Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,281 reports398 publishers97 added in the past week

481–500 of 1,281 reports · page 25 of 65

Added Thu 4 Jun

Unit 42 · Web page · Published 14 Jul
Behind the Clouds: Attackers Targeting Governments in Southeast Asia Implement Novel Covert C2 Communication
Since late 2024, Unit 42 researchers have been tracking a cluster of suspicious activity as CL-STA-1020, targeting governmental entities in Southeast Asia. The threat actors behind this cluster of activity have been collecting sensitive information from…
Malware Original (new tab)
Trend Micro · Web page · Published 19 May
Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud
An MDR investigation correlated attacker infrastructure and endpoint telemetry to map the full operational model of Banana RAT, a banking trojan attributed to a threat activity cluster that TrendAI™ tracks as SHADOW-WATER-063. By correlating artifacts like…
Malware Original (new tab)
Microsoft · Web page · Published 18 May
How Storm-2949 turned a compromised identity into a cloud-wide breach
Microsoft Threat Intelligence recently uncovered a methodical, sophisticated, and multi-layered attack, where a threat actor we track as Storm-2949 launched a relentless campaign with a singular focus: to exfiltrate as much sensitive data from a target…
Original (new tab)
trojan-killer.net · Web page · Published 31 May
DriveSurge Turns Trusted Websites Into ClickFix Malware Traps
A new DriveSurge campaign shows how a normal website visit can turn into a malware-installation prompt without the site owner or visitor realizing what happened. Silent Push researchers reported that the actor has compromised thousands of legitimate websites…
Malware Original (new tab)
Wiz · Web page · Published 27 May
Commit to Compromise: A New Threat Actor Targeting the Cryptocurrency Industry's Software Development Infrastructure
The Wiz Customer Incident Response Team (CIRT) has investigated multiple intrusions targeting cryptocurrency organizations. These campaigns leveraged sophisticated social engineering techniques, custom macOS malware, and deep targeting of CI/CD…
Original (new tab)
qualys.com · Web page · Published 2 Jun
The HazyBeacon Protocol – How Malware Weaponizes Amazon Web Services (AWS) Lambda Function URLs
HazyBeacon (CL-STA-1020) targets Southeast Asian government networks by abusing AWS Lambda Function URLs configured with AuthType: NONE as stealth command-and-control relays. Attackers use stolen IAM credentials to deploy Lambda functions that proxy malware…
Malware Original (new tab)
intelinsights.substack.com · Web page · Published 27 Jul
Profiling Hacktivist Groups,Alliances and Capabilities
Following the escalating military tensions between India and Pakistan there has been a surge in Hacktivist groups activity, from new groups surfacing to new collectives and alliances being formed. I have been tracking some of them, pretty much following every…
Original (new tab)
hacknotice.com · Web page · Published 16 Mar
Hualun New Materials Suffers Massive Data Breach by SnowSoul
HackNotice is a service that notices trends and patterns in publically available data so as to identify possible data breaches, leaks, hacks, and other data incidents on behalf of our clients. HackNotice monitors data streams related to breaches, leaks, and…
Original (new tab)
Unit 42 · Web page · Published 6 Mar
An Investigation Into Years of Undetected Operations Targeting High-Value Sectors
Since at least 2020, we have observed a cluster of activity targeting high-value organizations across South, Southeast and East Asia. The attacks focus on critical sectors such as aviation, energy, government, law enforcement, pharmaceutical, technology and…
Original (new tab)
Group-IB · Web page · Added 4 Jun
The GHOST STADIUM Score: Billions At Stake At The World’s Largest Football Tournament
The 2026 FIFA World Cup is set to be the largest sporting event in history. Hosted across three nations — the United States, Canada, and Mexico — the tournament will take place from June 11 to July 19, 2026, featuring 104 matches played in 16 cities. The…
Original (new tab)
dailydarkweb.net · Web page · Published 2 Apr
SnowSoul Attack Hits Multiple Chinese Organizations
Dongyu Company, along with several other Chinese organizations, has allegedly been compromised after a $2,000 ransom demand was refused. The leaked dataset, categorized under the identifier “SnowSoul ID-1270,” reportedly contains roughly 30GB of corporate…
Original (new tab)
outpost24.com · Web page · Published 1 Jul
How hacktivist cyber operations surged amid Israeli-Iranian conflict
In June 2025, Israel carried out airstrikes against key Iranian military and nuclear facilities. Iran swiftly retaliated, escalating regional tensions to unprecedented levels. This military confrontation has not only unfolded in conventional warfare but also…
Original (new tab)

