Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,224 reports387 publishers41 added in the past week

461–480 of 1,015 reports · page 24 of 51 · Clear filters

Added Tue 19 May

Microsoft · Web page · Published 14 May
Kazuar: Anatomy of a nation-state botnet
Kazuar, a sophisticated malware family attributed to the Russian state actor Secret Blizzard, has been under constant development for years and continues to evolve in support of espionage-focused operations. Over time, Kazuar has expanded from a relatively…
State-sponsored Malware Botnets and DDoS Original (new tab)
ANY.RUN · Web page · Published 14 May
LATAM Under Siege: Agent Tesla’s 18-Month Credential Theft Campaign Against Chilean Enterprises
Editor’s note: The analysis is authored by Moises Cerqueira, malware researcher & threat hunter. You can find Moises on LinkedIn and X. Credential theft malware rarely announces itself with ransomware-level noise. Instead, it operates like a silent siphon…
Malware Original (new tab)
ThreatFabric · Web page · Published 1 Oct
New TrickMo Variant: Device Take Over malware targeting Banking, Fintech, Wallet & Auth apps
Modern Android banking malware increasingly evolves through architectural redesigns intended to improve stealth, resilience, and operational flexibility rather than through entirely new user-facing capabilities. As platform protections and detection measures…
Malware Mobile Original (new tab)
artik.blue · Web page · Published 9 Jul
Malware analysis with IDA/Radare2 - Basic Unpacking (Dridex first stage)
Greetings again dear malware analysts! In this part of the series we are leaving the initial topics behind to start focusing on unpacking/decrypting malware by applying our reverse engineering skills to those binaries. We will start by unpacking the initial…
Malware Original (new tab)
zanezhub.github.io · Web page · Published 17 May
Analysis on Malware that attacks Israel’s Water treatment facilities
I go after the entry point of the malware and right away we can see that there’s only three main functions. This makes it easier for us to analyze the malware. I’m not sure why the author did not add a layer of obfuscation to the binary to make it hearder to…
Malware Original (new tab)

