Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,259 reports391 publishers75 added in the past week

41–60 of 1,259 reports · page 3 of 63

Added Sun 25 Oct

BlueVoyant · Web page · Added 25 Oct
Lorem Ipsum Revisited: ClickFix Pivot & Rapid Brigantine
What Happened? BlueVoyant Security Operations Center (SOC) and Threat Fusion Cell (TFC) researchers have been tracking an active ClickFix campaign that manipulates users into believing their web browser requires a security update. If the user complies, the…
Malware Original (new tab)
JFrog · Web page · Published 22 Jun
From PostCSS Masquerading to Windows RAT
The package name is not random. The legitimate postcss-selector-parser package is widely used across the JavaScript build ecosystem, with npm reporting more than 150M weekly downloads. postcss-minify-selector-parser is not a classic one-character typo.…
Malware Supply chain Original (new tab)
Lumen Black Lotus Labs · Web page · Added 25 Oct
Showboat Malware: Emerging Threats Targeting Telecom Providers
Black Lotus Labs®, the threat research team at Lumen, has uncovered a previously unreported Linux malware family called Showboat, used in a campaign targeting telecommunications organizations across multiple regions. In this post, we break down how the…
Malware Original (new tab)
Dutch National Police · Web page · Published 18 Jun
International law enforcement initiate hunt on malware group SocGholish
In Operation Endgame, a major operation this week disrupted a key infection chain used by cybercriminals. Within an international cooperation, 14.971 websites infected with SocGholish malware were remediated. This malware is used by a criminal group that…
Malware Takedowns and arrests Original (new tab)
patreon.com · Web page · Published 9 Dec
Live Stream VOD: The Many Faces of CryptBot
If you are just getting started with reverse engineering this the place to start. In this tutorial we provide an overview the current setup that we currently run, this is also the same setup used in all of our live streams and tutorials. About FlareVM If you…
Original (new tab)
F6 · Web page · Published 9 Apr
Восточный почерк: исследуем кибератаку азиатской группировки на российскую компанию
В этом блоге мы представили результаты исследования атаки на одну из российских производственных компаний, которую аналитики Центра кибербезопасности F6 обнаружили и локализовали в конце февраля 2026 года. Первоначальный доступ, полученный через…
Original (new tab)
Team Cymru · Web page · Published 27 Jan
Taking Down Emotet
How Team Cymru Leveraged Visibility and Relationships to Coordinate Community Efforts On Tuesday, January 26, 2021, the number of available controllers talking like Emotet Tier 1 controllers dropped to zero. Team Cymru’s monitoring confirmed that they dropped…
Takedowns and arrests Original (new tab)
bluecyber.hashnode.dev · Web page · Published 14 Mar
PlugX: Bad guy disguises as an msi file
Use msitool to extract msidump -s -t mal.msi . In File.idt , we can see that there are 3 embed file. These files are extracted to %LOCALAPPDATA\kjnBsLsJo\ Upon running, the program opens an pdf file called Meeting Invitation.pdf 2. DLL Side-loading technique…
Original (new tab)
Team Cymru · Web page · Published 3 Nov
Webinject Panel Administration: A Vantage Point into Multiple Threat Actor Campaigns
The contents of this blog were shared with Team Cymru’s community partners in the first half of 2021 and were subsequently presented by our analysts at RISE Las Vegas (September 2021). Much has been written about the role of webinjects in the evolution of…
Original (new tab)
ESET · Web page · Added 25 Oct
FishMonger’s arsenal upgraded: SprySOCKS for Windows
ESET researchers have discovered two as-yet undocumented Windows variants of SprySOCKS, a previously Linux-only backdoor reportedly used by FishMonger, the group believed to be operated by a Chinese contractor named I‑SOON. While we initially discovered the…
Malware Original (new tab)
qurium.org · Web page · Added 25 Oct
When Your Smart TV Stops Being Yours
In May 2026 the website of Arab Reporters for Investigative Journalism (ARIJ) was targeted by a large-scale scraping event on the site, receiving traffic from approximately 1.35 million unique IP addresses, spread across more than 7,300 autonomous systems and…
Original (new tab)
SecurityScorecard · Web page · Added 25 Oct
Resources - SecurityScorecard
PHP2Shell Customer Advisory: CVE-2026-109618 and CVE-2026-109619 Remediation Guide SecurityScorecard’s PHP2Shell advisory covers CVE-2026-109618 and CVE-2026-109619: SecurityScorecard patched its affected PHP site on release day and found no exploitation. See…
Vulnerabilities Original (new tab)
Synacktiv · Web page · Added 25 Oct
Etude de cas : Comment Hunters International et ses affiliés ciblent
Hunters International est un groupe de Ransomware-as-a-Service (RaaS) apparu en octobre 2023, après avoir acquis le code source et l'infrastructure du groupe Hive, aujourd'hui démantelé. À ce jour, selon les statistiques publiées, Hunters International et ses…
Ransomware Original (new tab)
stopmalvertising.com · Web page · Added 25 Oct
The #c3284d# Malware Network - Stats.php
08. this .seed = test + this .M; 10. return ( this .seed * this .oneOverM); 12. function RandomNumberGenerator(unix){ 13. var d = new Date(unix * 1000); 14. var s = Math.ceil(d.getHours() / 3); 15. this .seed = 2345678901 + (d.getMonth() * 0xF
Malware Original (new tab)
QiAnXin · Web page · Added 25 Oct
奇安信威胁情报中心
On December 23, 2025, the renowned document editor EmEditor officially released an announcement stating that between December 19th and 22nd, its official website installation packages were subjected to a supply chain attack. The MSI installation packages were…
Original (new tab)
derp.ca · Web page · Published 16 May
Vidar v1.5 in Go: same family, new language, heavy sandbox checks
Vidar is a name most infostealer trackers know well -- an Arkei descendant that has been snatching browser credentials and crypto wallets since 2018. It usually ships as a .NET binary or a C++ PE. The v1.5 sample we pulled from Triage on May 13, 2026 is…
Infostealers Original (new tab)
WIRED · Web page · Published 1 Feb
Inside Trickbot, Russia’s Notorious Ransomware Gang
Internal messages WIRED has viewed shed new light on the operators of one of the world's biggest botnets. Photograph: katleho Seisa/Getty Images When the phones and computer networks went down at Ridgeview Medical Center’s three hospitals on October 24, 2020,…
Ransomware Original (new tab)
Varonis · Web page · Published 22 Oct
StealC Is Back, and This Time It's a RAT
In June, Europol tore down StealC, a prominent infostealer, as part of Operation Endgame. International authorities seized 326 servers and 142 domains, recovered more than 25 million stolen credentials from 385,000 infected machines, and pulled the plug on…
Malware Infostealers Takedowns and arrests Original (new tab)
Team Cymru · Web page · Published 19 May
Tracking BokBot (IcedID) Infrastructure
BokBot (also known as IcedID) started life as a banking trojan using man-in-the-browser attacks to steal credentials from online banking sessions and initiate fraudulent transactions. Over time, the operator(s) of BokBot have also developed its use as a…
Malware Original (new tab)
abuse.ch · Web page · Added 25 Oct
MalwareBazaar - GCleaner
Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.