Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,281 reports398 publishers97 added in the past week

561–580 of 1,281 reports · page 29 of 65

Added Thu 7 May

Medium · Web page · Published 13 Mar
ArechClient; Decoding IOCs and finding the onboard browser extension
Found myself analyzing ArechClient recently and needed a way to automatically decode out the C2 info from lots of samples. By the end of our work we also discovered that the browser extension being delivered by ArechClient is on board the client itself. The…
Original (new tab)
Check Point · Web page · Published 12 Dec
Pulling the Curtains on Azov Ransomware: Not a Skidsware but Polymorphic Wiper
Check Point Research (CPR) provides under-the-hood details of its analysis of the infamous Azov Ransomware Investigation shows that Azov is capable of modifying certain 64-bit executables to execute its own code Azov is designed to inflict impeccable damage…
Ransomware Malware Original (new tab)
lookout.com · Web page · Published 8 Apr
Beyond BITTER: MENA Civil Society Targeted in Hack-For-Hire Operation Linke
Original (new tab)
SentinelOne · Web page · Published 23 Apr
fast16 | Mystery ShadowBrokers Reference Reveals High-Precision Software Sabotage 5 Years Before Stuxnet
SentinelLABS has uncovered a previously undocumented cyber sabotage framework whose core components date back to 2005, tracked as fast16. fast16.sys selectively targets high-precision calculation software, patching code in memory to tamper with results. By…
Original (new tab)
Group-IB · Web page · Added 7 May
The footprints of Raccoon
In the summer of 2020, Group-IB specialists discovered a malware distribution campaign exploiting Telegram’s legitimate features. Analysis showed that the attackers used the technique to distribute Raccoon stealer, i.e. malware spread through the…
Malware Infostealers Original (new tab)
Kaspersky · Web page · Published 30 Apr
Silver Fox uses the new ABCDoor backdoor to target organizations in Russia and India
In December 2025, we detected a wave of malicious emails designed to look like official correspondence from the Indian tax service. A few weeks later, in January 2026, a similar campaign began targeting Russian organizations. We have attributed this activity…
Malware Original (new tab)
Check Point · Web page · Published 19 Jul
BYOS – Bundle Your Own Stealer
Check Point Research (CPR) provides an in-depth analysis of the new malware strain dubbed BundleBot spreading under the radar. BundleBot is abusing the dotnet bundle (single-file), self-contained format that results in very low or no static detection at all.…
Infostealers Original (new tab)
Check Point · Web page · Published 17 Nov
Malware Spotlight – Into the Trash: Analyzing LitterDrifter
Gamaredon, also known as Primitive Bear, ACTINIUM, and Shuckworm, is a unique player in the Russian espionage ecosystem that targets a wide variety of almost exclusively Ukrainian entities. While researchers often struggle to uncover evidence of Russian…
State-sponsored Malware Original (new tab)
Cisco Talos · Web page · Published 5 May
UAT-8302 and its box full of malware
Cisco Talos is disclosing UAT-8302, a sophisticated, China-nexus advanced persistent threat (APT) group targeting government entities in South America since at least late 2024 and government agencies in southeastern Europe in 2025. After successful…
State-sponsored Malware Original (new tab)

Added Wed 6 May

cert.orangecyberdefense.com · PDF · Added 6 May
Smoking Out an Affiliate
Ransomware Original (new tab)
Darktrace · Web page · Published 16 Apr
Inside ZionSiphon: Darktrace’s Analysis of OT Malware Targeting Israeli Water Systems
What is ZionSiphon? Darktrace recently analyzed a malware sample, which identifies itself as ZionSiphon. This sample combines several familiar host-based capabilities, including privilege escalation, persistence, and removable-media propagation, with…
Malware Original (new tab)
gdatasoftware.com · Web page · Published 17 Mar
HijackLoader: Free Games, Costly Consequences, and Loads of Malware
PiviGames, a popular Spanish gaming platform is well-known in the gaming community for providing download links to pirated PC games. Such a platform offers attractive content and it has built a reputation within the gaming community over the years. However,…
Malware Original (new tab)
Trend Micro · Web page · Published 3 Apr
Weaponizing Trust Signals: Claude Code Lures and GitHub Release Payloads
Anthropic inadvertently exposed internal Claude Code source material via a misconfigured npm package, which included approximately 512,000 lines of internal TypeScript and triggering rapid mirroring across GitHub. Within 24 hours, threat actors took advantage…
Infostealers Original (new tab)
Trend Micro · Web page · Published 21 Apr
Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories
Void Dokkaebi (aka Famous Chollima) has evolved beyond single-target social engineering into a self-propagating supply chain threat. A compromised developer’s repository becomes an infection vector for the next wave of victims, creating a worm-like…
Malware Original (new tab)
Bitsight · Web page · Published 31 Mar
Ransomware with a Twizt: Inside the Phorpiex Botnet
Phorpiex, also known as Trik, is a resilient and long-running botnet with a history dating back to 2011. While it has grabbed some headlines, its sustained presence and adaptability make it a subject of ongoing concern for the cybersecurity community.…
Ransomware Botnets and DDoS Original (new tab)
intel.breakglass.tech · Web page · Published 11 Apr
We Dumped a Live Kimsuky C2 and Recovered Every Stage of the Kill Chain: CHM Dropper, VBScript Stager, PowerSh
#Infrastructure: 79 Domains Across 5 IPs ##The DAOU Staging Server (27.102.137.38 — 37 domains) ##The Fast-Flux Farm (118.194.249.109 — 40 domains) ##The Naver Phishing Farm (27.102.137.150 — 12+ domains, LIVE) #Related Kimsuky Sample #Detection Guidance…
State-sponsored Malware Original (new tab)
hexastrike.com · Web page · Published 18 Apr
Cloned, Loaded, and Stolen: How 109 Fake GitHub Repositories Delivered SmartLoader and StealC
We identified 109 malicious GitHub repositories across 103 accounts that impersonate legitimate projects and redirect users to embedded ZIP files containing a LuaJIT-based SmartLoader stage. The campaign appears to be operated by a single threat actor or…
Malware Infostealers Original (new tab)
zynap.com · Web page · Published 24 Mar
Defensive Rootkits: Engineering Kernel-Level Malware Analysis from Ring 0
We are in the middle of the next transition. This time, the failures are silent. Modern malware is industrialized: sold as-a-service, rapidly iterated, and designed to scale. At the same time, defenders increasingly depend on automated pipelines. When those…
Malware Infostealers Original (new tab)
strikeready.com · Web page · Added 6 May
StrikeReady — AI-Powered Security Command Center
UNC1151 has operated with a higher operational tempo in 2025, and in this blog, Labs shows how to track this actor, by surfacing two clusters of activity, and tying it to previously attributed samples. Files that leverage anti-analysis techniques can often be…
State-sponsored Original (new tab)
Zscaler · Web page · Published 1 Apr
Anthropic Claude Code Leak
By Manisha Ramcharan Prajapati, Jithin Prajeev Nair, Avinash Kumar, Mallikarjun Piddannavar ThreatLabz discovers “Claude Code leak” lure that distributes Vidar and GhostSocks While monitoring GitHub for threats, ThreatLabz came across a “Claude Code leak”…
Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.