Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,233 reports388 publishers50 added in the past week

481–500 of 1,024 reports · page 25 of 52 · Clear filters

Added Thu 14 May

IBM X-Force · Web page · Published 12 Mar
A Slopoly start to AI-enhanced ransomware attacks
In early 2026, IBM X-Force discovered a likely AI-generated novel malware which we are dubbing “Slopoly,” used during a ransomware attack. The operators are part of a group tracked as Hive0163, whose main objective is extortion through large-scale data…
Ransomware Malware AI Original (new tab)
darkwebinformer.com · Web page · Published 13 Apr
Polish Eco-Friendly Retailer VegeHome Suffers Data Breach Exposing 100K Customers
A threat actor going by lulzintel has uploaded the full database of vegehome.pl, a Polish eco-friendly home products retailer. The actor states the breach occurred in April 2026 and exposed data belonging to over 100,000 customers. VegeHome's tagline…
Original (new tab)
darkwebinformer.com · Web page · Published 23 Mar
Alleged Breach of Chile's Servicio Civil Platform Exposes 110K Public Servant Records With Full Names and User IDs
A threat actor going by NyxarGroup has published 110,000 records allegedly taken from Chile's Servicio Civil campus platform, the government training portal where public servants access professional development courses and programs. Servicio Civil is Chile's…
Original (new tab)
Microsoft · Web page · Published 12 Mar
Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential theft
In mid-January 2026, Microsoft Defender Experts identified a credential theft campaign that uses fake virtual private network (VPN) clients distributed through search engine optimization (SEO) poisoning. The campaign redirects users searching for legitimate…
Original (new tab)
Mandiant (Google) · Web page · Published 18 Mar
The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors
Google Threat Intelligence Group (GTIG) has identified a new iOS full-chain exploit that leveraged multiple zero-day vulnerabilities to fully compromise devices. Based on toolmarks in recovered payloads, we believe the exploit chain to be called DarkSword.…
Vulnerabilities Mobile Original (new tab)
Trend Micro · Web page · Published 30 Apr
Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia
Table 1. Legitimate executables vulnerable to DLL sideloading abused by SHADOW‑EARTH‑053 SHADOW-EARTH-053 uses a legitimate Toshiba Bluetooth Stack executable, renamed to CIATosBtKbd.exe, to sideload a malicious DLL (TosBtKbd.dll). This loader employs a…
Malware Original (new tab)
darkwebinformer.com · Web page · Published 23 Mar
Alleged Breach of Chile's Ley del Lobby Platform Exposes 250GB of Government Lobbying Records Spanning 2018 to 2026
A threat actor going by NyxarGroup claims to be selling 250GB of data from Chile's Ley del Lobby platform, the government transparency portal that records and monitors lobbying activities carried out by individuals, companies, and organizations in relation to…
Original (new tab)

Added Tue 12 May

LevelBlue · Web page · Published 19 Jun
LevelBlue Labs Discovers Highly Evasive, New Loader Targeting Chinese Organizations
LevelBlue Labs recently discovered a new highly evasive loader that is being delivered to specific targets through phishing attachments. A loader is a type of malware used to load second-stage payload malware onto a victim’s system. Due to the lack of…
Malware Original (new tab)
Trend Micro · Web page · Published 5 Mar
New BoryptGrab Stealer Targets Windows Users via Deceptive GitHub Pages
The BoryptGrab campaign uses fake SEO‑optimized GitHub repositories and deceptive download pages to distribute a data‑stealing malware family that delivers multiple payloads, including a reverse SSH backdoor, to Windows users. Save to Folio Key Takeaways…
Malware Infostealers Original (new tab)
redasgard.com · Web page · Published 6 May
Hunting Lazarus Part VII: The Server That Was Not Just FTP
This is Part VII of the "Hunting Lazarus" series. The earlier installments documented the Contagious Interview campaign run by Lazarus Group – the DPRK-linked APT – which targets cryptocurrency and Web3 developers with fake job interviews, fabricated company…
State-sponsored Original (new tab)
Cisco Talos · Web page · Published 26 Feb
New Dohdoor malware campaign targets education and health care
Cisco Talos discovered an ongoing malicious campaign since at least as early as December 2025 by a threat actor we track as “UAT-10027,” delivering a previously undisclosed backdoor dubbed “Dohdoor.” Dohdoor utilizes the DNS-over-HTTPS (DoH) technique for…
Malware Original (new tab)

