Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,281 reports398 publishers97 added in the past week

461–480 of 1,281 reports · page 24 of 65

Added Fri 12 Jun

teamt5.org · Web page · Published 10 Jun
Alert: Exploitation of CVE-2026-34197 in Apache ActiveMQ
SLIME88 積極利用。我們的調查顯示，SLIME88 在利用該漏洞後部署了 SoxAgent RAT ，以入侵 Linux 設備並建置 ORB 網路。我們目前以臨時名稱 GOBLIN14 追蹤該 ORB 網路。 SLIME88 最早的攻擊可以追溯到 4 月 7 日。 SLIME88 攻擊活動的受害者包括美國以及韓國、印度、法國和美國的 IT 與製造業。本文詳細說明攻擊手法與情況。 The following blog post is based on our 2026 April H2…
Vulnerabilities Original (new tab)
thecyberexpress.com · Web page · Published 18 Apr
Cyberattacks on Jordan: BlackMaskers Target Crucial Entities
Amidst the complexities of the Israel-Iran conflict, the Middle East is witnessing another form of strife: cyber warfare. Jordan finds itself at the forefront of this battle, facing a barrage of alleged cyberattacks orchestrated by various hacktivist groups.…
Original (new tab)
Proofpoint · Web page · Published 1 Jun
TA4922: The Suspected Chinese Crime Group is Going Global
TA4922 is a highly sophisticated threat actor demonstrating a rapid operational tempo and continually evolving malware arsenal. The group has been observed using multiple malware families including Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT…
Malware Original (new tab)

Added Thu 11 Jun

Microsoft · Web page · Published 17 Mar
StilachiRAT analysis: From system reconnaissance to cryptocurrency theft
In November 2024, Microsoft Incident Response researchers uncovered a novel remote access trojan (RAT) we named StilachiRAT that demonstrates sophisticated techniques to evade detection, persist in the target environment, and exfiltrate sensitive data.…
Malware Original (new tab)
GitHub · Web page · Added 11 Jun
GitHub - es3n1n/defendnot: An even funnier way to disable windows defender. (through WSC api)
Using this tool to facilitate malware distribution, cybercrime, unauthorized access, evading detection, or any illegal activity is strictly prohibited. Users assume all legal responsibility for how they use this tool and any consequences thereof. You must…
Original (new tab)

