Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,281 reports398 publishers97 added in the past week

541–560 of 1,281 reports · page 28 of 65

Added Sat 9 May

Kaspersky · Web page · Published 29 Dec
The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor
In mid-2025, we identified a malicious driver file on computer systems in Asia. The driver file is signed with an old, stolen, or leaked digital certificate and registers as a mini-filter driver on infected machines. Its end-goal is to inject a backdoor…
State-sponsored Malware Original (new tab)
nadsec.online · Web page · Published 6 Mar
Coruna: A Complete Technical Teardown of a State-Grade iOS/macOS Watering-Hole Exploit Chain
Author: @Nadsec | Date: March 2026 | Classification: Threat Intelligence - Public Abstract Coruna is a multi-stage, multi-platform exploit chain targeting Apple's Safari/WebKit engine and XNU kernel on ARM64 (arm64e) devices running iOS and macOS. Operated by…
Vulnerabilities Mobile Original (new tab)
threatlocker.com · Web page · Published 31 Jul
SafePay ransomware explained: IOCs, TTPs, and defense strategies
Observing SafePay ransomware, ThreatLocker® Intelligence has seen Mutexes being created to prevent additional copies of the ransomware running on already affected/encrypted devices. Typically, a different Mutex would be used for each victim. The switch to a…
Ransomware Original (new tab)
ANY.RUN · Web page · Published 12 Mar
MicroStealer Analysis: A Fast-Spreading Infostealer with Limited Detection
Security teams depend on early signals to spot and contain new threats. But what happens when a fully capable infostealer spreads while traditional detections stay limited? In recent investigations, ANY.RUN researchers observed MicroStealer in 40+ sandbox…
Infostealers Original (new tab)
CERT Polska · Web page · Added 9 May
Analiza kampanii FvncBot
Podstawowe informacje Omawiane próbki są hostowane pod adresem ruvofech.it[.]com . Sposób dystrybucji plików nie został jeszcze zidentyfikowany na moment tworzenia tej analizy. Aplikacja opisana jako Token U2F Mobilna Ochrona SGB informuje użytkownika o…
Original (new tab)
kmsec.uk · Web page · Published 1 May
North Korea's abuse of Cloudflare Workers and Pages
I took a break from my DPRK tracking hobby to amass a useless collection of public Google Docs in dochunt. But play time is over! DPRK gave me something fun to come back to. Thank you NK, very cool! Summary A cluster of 5 npm packages abuse Cloudflare…
Original (new tab)
redpiranha.net · Web page · Added 9 May
Threat Intelligence Report April 21 to April 27, 2026
Atemu RAT is a windows-based Remote Access Trojan (RAT) that’s primarily spread through ClickFix based attacks impersonating CloudFlare captchas to trick the user into pasting a malicious payload into PowerShell or cmd. The initial ClickFix payload uses…
Malware Original (new tab)

Added Fri 8 May

zanezhub.github.io · Web page · Published 2 May
NotPetya Malware Analysis - Bye, boot partition. I’ll miss you
MD5 hash: 71b6a493388e7d0b40c83ce903bc6b04 humanhash: michigan-twenty-december-papa File name: iec56w4ibovnb4wc.onion_Library__Ransomeware__NotPetya.bin.malw I tried to look for a NotPetya diagram to see the workflow of the malware, but I could not find
Malware Original (new tab)

