Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,233 reports388 publishers50 added in the past week

501–520 of 1,024 reports · page 26 of 52 · Clear filters

Added Thu 7 May

Netcraft · Web page · Added 7 May
Resources – Netcraft
Okay Netcraft Blog Featured THREAT INTELLIGENCE Fibergrid: Inside the Bulletproof Host for 16,000+ Active Fake Shops April 20, 2026 | Netcraft uncovers Fibergrid, a bulletproof hosting provider enabling 16,000+ fake shops. Learn how stolen IP space, shell…
Original (new tab)
Netcraft · Web page · Added 7 May
Resources – Netcraft
Okay Netcraft Blog Featured THREAT INTELLIGENCE Fibergrid: Inside the Bulletproof Host for 16,000+ Active Fake Shops April 20, 2026 | Netcraft uncovers Fibergrid, a bulletproof hosting provider enabling 16,000+ fake shops. Learn how stolen IP space, shell…
Original (new tab)
Group-IB · Web page · Added 7 May
report-redcurl-awakening-en
2. The report provides information on the tactics, tools, and infrastructure of the cybercriminal group RedCurl. The report’s goal is to minimize the risk of the group committing further illegal acts, suppress any such activity in a timely manner, and raise…
Original (new tab)
Kaspersky · Web page · Published 16 Apr
Securelist | Kaspersky’s threat research and reports
Kaspersky researchers uncovered malicious wheel packages in PyPI that targeted both Windows and Linux and contained a dropper delivering malware dubbed ZiChatBot. We attribute this activity to OceanLotus APT. Threats Webinars Register to Access All Kaspersky…
Malware Original (new tab)
rootshell.be · Web page · Published 14 Jul
Simple DGA Spotted in a Malicious PowerShell
DGA (“Domain Generation Algorithm“) is a technique implemented in some malware families to defeat defenders and to make the generation of IOC’s (and their usage – example to implement black lists) more difficult. When a piece of malware has to contact a C2…
Malware Original (new tab)
Check Point · Web page · Published 10 Mar
Leaks of Conti Ransomware Group Paint Picture of a Surprisingly Normal Tech Start-Up… Sort Of
You’ve probably heard of the Conti ransomware group. After their 2020 emergence, they’ve accumulated at least 700 victims, where by “victims” we mean ‘big fish’ corporations with millions of dollars in revenue; unlike your average neighborhood ransomware…
Ransomware Original (new tab)
US Department of Justice · Web page · Published 7 May
Four Individuals Plead Guilty to RICO Conspiracy Involving “Bulletproof Hosting” for Cybercriminals
Four Eastern European nationals have pleaded guilty to conspiring to engage in a Racketeer Influenced Corrupt Organization (RICO) arising from their providing “bulletproof hosting” services between 2008 and 2015, which were used by cybercriminals to…
Original (new tab)
Check Point · Web page · Published 16 Dec
Phorpiex botnet is back with a new Twizt: Hijacking Hundreds of crypto transactions
Check Point Research (CPR) spotted the resurgence of Phorpiex, an old threat known for its sextortion spam campaigns, crypto-jacking, cryptocurrency clipping and ransomware spread The new variant “Twizt” enables the botnet to operate successfully without…
Botnets and DDoS Original (new tab)
Check Point · Web page · Published 1 Jun
“Troldesh” – New Ransomware from Russia
“Troldesh”, aka Encoder.858 or Shade, is a Trojan and a crypto-ransomware variant created in Russia and spread all over the world. Troldesh is based on so-called encryptors that encrypt all of the user’s personal data and extort money to decrypt the files.…
Ransomware Malware Original (new tab)
US Department of Justice · Web page · Published 28 Jan
Emotet Botnet Disrupted in International Cyber Operation
The Justice Department today announced its participation in a multinational operation involving actions in the United States, Canada, France, Germany, the Netherlands, and the United Kingdom to disrupt and take down the infrastructure of the malware and…
Malware Botnets and DDoS Original (new tab)
opensourcemalware.com · Web page · Published 6 May
Lazarus Group Uses Git Hooks To Hide Malware
The OpenSourceMalware team has spotted a fresh twist in the DPRK's Contagious Interview / TaskJacker playbook: the operators have pivoted away from stuffing their stage-2 loader into .vscode/tasks.json , package.json postinstall scripts, or fake .woff2 font…
State-sponsored Malware Original (new tab)
Medium · Web page · Published 5 Jan
Linux Threat Hunting Primer — Part II
In the previous post “Linux Threat Hunting Primer — Part 1” , we discussed how to start the threat hunting process and reviewed the statistical distribution of the Linux tactics and techniques. We also created lists of techniques to search for after…
Original (new tab)
Medium · Web page · Published 13 Mar
ArechClient; Decoding IOCs and finding the onboard browser extension
Found myself analyzing ArechClient recently and needed a way to automatically decode out the C2 info from lots of samples. By the end of our work we also discovered that the browser extension being delivered by ArechClient is on board the client itself. The…
Original (new tab)
Check Point · Web page · Published 12 Dec
Pulling the Curtains on Azov Ransomware: Not a Skidsware but Polymorphic Wiper
Check Point Research (CPR) provides under-the-hood details of its analysis of the infamous Azov Ransomware Investigation shows that Azov is capable of modifying certain 64-bit executables to execute its own code Azov is designed to inflict impeccable damage…
Ransomware Malware Original (new tab)
lookout.com · Web page · Published 8 Apr
Beyond BITTER: MENA Civil Society Targeted in Hack-For-Hire Operation Linke
Original (new tab)
SentinelOne · Web page · Published 23 Apr
fast16 | Mystery ShadowBrokers Reference Reveals High-Precision Software Sabotage 5 Years Before Stuxnet
SentinelLABS has uncovered a previously undocumented cyber sabotage framework whose core components date back to 2005, tracked as fast16. fast16.sys selectively targets high-precision calculation software, patching code in memory to tamper with results. By…
Original (new tab)
Group-IB · Web page · Added 7 May
The footprints of Raccoon
In the summer of 2020, Group-IB specialists discovered a malware distribution campaign exploiting Telegram’s legitimate features. Analysis showed that the attackers used the technique to distribute Raccoon stealer, i.e. malware spread through the…
Malware Infostealers Original (new tab)
Kaspersky · Web page · Published 30 Apr
Silver Fox uses the new ABCDoor backdoor to target organizations in Russia and India
In December 2025, we detected a wave of malicious emails designed to look like official correspondence from the Indian tax service. A few weeks later, in January 2026, a similar campaign began targeting Russian organizations. We have attributed this activity…
Malware Original (new tab)
Check Point · Web page · Published 19 Jul
BYOS – Bundle Your Own Stealer
Check Point Research (CPR) provides an in-depth analysis of the new malware strain dubbed BundleBot spreading under the radar. BundleBot is abusing the dotnet bundle (single-file), self-contained format that results in very low or no static detection at all.…
Infostealers Original (new tab)
Check Point · Web page · Published 17 Nov
Malware Spotlight – Into the Trash: Analyzing LitterDrifter
Gamaredon, also known as Primitive Bear, ACTINIUM, and Shuckworm, is a unique player in the Russian espionage ecosystem that targets a wide variety of almost exclusively Ukrainian entities. While researchers often struggle to uncover evidence of Russian…
State-sponsored Malware Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.