Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,224 reports387 publishers42 added in the past week

441–460 of 1,015 reports · page 23 of 51 · Clear filters

Added Thu 28 May

cyderes.com · Web page · Published 29 Sep
MedusaLocker v3 Ransomware Explained
Howler Cell investigated the new v3 variant of MedusaLocker, the well-known ransomware family active since late 2019. This ransomware is also known as the BabyLockerKZ variant. Industry Impact Healthcare, Finance, Government, and Manufacturing sectors are…
Ransomware Original (new tab)
Zimperium · Web page · Published 16 Apr
Android Bankers: 4 Campaigns In A Row
In recent months, Zimperium’s zLabs team has identified a surge in Android Banking Trojan activity, marking a sophisticated shift in the mobile threat landscape. Our researchers successfully tracked four distinct campaigns, RecruitRat, SaferRat, Astrinox, and…
Mobile Original (new tab)
K7 Labs · Web page · Published 20 May
Fake Microsoft Teams Campaign Delivers ValleyRAT via NSIS Installer and DLL Sideloading
We came across fake Microsoft Teams distribution sites, shared on X platform back in mid April. The websites closely mimic the legitimate Microsoft Teams download page, using lookalike domains to trick users into downloading a trojanized installer packaged as…
Original (new tab)

Added Fri 22 May

nld.com.vn · Web page · Published 24 Mar
Một học sinh lớp 12 ở Thanh Hóa dùng mã độc đánh cắp dữ liệu máy tính người dùng toàn cầu
Ngày 24-3, tin từ Công an tỉnh Thanh Hóa cho biết Cơ quan An ninh điều tra Công an tỉnh này vừa khởi tố vụ án, khởi tố 12 bị can (trong đó có 1 học sinh lớp 12) về các tội danh liên quan đến sản xuất, phát tán phần mềm trái phép và xâm nhập hệ thống máy tính.…
Original (new tab)
secureblink.com · Web page · Added 22 May
Mustang Panda Strikes India and South Korea with Updated LOTUSLITE Backdoor in Espionage Campaign
China-linked Mustang Panda targets India banks & S.Korea policy via LOTUSLITE backdoor 22-Apr-2026 4 min read A China-linked threat group known as Mustang Panda has launched a dual‑faced espionage campaign targeting India’s banking sector and South Korea’s…
State-sponsored Malware Original (new tab)
Check Point · Web page · Published 13 May
Thus Spoke…The Gentlemen
On May 4th, 2026, The Gentlemen RaaS administrator acknowledged on underground forums that an internal backend database (Rocket) had been leaked. This leak exposed 9 accounts, including zeta88 (aka hastalamuerte), who runs the infrastructure, builds the…
Vulnerabilities Original (new tab)
acronis.com · Web page · Added 22 May
LOTUSLITE: Targeted espionage leveraging geopolitical themes
Acronis Threat Research Unit (TRU) observed a targeted malware campaign against U.S. government entities leveraging a politically themed ZIP archive containing a loader executable and a malicious dynamic-link library (DLL). The executable is used to sideload…
State-sponsored Malware Original (new tab)
egfincirt.org.eg · Web page · Published 5 May
Payload Ransomware: In-depth technical analysis
Payload is a cross-platform ransomware family with both Windows and Linux variants. In this blog, we will primarily focus on the Windows variant and its behavior in detail. Payload provides extensive support for command-line arguments, suggesting it can be…
Ransomware Original (new tab)
0x3obad.github.io · Web page · Published 13 May
MustangPanda New Backdoor LotusLite
Chinese state-sponsored APT Mustang Panda has added a new undocumented C++ backdoor LotusLite to its arsenal targets the financial sectors in India , South Korea and U.S . The analyzed sample is a fully-featured Windows backdoor DLL disguised as a WPS Office…
State-sponsored Malware Original (new tab)
pyaeheinnkyaw.com · Web page · Published 7 Sep
Red Shadows over Yangon: Analyzing TONESHELL Malware from Mustang Panda’s Campaign Against Myanmar
This report details a targeted malware campaign attributed to Mustang Panda, a Chinese APT group, leveraging a supposed compromised Myanmar embassy email to deliver malware against Myanmar’s entities. The campaign begins with a phishing email containing a…
State-sponsored Malware Original (new tab)
ANY.RUN · Web page · Published 17 Feb
LATAM Businesses Hit by XWorm via Fake Financial Receipts: Full Campaign Analysis
Editor’s note: The current article is authored by Moises Cerqueira, malware researcher and threat hunter. You can find Moises on LinkedIn. Malware campaigns targeting Latin America (LATAM) are evolving. While the final payloads, often commodity RATs like…
Malware Original (new tab)

