Research reports
1,224 reports from 387 publishers45 added in the past week
294 reports, newest added first
Added Sat 10 Oct
Darktrace Malware Analysis: Unpacking SnappyBee
The aim of this blog is to be an educational resource, documenting how an analyst can perform malware analysis techniques such as unpacking. This blog will demonstrate the malware analysis process against well-known malware, in this case SnappyBee. SnappyBee…
State-sponsoredMalware
Star Blizzard refines phishing and malware delivery with the RedFlick technique
Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a novel malware delivery technique that…
State-sponsoredMalwarePhishing
IBM X-Force Discovers New Sheriff Backdoor used to target Ukraine
IBM X-Force discovered a set of previously unknown malware (Sheriff backdoor) used in a cyber espionage attack against an entity within Ukraine’s defense sector in the first half of 2024. The threat actor used a popular news portal in Ukraine, ukr.net, to…
State-sponsoredMalware
GitHub - yankywilson/jdy-botnet-threat-analysis: Defensive CTI analysis of the JDY reconnaissance botnet (China-nexus, Volt Typhoon / KV lineage, MITRE G1017): MIPS64 implant reverse engineering, infrastructure enumeration, tiered intelligence reporting, Sigma/YARA detections, and a tasking decryptor. TLP:CLEAR.
A complete defensive analysis of the JDY botnet: reverse engineering of the implant, enumeration of its control infrastructure, three-tier intelligence reporting, deployable detections, and a working tasking decryptor. JDY is a China-nexus reconnaissance…
State-sponsoredMalwareBotnets and DDoS
Added Fri 9 Oct
XenoRAT-Malware-Analysis/Reports/XenoRAT_EN.md at main · Yavuzhanzgen/XenoRAT-Malware-Analysis
This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. XenoRAT Technical Analysis Report Static Analysis • Dynamic Analysis •…
Malware
Technical Analysis of 2CLoader
Important strings in 2CLoader are decrypted at runtime using an inlined bitwise XOR operation applied to global values. The key in the analyzed sample is 0x37 . Indirect system calls For the Nt* APIs listed below, 2CLoader prefers indirect system calls to…
Malware
Added Thu 8 Oct
$100k in Crypto Drained by the Underground Operation
Netskope Threat Labs analyzed a crypto-stealing operation that drains victims’ cryptocurrency exchange accounts. An Aotera/Tedy loader injects a Vidar-class stealer into a Windows process, which then launches Chrome or Edge and injects its scripts into the…
MalwareInfostealers
Introducing DOUBLECUP, a ClickFix Loader Delivering CountLoader and DeviceManager RATs
The DOUBLECUP panel provides multiple utilities to load an operator’s final payload. The first stage drops a steganographic PNG image into the browser’s cache, retrieves its hidden content, and executes the second stage. This second stage decrypts the final…
Malware
Added Wed 7 Oct
threat-research/ancient-botnet at main · ksi-digital/threat-research
We captured a botnet family that calls itself "ancient" in our SSH/Telnet honeypot. Between 2026-10-04 and 2026-10-05 we observed its delivery chain, three iterations of its dropper, and its C2 behaviour. We confirmed its C2 server live. We have not found a…
MalwareBotnets and DDoS
Added Tue 29 Sep
The Closed Quorum: Inside the first reported autonomous AI C2 implant
CLOSEDQUORUM, a malware binary discovered through Cisco Talos’ CAIRN project, exhibits fully autonomous command and control (C2). While we do not have confirmation of in-the-wild deployment, artifacts from the binary were used to connect the developer to…
Malware
Added Sat 26 Sep
Amadey-Malware-Analysis/Reports/Amadey_EN.md at main · Yavuzhanzgen/Amadey-Malware-Analysis
This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. Amadey Technical Analysis Report Static Analysis • Dynamic Analysis •…
Malware
RenEngine Loader and HijackLoader: Dual-Stage Attack Chain
Our analysis indicates that more than 400,000 global victims have been impacted, with the operation continuing to infect over 5,000 new victims per day. The threat actors blend compelling social‑engineering techniques with a stealthy, multi‑stage execution…
Malware
ValleyRAT-Malware-Analysis/Reports/ValleyRat-EN.md at main · Yavuzhanzgen/ValleyRAT-Malware-Analysis
This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. ValleyRAT Technical Analysis Report Static Analysis • Dynamic Analysis •…
Malware
The road to Xloader
Xloader is a stealer that was built on the FormBook malware family that first emerged in 2016; the rebranded Xloader was introduced in 2020. It is highly sophisticated malware that uses a combination of anti-analysis and obfuscation techniques, and it’s…
Malware
KoiLoader-Malware-Analysis/Reports/KoiLoader-EN.md at main · Yavuzhanzgen/KoiLoader-Malware-Analysis
This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. KoiLoader Technical Analysis Report Static Analysis • Dynamic Analysis •…
Malware
Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit
Acronis Threat Research Unit (TRU) uncovered a multinational campaign in which a Chinese-speaking threat actor, tracked as Red Heron, rapidly weaponized CVE-2026-60004 to compromise internet-facing instances of Gitea, a self-hosted source-code management…
MalwareVulnerabilities
XWorm-Malware-Analysis/Reports/XWorm_v3.1_Report_EN.md at main · Yavuzhanzgen/XWorm-Malware-Analysis
This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples have been analyzed in an isolated laboratory environment. XWorm V3.1 Malware T Static Analysis • Dynamic Analysis • Reverse…
Malware
XoriumStealer-Malware-Analysis/Reports/XoriumStealer-EN.md at main · Yavuzhanzgen/XoriumStealer-Malware-Analysis
This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. Xorium Stealer Malware T Static Analysis • Dynamic Analysis • Reverse…
Malware
Added Fri 25 Sep
Don’t Call Us, We’ll Call Your APIs
Following disclosure of the TraderTraitor attack against LayerZero Labs in April 2026, SentinelOne identified an additional victim with the same macOS backdoors. Our analysis explores the mechanics of these backdoors and the expanded targeting against a…
Malware
Added Wed 23 Sep
Beware the SparroWock: The backdoor that bites, the commands that catch
ESET Research’s ongoing monitoring of FamousSparrow has borne fruit once again. Our previous public report on FamousSparrow revealed that this China-aligned APT group had developed two new versions of its custom backdoor named SparrowDoor. This time, we…
Malware
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.