Added Sat 9 May

0x3obad.github.io · Web page · Published 27 Mar
PlugX : Mustang Panda APT
Mustang Panda is a China-linked advanced persistent threat (APT) group engaged in sustained cyber espionage operations, primarily targeting government entities, diplomatic organizations, and NGOs. The group relies on a consistent toolset that is regularly…
State-sponsored Malware Original (new tab)
Kaspersky · Web page · Published 29 Dec
The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor
In mid-2025, we identified a malicious driver file on computer systems in Asia. The driver file is signed with an old, stolen, or leaked digital certificate and registers as a mini-filter driver on infected machines. Its end-goal is to inject a backdoor…
State-sponsored Malware Original (new tab)
nadsec.online · Web page · Published 6 Mar
Coruna: A Complete Technical Teardown of a State-Grade iOS/macOS Watering-Hole Exploit Chain
Author: @Nadsec | Date: March 2026 | Classification: Threat Intelligence - Public Abstract Coruna is a multi-stage, multi-platform exploit chain targeting Apple's Safari/WebKit engine and XNU kernel on ARM64 (arm64e) devices running iOS and macOS. Operated by…
Vulnerabilities Mobile Original (new tab)
threatlocker.com · Web page · Published 31 Jul
SafePay ransomware explained: IOCs, TTPs, and defense strategies
Observing SafePay ransomware, ThreatLocker® Intelligence has seen Mutexes being created to prevent additional copies of the ransomware running on already affected/encrypted devices. Typically, a different Mutex would be used for each victim. The switch to a…
Ransomware Original (new tab)
ANY.RUN · Web page · Published 12 Mar
MicroStealer Analysis: A Fast-Spreading Infostealer with Limited Detection
Security teams depend on early signals to spot and contain new threats. But what happens when a fully capable infostealer spreads while traditional detections stay limited? In recent investigations, ANY.RUN researchers observed MicroStealer in 40+ sandbox…
Infostealers Original (new tab)
CERT Polska · Web page · Added 9 May
Analiza kampanii FvncBot
Podstawowe informacje Omawiane próbki są hostowane pod adresem ruvofech.it[.]com . Sposób dystrybucji plików nie został jeszcze zidentyfikowany na moment tworzenia tej analizy. Aplikacja opisana jako Token U2F Mobilna Ochrona SGB informuje użytkownika o…
Original (new tab)
kmsec.uk · Web page · Published 1 May
North Korea's abuse of Cloudflare Workers and Pages
I took a break from my DPRK tracking hobby to amass a useless collection of public Google Docs in dochunt. But play time is over! DPRK gave me something fun to come back to. Thank you NK, very cool! Summary A cluster of 5 npm packages abuse Cloudflare…
Original (new tab)
redpiranha.net · Web page · Added 9 May
Threat Intelligence Report April 21 to April 27, 2026
Atemu RAT is a windows-based Remote Access Trojan (RAT) that’s primarily spread through ClickFix based attacks impersonating CloudFlare captchas to trick the user into pasting a malicious payload into PowerShell or cmd. The initial ClickFix payload uses…
Malware Original (new tab)

Added Fri 8 May

zanezhub.github.io · Web page · Published 2 May
NotPetya Malware Analysis - Bye, boot partition. I’ll miss you
MD5 hash: 71b6a493388e7d0b40c83ce903bc6b04 humanhash: michigan-twenty-december-papa File name: iec56w4ibovnb4wc.onion_Library__Ransomeware__NotPetya.bin.malw I tried to look for a NotPetya diagram to see the workflow of the malware, but I could not find
Malware Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.