Research reports
1,224 reports from 387 publishers45 added in the past week
50 reports, newest added first
Added Sat 10 Oct
Darktrace Malware Analysis: Unpacking SnappyBee
The aim of this blog is to be an educational resource, documenting how an analyst can perform malware analysis techniques such as unpacking. This blog will demonstrate the malware analysis process against well-known malware, in this case SnappyBee. SnappyBee…
State-sponsoredMalware
Star Blizzard refines phishing and malware delivery with the RedFlick technique
Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a novel malware delivery technique that…
State-sponsoredMalwarePhishing
IBM X-Force Discovers New Sheriff Backdoor used to target Ukraine
IBM X-Force discovered a set of previously unknown malware (Sheriff backdoor) used in a cyber espionage attack against an entity within Ukraine’s defense sector in the first half of 2024. The threat actor used a popular news portal in Ukraine, ukr.net, to…
State-sponsoredMalware
GitHub - yankywilson/jdy-botnet-threat-analysis: Defensive CTI analysis of the JDY reconnaissance botnet (China-nexus, Volt Typhoon / KV lineage, MITRE G1017): MIPS64 implant reverse engineering, infrastructure enumeration, tiered intelligence reporting, Sigma/YARA detections, and a tasking decryptor. TLP:CLEAR.
A complete defensive analysis of the JDY botnet: reverse engineering of the implant, enumeration of its control infrastructure, three-tier intelligence reporting, deployable detections, and a working tasking decryptor. JDY is a China-nexus reconnaissance…
State-sponsoredMalwareBotnets and DDoS
Added Fri 9 Oct
XenoRAT-Malware-Analysis/Reports/XenoRAT_EN.md at main · Yavuzhanzgen/XenoRAT-Malware-Analysis
This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. XenoRAT Technical Analysis Report Static Analysis • Dynamic Analysis •…
Malware
Technical Analysis of 2CLoader
Important strings in 2CLoader are decrypted at runtime using an inlined bitwise XOR operation applied to global values. The key in the analyzed sample is 0x37 . Indirect system calls For the Nt* APIs listed below, 2CLoader prefers indirect system calls to…
Malware
Added Thu 8 Oct
$100k in Crypto Drained by the Underground Operation
Netskope Threat Labs analyzed a crypto-stealing operation that drains victims’ cryptocurrency exchange accounts. An Aotera/Tedy loader injects a Vidar-class stealer into a Windows process, which then launches Chrome or Edge and injects its scripts into the…
MalwareInfostealers
Introducing DOUBLECUP, a ClickFix Loader Delivering CountLoader and DeviceManager RATs
The DOUBLECUP panel provides multiple utilities to load an operator’s final payload. The first stage drops a steganographic PNG image into the browser’s cache, retrieves its hidden content, and executes the second stage. This second stage decrypts the final…
Malware
Added Wed 7 Oct
threat-research/ancient-botnet at main · ksi-digital/threat-research
We captured a botnet family that calls itself "ancient" in our SSH/Telnet honeypot. Between 2026-10-04 and 2026-10-05 we observed its delivery chain, three iterations of its dropper, and its C2 behaviour. We confirmed its C2 server live. We have not found a…
MalwareBotnets and DDoS
Added Tue 29 Sep
The Closed Quorum: Inside the first reported autonomous AI C2 implant
CLOSEDQUORUM, a malware binary discovered through Cisco Talos’ CAIRN project, exhibits fully autonomous command and control (C2). While we do not have confirmation of in-the-wild deployment, artifacts from the binary were used to connect the developer to…
Malware
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.