Added Thu 21 May

BlueVoyant · Web page · Added 21 May
Lorem Ipsum Malware: Trojanized MS Teams Installers Deliver…
Lorem Ipsum Malware: Trojanized MS Teams Installers Deliver Multi-Stage Loader and Backdoor May 4, 2026 | 18 min read What Happened? BlueVoyant Security Operations Center (SOC) and Threat Fusion Cell (TFC) security researchers have been tracking an emerging,…
Malware Original (new tab)
Elastic Security Labs · Web page · Published 7 May
TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook
Elastic Security Labs identified a new Brazilian banking trojan that we are tracking as TCLBANKER, a malware family we assess is a major update of the MAVERICK/SORVEPOTEL family. The campaign, tracked as REF3076, features a loader with robust anti-analysis…
Malware Original (new tab)
ransom-isac.com · Web page · Published 22 Apr
DragonBreath: Dragon in the Kernel
Dragoncore_k.sys & Zhengzhou 403 Network Technology Co., Ltd. 0-Day BYOVD Vulnerability | Shell Company Analysis | Dragon Breath APT-Q-27 | APT31 Personnel Nexus Field Value Report Date April 22, 2026 Authors Alex Necula, Ellis Stannard TLP Classification…
State-sponsored Vulnerabilities Original (new tab)

Added Wed 20 May

ESET · Web page · Added 20 May
FrostyNeighbor: Fresh mischief and digital shenanigans
This blogpost covers newly discovered activities attributed to FrostyNeighbor, targeting governmental organizations in Ukraine. FrostyNeighbor has been running continual cyberoperations, changing and updating its toolset regularly, updating its compromise…
Original (new tab)
Netskope · Web page · Published 7 May
OpenClaw’s Hologram: Fake Installer Ships Rust Infostealer
Netskope Threat Labs has found a fake OpenClaw installer delivering red-team-grade capabilities—all pointed at stealing credentials from over 250 crypto wallet and password manager extensions. The dropper’s manifest doesn’t hide the intent: “Hologram – Decoy…
Malware Infostealers Original (new tab)
egfincirt.org.eg · Web page · Published 5 May
Payload Ransomware: In-depth technical analysis
Payload is a cross-platform ransomware family with both Windows and Linux variants. In this blog, we will primarily focus on the Windows variant and its behavior in detail. Payload provides extensive support for command-line arguments, suggesting it can be…
Ransomware Original (new tab)
zynap.com · Web page · Published 15 May
Zynap’s Next-Gen Sandbox Redefines Automatic Malware Analysis
In simple terms, a hook is like placing a “sensor” on certain operating system functions: every time the malware calls that function, the sensor records the action. This allows us to observe what the malware does without having to perform a manual…
Malware Original (new tab)

Added Tue 19 May

cocomelonc.github.io · Web page · Published 27 Apr
MacOS malware persistence 11: osascript LOLBin. Simple C example
Hello, cybersecurity enthusiasts and white hackers! Continuing the macOS malware persistence series. Today we look at another Apple-signed LOLBin: osascript - the command-line interpreter for AppleScript and JavaScript for Automation (JXA). Used in the wild…
Malware Original (new tab)
artik.blue · Web page · Published 12 Jul
Malware analysis with IDA/Radare2 - Multiple unpacking (Ramnit worm)
Today we are following our previous post on these series unpacking a sample (Ramnit) that looks a bit more complex as it performs multiple unpacking, combining own methods with an open source packer. As this piece of malware is relatively old, I’ll be using a…
Malware Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.