Added Thu 7 May

Netcraft · Web page · Added 7 May
Resources – Netcraft
Okay Netcraft Blog Featured THREAT INTELLIGENCE Fibergrid: Inside the Bulletproof Host for 16,000+ Active Fake Shops April 20, 2026 | Netcraft uncovers Fibergrid, a bulletproof hosting provider enabling 16,000+ fake shops. Learn how stolen IP space, shell…
Original (new tab)
Netcraft · Web page · Added 7 May
Resources – Netcraft
Okay Netcraft Blog Featured THREAT INTELLIGENCE Fibergrid: Inside the Bulletproof Host for 16,000+ Active Fake Shops April 20, 2026 | Netcraft uncovers Fibergrid, a bulletproof hosting provider enabling 16,000+ fake shops. Learn how stolen IP space, shell…
Original (new tab)
Group-IB · Web page · Added 7 May
report-redcurl-awakening-en
2. The report provides information on the tactics, tools, and infrastructure of the cybercriminal group RedCurl. The report’s goal is to minimize the risk of the group committing further illegal acts, suppress any such activity in a timely manner, and raise…
Original (new tab)
Kaspersky · Web page · Published 16 Apr
Securelist | Kaspersky’s threat research and reports
Kaspersky researchers uncovered malicious wheel packages in PyPI that targeted both Windows and Linux and contained a dropper delivering malware dubbed ZiChatBot. We attribute this activity to OceanLotus APT. Threats Webinars Register to Access All Kaspersky…
Malware Original (new tab)
rootshell.be · Web page · Published 14 Jul
Simple DGA Spotted in a Malicious PowerShell
DGA (“Domain Generation Algorithm“) is a technique implemented in some malware families to defeat defenders and to make the generation of IOC’s (and their usage – example to implement black lists) more difficult. When a piece of malware has to contact a C2…
Malware Original (new tab)
Check Point · Web page · Published 10 Mar
Leaks of Conti Ransomware Group Paint Picture of a Surprisingly Normal Tech Start-Up… Sort Of
You’ve probably heard of the Conti ransomware group. After their 2020 emergence, they’ve accumulated at least 700 victims, where by “victims” we mean ‘big fish’ corporations with millions of dollars in revenue; unlike your average neighborhood ransomware…
Ransomware Original (new tab)
US Department of Justice · Web page · Published 7 May
Four Individuals Plead Guilty to RICO Conspiracy Involving “Bulletproof Hosting” for Cybercriminals
Four Eastern European nationals have pleaded guilty to conspiring to engage in a Racketeer Influenced Corrupt Organization (RICO) arising from their providing “bulletproof hosting” services between 2008 and 2015, which were used by cybercriminals to…
Original (new tab)
Check Point · Web page · Published 16 Dec
Phorpiex botnet is back with a new Twizt: Hijacking Hundreds of crypto transactions
Check Point Research (CPR) spotted the resurgence of Phorpiex, an old threat known for its sextortion spam campaigns, crypto-jacking, cryptocurrency clipping and ransomware spread The new variant “Twizt” enables the botnet to operate successfully without…
Botnets and DDoS Original (new tab)
Check Point · Web page · Published 1 Jun
“Troldesh” – New Ransomware from Russia
“Troldesh”, aka Encoder.858 or Shade, is a Trojan and a crypto-ransomware variant created in Russia and spread all over the world. Troldesh is based on so-called encryptors that encrypt all of the user’s personal data and extort money to decrypt the files.…
Ransomware Malware Original (new tab)
US Department of Justice · Web page · Published 28 Jan
Emotet Botnet Disrupted in International Cyber Operation
The Justice Department today announced its participation in a multinational operation involving actions in the United States, Canada, France, Germany, the Netherlands, and the United Kingdom to disrupt and take down the infrastructure of the malware and…
Malware Botnets and DDoS Original (new tab)
opensourcemalware.com · Web page · Published 6 May
Lazarus Group Uses Git Hooks To Hide Malware
The OpenSourceMalware team has spotted a fresh twist in the DPRK's Contagious Interview / TaskJacker playbook: the operators have pivoted away from stuffing their stage-2 loader into .vscode/tasks.json , package.json postinstall scripts, or fake .woff2 font…
State-sponsored Malware Original (new tab)
Medium · Web page · Published 5 Jan
Linux Threat Hunting Primer — Part II
In the previous post “Linux Threat Hunting Primer — Part 1” , we discussed how to start the threat hunting process and reviewed the statistical distribution of the Linux tactics and techniques. We also created lists of techniques to search for after…
Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.