Added Wed 3 Jun

nextron-systems.com · Web page · Published 2 Jun
Detecting Nimbus Manticore and their sideloading infection chains
During a recent incident, we identified a sophisticated sideloading infection chain dropping a custom implant for data exfiltration. Further analysis allowed us to attribute the activity to the Iran-nexus APT group Nimbus Manticore, also tracked as UNC1549…
State-sponsored Malware Original (new tab)
Check Point · Web page · Published 22 May
Fast and Furious – Nimbus Manticore Operations During the Iranian Conflict
The Iranian, IRGC affiliated, threat actor Nimbus Manticore resurfaced during Operation Epic Fury, the US military campaign against Iran launched on February 28, 2026, demonstrating newly adopted techniques and enhanced capabilities. The campaign leveraged…
Malware Original (new tab)
wojsko-polskie.pl · Web page · Added 3 Jun
Analiza wykorzystania podatności CVE 2026 21509 w kontekście aktywności Crafty Leshy
Już cztery dni później tj. 30.01.2026 r. analitycy DKWOC, prowadzący bieżące monitorowanie aktywności adwersarzy zidentyfikowali artefakty pozwalające potwierdzić aktywne wykorzystanie tej luki w kampanii wymierzonej zarówno w instytucje krajowe, jak i…
Original (new tab)

Added Tue 2 Jun

PwC · Web page · Added 2 Jun
Open Directory, Open Season: Inside Red Lamassu’s JFMBackdoor
PwC Threat Intelligence has been tracking a China-based threat actor we call Red Lamassu (a.k.a. Calypso) since 2019, observing its operations targeting telecommunications and government entities across the Asia Pacific region with a combination of bespoke…
Original (new tab)

Added Thu 28 May

Trend Micro · Web page · Published 22 May
Analyzing Void Dokkaebi’s Cython-Compiled InvisibleFerret Malware
Void Dokkaebi, a North Korea-aligned intrusion set, has updated its information-stealing malware, InvisibleFerret, shifting its delivery format to evade script-based detections. Save to Folio Key takeaways Void Dokkaebi (aka Famous Chollima) has migrated…
Malware Original (new tab)
cyderes.com · Web page · Published 29 Sep
MedusaLocker v3 Ransomware Explained
Howler Cell investigated the new v3 variant of MedusaLocker, the well-known ransomware family active since late 2019. This ransomware is also known as the BabyLockerKZ variant. Industry Impact Healthcare, Finance, Government, and Manufacturing sectors are…
Ransomware Original (new tab)
Zimperium · Web page · Published 16 Apr
Android Bankers: 4 Campaigns In A Row
In recent months, Zimperium’s zLabs team has identified a surge in Android Banking Trojan activity, marking a sophisticated shift in the mobile threat landscape. Our researchers successfully tracked four distinct campaigns, RecruitRat, SaferRat, Astrinox, and…
Mobile Original (new tab)
K7 Labs · Web page · Published 20 May
Fake Microsoft Teams Campaign Delivers ValleyRAT via NSIS Installer and DLL Sideloading
We came across fake Microsoft Teams distribution sites, shared on X platform back in mid April. The websites closely mimic the legitimate Microsoft Teams download page, using lookalike domains to trick users into downloading a trojanized installer packaged as…
Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.