Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,281 reports398 publishers97 added in the past week

421–440 of 1,281 reports · page 22 of 65

Added Wed 22 Jul

Medium · Web page · Published 2 Jul
Operation Turb00 — Part 3: Unmasking the SnappyClient RAT
The orchestrator behind the first chain, WizardDa42.exe (the legitimate Radmin VPN process), also launches this second one. Beyond that shared parent process, the two have nothing in common, as
Malware Original (new tab)
Huntress · Web page · Published 16 Jan
Dissecting CrashFix: KongTuke's New Toy
In January 2026, Huntress Senior Security Operations Analyst Tanner Filip observed threat actors using a malicious browser extension to display a fake security warning, claiming the browser had "stopped abnormally" and prompting users to run a “scan” to…
Original (new tab)
GitHub · Web page · Published 24 Mar
public-research/jackskid/report.md at main · deepfield/public-research
Reverse-engineering Jackskid: from bare-bones Mirai fork to persistent TV box botnet Nokia Deepfield Emergency Response Team (ERT) and Comcast Threat Research Lab (CTRL) First published: 2026-03-24 Content warning: This report quotes malware artifacts…
Botnets and DDoS Original (new tab)
Zscaler · Web page · Published 15 Jul
ClaudeFix: Shared Claude Chats Meet ClickFix
Guarda Crypto Wallet bhhhlbepdkbapadjdnnojkbgioiodbic Solflare Wallet
Original (new tab)
Rapid7 · Web page · Published 13 May
When IT Support Calls: Dissecting a ModeloRAT Campaign from Teams to Domain Compromise
Attackers do not need to break into the front door when they can convince employees to open it for them through the tools they already trust. In April 2026, Rapid7 investigated an enterprise intrusion that began with a Microsoft Teams message from a fake “IT…
Original (new tab)
casco.com · Web page · Published 31 Mar
The Blueprint of a North Korean Attack on Open-Source
Just in the last 7 days, we've seen LiteLLM and axios impacted by supply chain attacks. Recently with Bereket Engida, the creator of the popular JS auth library: Better-Auth. He observed repeated attempts by a contributor to add malicious code directly via a…
Original (new tab)
ANY.RUN · Web page · Added 22 Jul
SnappyClient
SnappyClient is a C++-based C2 implant first identified in December 2025, delivered through the HijackLoader malware loader. It combines remote access (terminal, process control, file management) with data theft (keylogging, screenshots, browser and crypto…
Malware Original (new tab)
anomali.com · Web page · Published 21 Oct
Anomali Cyber Watch: F5 Breach, Mysterious Elephant APT, Malicious MCP Servers, and More
Jewelbug APT Executes Five-Month Espionage Against Russian IT Provider When Trusted AI Connections Turn Hostile LinkPro Linux Rootkit Exposes Deep Stealth Threat to Cloud & Linux Environments Silver Fox Expands Winos 4.0 Attacks to Japan and Malaysia via…
State-sponsored Malware Original (new tab)

Added Tue 21 Jul

Elastic Security Labs · Web page · Published 18 Jul
New North Korean campaign uses fake coding interviews to steal developer credentials
Elastic Security Labs found a new Contagious Interview campaign, tracked as REF9403, hiding malware inside SVG image files using steganography. To our knowledge, this specific infection chain has not been previously documented. We found it after the…
Infostealers Original (new tab)
Checkmarx · Web page · Added 21 Jul
ChainVeil: A Malicious npm Supply Chain Attack by SuccessKey
Checkmarx Zero’s ongoing research into malicious open-source libraries has uncovered and reported a targeted supply chain campaign that bears strong indications of being operated by a threat actor known as “SuccessKey” (no apparent relationship to several…
Supply chain Original (new tab)
Checkmarx · Web page · Added 21 Jul
Sequel to ChainVeil npm malware: ViteVenom
When we published our ChainVeil report in June 2026, we noted something that didn’t fit: the SuccessKey campaign’s Command and Control (Command and Control (C2)) infrastructure contained a secondary server at 198.105.127[.]210 and a tertiary server at…
Malware Supply chain Original (new tab)
opensourcemalware.com · Web page · Published 17 Jul
ChainVeil and ViteVenom are DPRK’s PolinRider Campaign
On June 16, 2026, Checkmarx Zero published a detailed breakdown of an npm supply chain campaign they named "ChainVeil." It's careful work: they pulled together nine malicious packages, a 77KB remote access trojan (RAT), a four-tier blockchain command channel…
Malware Supply chain Original (new tab)
Trend Micro · Web page · Published 29 Jun
TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry
Attackers are targeting employees of Booking.com partner companies in Japan, using phishing emails that impersonate guest complaints and review requests to trick hotel staff into executing malicious files. Multiple email delivery methods were observed,…
Malware Phishing Original (new tab)

