thu 11 Jun

Microsoft · Web page · Published 17 Mar
StilachiRAT analysis: From system reconnaissance to cryptocurrency theft
In November 2024, Microsoft Incident Response researchers uncovered a novel remote access trojan (RAT) we named StilachiRAT that demonstrates sophisticated techniques to evade detection, persist in the target environment, and exfiltrate sensitive data.…
Malware Original (new tab)
GitHub · Web page · Added 11 Jun
GitHub - es3n1n/defendnot: An even funnier way to disable windows defender. (through WSC api)
Using this tool to facilitate malware distribution, cybercrime, unauthorized access, evading detection, or any illegal activity is strictly prohibited. Users assume all legal responsibility for how they use this tool and any consequences thereof. You must…
Original (new tab)

Added Wed 10 Jun

CrowdStrike · Web page · Added 10 Jun
Blurring of Commodity and Targeted Attack Malware
As malware and its authors continue to evolve, deciphering the purpose of specific malware-driven attacks has become more challenging. While some malware still has a feature-specific design such as DDoS tools or spam bots, it is becoming increasingly common…
Malware Original (new tab)
GitHub · Web page · Added 10 Jun
GitHub - vxaboveground/Overlord: Overlord
Hello, I made this project for fun. The server is TypeScript on Node/Bun. The client is Go. Operators talk to the server through a web panel or the Electron desktop app, and agents connect over encrypted WebSockets. Docker is the easiest way to run it. Quick…
Original (new tab)
exatrack.com · Web page · Published 1 Jun
Tracking APT28 PixyNetLoader: Evolutions from 2024 to 2026
Analysis of ~90 PixyNetLoader samples and grouping them into 4 sub-families using code similarities sharing Enabling unified detection through a single YARA rule Exposing the latest steganography mechanisms used in the 2026 March-April versions Provinding PNG…
State-sponsored Original (new tab)
fox-it.com · Web page · Published 22 May
RemotePE: The Lazarus RAT that lives in memory
Last year, we published research1 about a North Korean Lazarus subgroup targeting financial and cryptocurrency organizations, encountered during multiple incident response engagements. This Lazarus subgroup overlaps with activity linked to AppleJeus2, Citrine…
State-sponsored Malware Original (new tab)
WithSecure · Web page · Added 10 Jun
GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations
GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations - WithSecure™ By Authors Executive Summary WithSecure identified an ongoing and persistent set of activity targeting Ukraine and Ukraine-related entities since at least August 2025.…
State-sponsored Original (new tab)
exatrack.com · Web page · Published 9 Jun
Under the Hood - LotusLite: Believe me I am MustangPanda
Under the Hood - The new series where We share stories from our daily life as a malware hunter 🔎 We’re kicking things off with a recent implant featuring “BelievemeIamMustang-Panda” and “Hi,Mustang_Panda” hardcoded in its .data section! A C2 over…
Malware Original (new tab)
Proofpoint · Web page · Published 5 Jun
Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency
By Saher Naumaan, Carlos Rubio, and the Proofpoint Threat Research Team By Saher Naumaan, Carlos Rubio, and the Proofpoint Threat Research Team Key Findings Between April and May 2026, Proofpoint Threat Research observed a likely North Korean threat actor…
Phishing Original (new tab)
StepSecurity · Web page · Added 10 Jun
The Hades Campaign: Graph ML PyPI Packages Deploy Cross-Platform Memory Scrapers, AI Analyst Misdirection, and a Wiper Deterrent
On June 8, 2026, version 0.8.101 of the popular graph machine learning package ensmallen on PyPI was identified as containing a highly sophisticated supply chain compromise. Concurrently, a series of related packages in the computational biology,…
Malware Supply chain Original (new tab)
ESET · Web page · Added 10 Jun
A rigged game: ScarCruft compromises gaming platform in a supply-chain attack
ESET researchers uncovered a multiplatform supply-chain attack by North Korea-aligned APT group ScarCruft, targeting the Yanbian region in China – home to ethnic Koreans and a crossing point for North Korean refugees and defectors. In the attack, probably…
Malware Supply chain Mobile Original (new tab)
CERT-UA · Web page · Added 10 Jun
CERT-UA
CERT-UA звертає увагу спільноти на те, що активність, описана в цій статті як окремий кластер кіберзагроз UAC-0247, фактично здійснюється особами, діяльність яких раніше відстежувалася за ідентифікатором UAC-0244. Відтак подальше відстеження пов’язаних…
Original (new tab)

Added Tue 9 Jun

Fortinet · Web page · Published 3 Jun
Inside the Cross-Platform Propagation of a New Gafgyt Variant C0XMO
This past March, FortiGuard Labs discovered a new Gafgyt botnet variant, C0XMO, that spreads by exploiting CVE-2021-27137. Our analysis revealed that, unlike earlier versions, this malware separates its lateral movement into a standalone Python script. This…
Vulnerabilities Original (new tab)

Added Thu 4 Jun

bin.re · Web page · Added 4 Jun
A JavaScript-based DGA - Analysis of a defunct Proslikefan Sample
Note 2016-06-17: I later found a fully functional sample of Proslikefan and wrote about it here. Please check out the newer blog post in favor of this post. I leave this write-up of Proslikefan up, with some minor edits to reflect findings I obtained by…
Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.