Added Thu 14 May

GitHub · PDF · Added 14 May
MacProStorage02:_2018ROW:Bitdefender-Whitepaper-Inexsmar-crea1598-A4-en_EN:Bitdefender-Whitepaper-Inexsmar-crea1598-A4-en_EN.indd
FOR MORE INFORMATION VISIT: enterprise.bitdefender.com Bitdefender is a global security technology company that delivers solutions in more than 100 countries through a network of value-added alliances, distributors and reseller partners. Since 2001,…
Original (new tab)
Kaspersky · Web page · Published 17 Feb
Kaspersky discovers Keenadu – a multifaceted Android malware that can come preinstalled on new devices
Kaspersky has detected a new malware for Android devices that it dubbed Keenadu. This malware is distributed in multiple forms – it can be preinstalled directly into devices’ firmware, embedded within system apps, or even downloaded from official app stores…
Malware Mobile Original (new tab)
panther.com · Web page · Published 3 Apr
jsonspack: Multi-Tenant Node.js RAT — DPRK Supply Chain Campaign
Note — jsonspack vs legitimate jsonpack : jsonpack is a legitimate npm JSON compression library published by sapienlab in 2013, maintained through 2022, with 1.1.5 as the final version.P2 (Footnote prefixes: E = evidence, P = prior art, R = references, A =…
Malware Supply chain Original (new tab)
LevelBlue · Web page · Published 19 Nov
SpiderLabs IDs New Banking Trojan Distributed Through WhatsApp
November 19, 2025 10 Minute Read by Nathaniel Morales, John Basmayor, and Nikita Kazymirskyi LevelBlue SpiderLabs researchers have recently identified a banking Trojan we dubbed Eternidade Stealer, which is distributed through WhatsApp hijacking and social…
Malware Original (new tab)
Medium · Web page · Published 27 Jan
From XLoader to Phantom Stealer: A DHL-Themed multi-stage Infection Chain
I have identified a multi-stage malware campaign delivering Phantom Stealer v3.5.0 via a DHL-themed spam email. Initial access occurs through a ZIP attachment masquerading as an invoice and requiring user execution. The archive drops a signed Java utility…
Infostealers Original (new tab)
QiAnXin · Web page · Published 11 May
Threat Actor Mr_Rot13 Actively Exploits CVE-2026-41940 for Backdoor Deployment
CVE-2026-41940 is a high-severity unauthenticated authentication bypass vulnerability affecting cPanel & WHM. This product is widely used in Linux server operations and virtual hosting management. The vulnerability has a CVSS score as high as 9.8 (Critical).…
Malware Vulnerabilities Original (new tab)
IBM X-Force · Web page · Published 12 Mar
A Slopoly start to AI-enhanced ransomware attacks
In early 2026, IBM X-Force discovered a likely AI-generated novel malware which we are dubbing “Slopoly,” used during a ransomware attack. The operators are part of a group tracked as Hive0163, whose main objective is extortion through large-scale data…
Ransomware Malware AI Original (new tab)
darkwebinformer.com · Web page · Published 13 Apr
Polish Eco-Friendly Retailer VegeHome Suffers Data Breach Exposing 100K Customers
A threat actor going by lulzintel has uploaded the full database of vegehome.pl, a Polish eco-friendly home products retailer. The actor states the breach occurred in April 2026 and exposed data belonging to over 100,000 customers. VegeHome's tagline…
Original (new tab)
darkwebinformer.com · Web page · Published 23 Mar
Alleged Breach of Chile's Servicio Civil Platform Exposes 110K Public Servant Records With Full Names and User IDs
A threat actor going by NyxarGroup has published 110,000 records allegedly taken from Chile's Servicio Civil campus platform, the government training portal where public servants access professional development courses and programs. Servicio Civil is Chile's…
Original (new tab)
Microsoft · Web page · Published 12 Mar
Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential theft
In mid-January 2026, Microsoft Defender Experts identified a credential theft campaign that uses fake virtual private network (VPN) clients distributed through search engine optimization (SEO) poisoning. The campaign redirects users searching for legitimate…
Original (new tab)
Mandiant (Google) · Web page · Published 18 Mar
The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors
Google Threat Intelligence Group (GTIG) has identified a new iOS full-chain exploit that leveraged multiple zero-day vulnerabilities to fully compromise devices. Based on toolmarks in recovered payloads, we believe the exploit chain to be called DarkSword.…
Vulnerabilities Mobile Original (new tab)
Trend Micro · Web page · Published 30 Apr
Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia
Table 1. Legitimate executables vulnerable to DLL sideloading abused by SHADOW‑EARTH‑053 SHADOW-EARTH-053 uses a legitimate Toshiba Bluetooth Stack executable, renamed to CIATosBtKbd.exe, to sideload a malicious DLL (TosBtKbd.dll). This loader employs a…
Malware Original (new tab)
darkwebinformer.com · Web page · Published 23 Mar
Alleged Breach of Chile's Ley del Lobby Platform Exposes 250GB of Government Lobbying Records Spanning 2018 to 2026
A threat actor going by NyxarGroup claims to be selling 250GB of data from Chile's Ley del Lobby platform, the government transparency portal that records and monitors lobbying activities carried out by individuals, companies, and organizations in relation to…
Original (new tab)

Added Tue 12 May

LevelBlue · Web page · Published 19 Jun
LevelBlue Labs Discovers Highly Evasive, New Loader Targeting Chinese Organizations
LevelBlue Labs recently discovered a new highly evasive loader that is being delivered to specific targets through phishing attachments. A loader is a type of malware used to load second-stage payload malware onto a victim’s system. Due to the lack of…
Malware Original (new tab)
Trend Micro · Web page · Published 5 Mar
New BoryptGrab Stealer Targets Windows Users via Deceptive GitHub Pages
The BoryptGrab campaign uses fake SEO‑optimized GitHub repositories and deceptive download pages to distribute a data‑stealing malware family that delivers multiple payloads, including a reverse SSH backdoor, to Windows users. Save to Folio Key Takeaways…
Malware Infostealers Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.