Added Sat 18 Jul

ox.security · Web page · Published 12 Jul
Malware-Slop: Crypto Stealer Impersonating Polymarket Exposes Its Own Credentials
Then Exposes Its Own GitLab Credentials Overview The OX Research team recently discovered a malicious npm package cryptocurrency theft and credential exfiltration campaign. The package specifically impersonates target high-value crypto users. In a new…
Malware Infostealers Supply chain Original (new tab)
itochuci.co.jp · Web page · Published 11 Jun
ホテル業界を標的とした不審メールの分析（パート2: 技術詳細編）
ホテル業界を標的とした不審メールの分析編）攻撃の概要（全体像）攻撃手法の詳細分析多段スクリプト JavaScript ファイル（TonRAT） TonRAT の通信プロトコル通信先の分析まとめ Appendix IoC（ファイル） IoC（通信先）本記事はパート1「キャンペーン概要編」の続編です。パートや攻撃キャンペーンの全体像を解説しました。パート的な分析結果を解説します。パート1の記事はこちらです。攻撃の概要（全体像）パート1で解説した通り、今回確認された攻撃の流れは以下の通りです。…
Original (new tab)
opensourcemalware.com · Web page · Published 15 Jul
PolinRider Confirmed Footprint Grows 6.5x Since March
In the three months since we discovered the PolinRider campaign, we've observed it growing to become a major source of malicious activity. We recently completed a fresh hunt that surfaced an entire new wave of victims: Our July hunt uncovered 2,417…
Original (new tab)
itochuci.co.jp · Web page · Published 11 Jun
ホテル業界を標的とした不審メールの分析（パート1: キャンペーン概要編）
ホテル業界を標的とした不審メールの分析ーン概要編背景 Booking.com 攻撃の全体像まとめ Appendix ）を詐称した不審メールメールヘッダーの分析送信元インフラの一致送信者名の偽装 Reply-To 添付ファイル（メール本文のリンクの分析ショートカットファイルの分析 IoC（ファイル） IoC（通信先）本記事は2部構成です。パート詳細分析を解説します。パート2の記事はこちらです。背景宿泊施設のネット予約サービスを提供するす。このサイバー攻撃は、Booking.com…
Original (new tab)

Added Fri 17 Jul

Microsoft · Web page · Published 25 Jun
Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access
By Microsoft Defender Security Research Team, Microsoft Defender Experts, Parth Jomadkar Microsoft Threat Intelligence has identified an active multi-stage intrusion campaign targeting organizations in the hospitality and hotel industry since April 2026.…
Malware Original (new tab)
Symantec · Web page · Added 17 Jul
Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor
Backdoor.Daxin, the China-linked kernel-mode rootkit that Symantec first uncovered and exposed in 2022, is still operational. It was found running on a compromised host in Taiwan in 2026, more than four years after it was first uncovered. On the same machine,…
Malware Original (new tab)
Expel · Web page · Published 15 Jul
Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident
Chinese cybercrime group, GoldenEyeDog, has been regularly updating their malware and tactics since 2015. We’ve observed them regularly leveraging code-signing certificates to bypass Windows’s SmartScreen since 2024. They leverage several malware, including…
Malware Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.