Added Wed 10 Jun

CrowdStrike · Web page · Added 10 Jun
Blurring of Commodity and Targeted Attack Malware
As malware and its authors continue to evolve, deciphering the purpose of specific malware-driven attacks has become more challenging. While some malware still has a feature-specific design such as DDoS tools or spam bots, it is becoming increasingly common…
Malware Original (new tab)
GitHub · Web page · Added 10 Jun
GitHub - vxaboveground/Overlord: Overlord
Hello, I made this project for fun. The server is TypeScript on Node/Bun. The client is Go. Operators talk to the server through a web panel or the Electron desktop app, and agents connect over encrypted WebSockets. Docker is the easiest way to run it. Quick…
Original (new tab)
exatrack.com · Web page · Published 1 Jun
Tracking APT28 PixyNetLoader: Evolutions from 2024 to 2026
Analysis of ~90 PixyNetLoader samples and grouping them into 4 sub-families using code similarities sharing Enabling unified detection through a single YARA rule Exposing the latest steganography mechanisms used in the 2026 March-April versions Provinding PNG…
State-sponsored Original (new tab)
fox-it.com · Web page · Published 22 May
RemotePE: The Lazarus RAT that lives in memory
Last year, we published research1 about a North Korean Lazarus subgroup targeting financial and cryptocurrency organizations, encountered during multiple incident response engagements. This Lazarus subgroup overlaps with activity linked to AppleJeus2, Citrine…
State-sponsored Malware Original (new tab)
WithSecure · Web page · Added 10 Jun
GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations
GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations - WithSecure™ By Authors Executive Summary WithSecure identified an ongoing and persistent set of activity targeting Ukraine and Ukraine-related entities since at least August 2025.…
State-sponsored Original (new tab)
exatrack.com · Web page · Published 9 Jun
Under the Hood - LotusLite: Believe me I am MustangPanda
Under the Hood - The new series where We share stories from our daily life as a malware hunter 🔎 We’re kicking things off with a recent implant featuring “BelievemeIamMustang-Panda” and “Hi,Mustang_Panda” hardcoded in its .data section! A C2 over…
Malware Original (new tab)
Proofpoint · Web page · Published 5 Jun
Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency
By Saher Naumaan, Carlos Rubio, and the Proofpoint Threat Research Team By Saher Naumaan, Carlos Rubio, and the Proofpoint Threat Research Team Key Findings Between April and May 2026, Proofpoint Threat Research observed a likely North Korean threat actor…
Phishing Original (new tab)
StepSecurity · Web page · Added 10 Jun
The Hades Campaign: Graph ML PyPI Packages Deploy Cross-Platform Memory Scrapers, AI Analyst Misdirection, and a Wiper Deterrent
On June 8, 2026, version 0.8.101 of the popular graph machine learning package ensmallen on PyPI was identified as containing a highly sophisticated supply chain compromise. Concurrently, a series of related packages in the computational biology,…
Malware Supply chain Original (new tab)
ESET · Web page · Added 10 Jun
A rigged game: ScarCruft compromises gaming platform in a supply-chain attack
ESET researchers uncovered a multiplatform supply-chain attack by North Korea-aligned APT group ScarCruft, targeting the Yanbian region in China – home to ethnic Koreans and a crossing point for North Korean refugees and defectors. In the attack, probably…
Malware Supply chain Mobile Original (new tab)
CERT-UA · Web page · Added 10 Jun
CERT-UA
CERT-UA звертає увагу спільноти на те, що активність, описана в цій статті як окремий кластер кіберзагроз UAC-0247, фактично здійснюється особами, діяльність яких раніше відстежувалася за ідентифікатором UAC-0244. Відтак подальше відстеження пов’язаних…
Original (new tab)

Added Tue 9 Jun

Fortinet · Web page · Published 3 Jun
Inside the Cross-Platform Propagation of a New Gafgyt Variant C0XMO
This past March, FortiGuard Labs discovered a new Gafgyt botnet variant, C0XMO, that spreads by exploiting CVE-2021-27137. Our analysis revealed that, unlike earlier versions, this malware separates its lateral movement into a standalone Python script. This…
Vulnerabilities Original (new tab)

Added Thu 4 Jun

bin.re · Web page · Added 4 Jun
A JavaScript-based DGA - Analysis of a defunct Proslikefan Sample
Note 2016-06-17: I later found a fully functional sample of Proslikefan and wrote about it here. Please check out the newer blog post in favor of this post. I leave this write-up of Proslikefan up, with some minor edits to reflect findings I obtained by…
Original (new tab)
The Hacker News · Web page · Published 30 Jun
U.S. Agencies Warn of Rising Iranian Cyber Attacks on Defense, OT Networks, and Critical Infrastructure
U.S. cybersecurity and intelligence agencies have issued a joint advisory warning of potential cyber attacks from Iranian state-sponsored or affiliated threat actors. "Over the past several months, there has been increasing activity from hacktivists and…
Vulnerabilities Original (new tab)
WithSecure · Web page · Added 4 Jun
GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations
GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations - WithSecure™ By Authors Executive Summary WithSecure identified an ongoing and persistent set of activity targeting Ukraine and Ukraine-related entities since at least August 2025.…
State-sponsored Original (new tab)
Recorded Future · Web page · Added 4 Jun
Latin America and the Caribbean Cybercrime Landscape
This report provides an overview of trends and developments in the cybercriminal ecosystem of Latin America and the Caribbean (LAC) in 2025. Insikt Group found that threat actors operating in or targeting the LAC region predominantly use client-server…
Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.