Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,233 reports388 publishers50 added in the past week

521–540 of 1,024 reports · page 27 of 52 · Clear filters

Added Thu 7 May

Cisco Talos · Web page · Published 5 May
UAT-8302 and its box full of malware
Cisco Talos is disclosing UAT-8302, a sophisticated, China-nexus advanced persistent threat (APT) group targeting government entities in South America since at least late 2024 and government agencies in southeastern Europe in 2025. After successful…
State-sponsored Malware Original (new tab)

Added Wed 6 May

cert.orangecyberdefense.com · PDF · Added 6 May
Smoking Out an Affiliate
Ransomware Original (new tab)
Darktrace · Web page · Published 16 Apr
Inside ZionSiphon: Darktrace’s Analysis of OT Malware Targeting Israeli Water Systems
What is ZionSiphon? Darktrace recently analyzed a malware sample, which identifies itself as ZionSiphon. This sample combines several familiar host-based capabilities, including privilege escalation, persistence, and removable-media propagation, with…
Malware Original (new tab)
gdatasoftware.com · Web page · Published 17 Mar
HijackLoader: Free Games, Costly Consequences, and Loads of Malware
PiviGames, a popular Spanish gaming platform is well-known in the gaming community for providing download links to pirated PC games. Such a platform offers attractive content and it has built a reputation within the gaming community over the years. However,…
Malware Original (new tab)
Trend Micro · Web page · Published 3 Apr
Weaponizing Trust Signals: Claude Code Lures and GitHub Release Payloads
Anthropic inadvertently exposed internal Claude Code source material via a misconfigured npm package, which included approximately 512,000 lines of internal TypeScript and triggering rapid mirroring across GitHub. Within 24 hours, threat actors took advantage…
Infostealers Original (new tab)
Trend Micro · Web page · Published 21 Apr
Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories
Void Dokkaebi (aka Famous Chollima) has evolved beyond single-target social engineering into a self-propagating supply chain threat. A compromised developer’s repository becomes an infection vector for the next wave of victims, creating a worm-like…
Malware Original (new tab)
Bitsight · Web page · Published 31 Mar
Ransomware with a Twizt: Inside the Phorpiex Botnet
Phorpiex, also known as Trik, is a resilient and long-running botnet with a history dating back to 2011. While it has grabbed some headlines, its sustained presence and adaptability make it a subject of ongoing concern for the cybersecurity community.…
Ransomware Botnets and DDoS Original (new tab)
intel.breakglass.tech · Web page · Published 11 Apr
We Dumped a Live Kimsuky C2 and Recovered Every Stage of the Kill Chain: CHM Dropper, VBScript Stager, PowerSh
#Infrastructure: 79 Domains Across 5 IPs ##The DAOU Staging Server (27.102.137.38 — 37 domains) ##The Fast-Flux Farm (118.194.249.109 — 40 domains) ##The Naver Phishing Farm (27.102.137.150 — 12+ domains, LIVE) #Related Kimsuky Sample #Detection Guidance…
State-sponsored Malware Original (new tab)
hexastrike.com · Web page · Published 18 Apr
Cloned, Loaded, and Stolen: How 109 Fake GitHub Repositories Delivered SmartLoader and StealC
We identified 109 malicious GitHub repositories across 103 accounts that impersonate legitimate projects and redirect users to embedded ZIP files containing a LuaJIT-based SmartLoader stage. The campaign appears to be operated by a single threat actor or…
Malware Infostealers Original (new tab)
zynap.com · Web page · Published 24 Mar
Defensive Rootkits: Engineering Kernel-Level Malware Analysis from Ring 0
We are in the middle of the next transition. This time, the failures are silent. Modern malware is industrialized: sold as-a-service, rapidly iterated, and designed to scale. At the same time, defenders increasingly depend on automated pipelines. When those…
Malware Infostealers Original (new tab)
strikeready.com · Web page · Added 6 May
StrikeReady — AI-Powered Security Command Center
UNC1151 has operated with a higher operational tempo in 2025, and in this blog, Labs shows how to track this actor, by surfacing two clusters of activity, and tying it to previously attributed samples. Files that leverage anti-analysis techniques can often be…
State-sponsored Original (new tab)
Zscaler · Web page · Published 1 Apr
Anthropic Claude Code Leak
By Manisha Ramcharan Prajapati, Jithin Prajeev Nair, Avinash Kumar, Mallikarjun Piddannavar ThreatLabz discovers “Claude Code leak” lure that distributes Vidar and GhostSocks While monitoring GitHub for threats, ThreatLabz came across a “Claude Code leak”…
Original (new tab)
Darktrace · Web page · Published 26 Mar
Tracking & Detecting GhostSocks Malware
Software supply-chain attacks now represent the primary threat shaping the 2026 security landscape. Rather than relying on exploits at the perimeter, attackers are targeting the connective tissue of modern engineering environments: package managers, CI/CD…
Malware Supply chain Original (new tab)
Huntress · Web page · Published 4 Mar
“Malware, from the Outside!”: How a Threat Actor Used Fake OpenClaw Installers to Infect Systems with GhostSocks and Information Stealers
Special thanks to Greig Bailey for their effort in triaging and responding to this activity, and Aaron Deal for his tireless review and edits of this blog. Summary Information stealers continue to be an initial access vector for severe attacks against…
Malware Infostealers Original (new tab)
Trend Micro · Web page · Published 4 May
Quasar Linux (QLNX) – A Silent Foothold in the Supply Chain: Inside a Full-Featured Linux RAT With Rootkit, PAM Backdoor, Credential Harvesting Capabilities
Quasar Linux RAT (QLNX) is a comprehensive Linux implant that combines remote access capabilities with advanced evasion, persistence, keylogging, and credential harvesting features. The malware carries embedded C source code for both its PAM backdoor and…
Malware Phishing Supply chain Original (new tab)
zanezhub.github.io · Web page · Published 19 Apr
WannaCry Malware Analysis - How YOU Could have Saved the World ꩜
Everyone knows and has heard about the WannaCry ransomware. One of the biggests and most well known attacks to ever happen in cybersecurity, the range was so big that even people outside of the cybersecurity community knew about it. WannaCry? :’( If somehow…
Malware Original (new tab)
Gen Digital · Web page · Added 6 May
When Malware Authors Study Algebra: The Group Theory Inside Bedep's DGA
TLDR: Bedep was a malware family active mainly in 2014 and 2015 that used an unusually sophisticated domain generation algorithm, or DGA, to hide its command-and-control infrastructure. Instead of relying only on the date, it used real foreign exchange rates…
Malware Original (new tab)
orangecyberdefense.com · Web page · Published 15 Apr
SmokedHam and Qilin Threats
Smoking out an affiliate: SmokedHam, Qilin, a few Google ads and some bossware TL;DR In early 2026, Orange Cyberdefense responded to several incidents delivering the SmokedHam backdoor; In at least one case, the infection chain resulted in the deployment of…
Ransomware Original (new tab)

Added Tue 5 May

Group-IB · Web page · Added 5 May
The Darker Things
Today, on November 3, BlackMatter gang announced it was shutting its Ransomware-as-a-Service program due to the “pressure from the authorities”. However, it doesn’t mean that BlackMatter’s affiliates will stop malicious activity. They will most likely join…
Ransomware Original (new tab)
redteam.pl · Web page · Added 5 May
Sodinokibi / REvil / Maze ransomware (TTPs & IOC)
In general Web Share API [https://w3c.github.io/web-share/] allows users to share links from the browser via 3rd party applications (e.g. mail and messaging apps). The problem is that file: scheme is allowed and when a website points to such URL unexpected…
Ransomware Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.