Research reports
1,224 reports from 387 publishers45 added in the past week
143 reports, newest added first
Added Thu 23 Jul
INC Ransom: Infrastructure Analysis, Operational Tradecraft, and Detection Opportunities
The study was prepared in cooperation with Piotr Chęciński. Executive Summary INC Ransom is an active cybercriminal group operating under the Ransomware-as-a-Service (RaaS) model and has been observed since mid-2023. The group primarily conducts double…
Ransomware
GitHub - muhammadzidane632/Hopeless: Ransomware Wiper Bootkit Hybrid (Real Author Only Zdn2Pwn) Look at Date the Initial Commit
A C-based malware research framework designed to demonstrate advanced multi-stage system compromise techniques on Windows. This project is intended solely for educational purposes, security research, and understanding offensive techniques in a controlled…
RansomwareMalware
Added Thu 9 Jul
Threat Alert: TeamPCP, An Emerging Force in the Cloud Native and Ransomware Landscape
No excerpt available.
Ransomware
Added Thu 28 May
MedusaLocker v3 Ransomware Explained
Howler Cell investigated the new v3 variant of MedusaLocker, the well-known ransomware family active since late 2019. This ransomware is also known as the BabyLockerKZ variant. Industry Impact Healthcare, Finance, Government, and Manufacturing sectors are…
Ransomware
Added Fri 22 May
Payload Ransomware: In-depth technical analysis
Payload is a cross-platform ransomware family with both Windows and Linux variants. In this blog, we will primarily focus on the Windows variant and its behavior in detail. Payload provides extensive support for command-line arguments, suggesting it can be…
Ransomware
Added Wed 20 May
Payload Ransomware: In-depth technical analysis
Payload is a cross-platform ransomware family with both Windows and Linux variants. In this blog, we will primarily focus on the Windows variant and its behavior in detail. Payload provides extensive support for command-line arguments, suggesting it can be…
Ransomware
Added Thu 14 May
A Slopoly start to AI-enhanced ransomware attacks
In early 2026, IBM X-Force discovered a likely AI-generated novel malware which we are dubbing “Slopoly,” used during a ransomware attack. The operators are part of a group tracked as Hive0163, whose main objective is extortion through large-scale data…
RansomwareMalwareAI
Added Sat 9 May
SafePay ransomware explained: IOCs, TTPs, and defense strategies
Observing SafePay ransomware, ThreatLocker® Intelligence has seen Mutexes being created to prevent additional copies of the ransomware running on already affected/encrypted devices. Typically, a different Mutex would be used for each victim. The switch to a…
Ransomware
Added Thu 7 May
Leaks of Conti Ransomware Group Paint Picture of a Surprisingly Normal Tech Start-Up… Sort Of
You’ve probably heard of the Conti ransomware group. After their 2020 emergence, they’ve accumulated at least 700 victims, where by “victims” we mean ‘big fish’ corporations with millions of dollars in revenue; unlike your average neighborhood ransomware…
Ransomware
“Troldesh” – New Ransomware from Russia
“Troldesh”, aka Encoder.858 or Shade, is a Trojan and a crypto-ransomware variant created in Russia and spread all over the world. Troldesh is based on so-called encryptors that encrypt all of the user’s personal data and extort money to decrypt the files.…
RansomwareMalware
Pulling the Curtains on Azov Ransomware: Not a Skidsware but Polymorphic Wiper
Check Point Research (CPR) provides under-the-hood details of its analysis of the infamous Azov Ransomware Investigation shows that Azov is capable of modifying certain 64-bit executables to execute its own code Azov is designed to inflict impeccable damage…
RansomwareMalware
Added Wed 6 May
Ransomware with a Twizt: Inside the Phorpiex Botnet
Phorpiex, also known as Trik, is a resilient and long-running botnet with a history dating back to 2011. While it has grabbed some headlines, its sustained presence and adaptability make it a subject of ongoing concern for the cybersecurity community.…
RansomwareBotnets and DDoS
SmokedHam and Qilin Threats
Smoking out an affiliate: SmokedHam, Qilin, a few Google ads and some bossware TL;DR In early 2026, Orange Cyberdefense responded to several incidents delivering the SmokedHam backdoor; In at least one case, the infection chain resulted in the deployment of…
Ransomware
Added Tue 5 May
The Darker Things
Today, on November 3, BlackMatter gang announced it was shutting its Ransomware-as-a-Service program due to the “pressure from the authorities”. However, it doesn’t mean that BlackMatter’s affiliates will stop malicious activity. They will most likely join…
Ransomware
Sodinokibi / REvil / Maze ransomware (TTPs & IOC)
In general Web Share API [https://w3c.github.io/web-share/] allows users to share links from the browser via 3rd party applications (e.g. mail and messaging apps). The problem is that file: scheme is allowed and when a website points to such URL unexpected…
Ransomware
Maze Ransomware Releases Files Stolen from City of Pensacola
The actors behind the Maze Ransomware have released 2GB of files that were allegedly stolen from the City of Pensacola during their ransomware attack. Earlier this month, the City of Pensacola was hit with a ransomware attack that impacted the city's email…
Ransomware
Cat’s out of the bag: Lynx Ransomware-as-a-Service
Ransomware remains one of the most profitable cyberthreats, with new variants and business models evolving faster than many organizations can respond. Fueled by the expansion of Ransomware-as-a-Service (RaaS), the proliferation of stolen data on Dedicated…
Ransomware
[S2W LAB] Analysis of Clop Ransomware suspiciously related to the Recent Incident
랜섬노트 (Ransom Note) 확인결과, 다크웹 상에서 유출 데이터를 공개하는 기존 Clop 랜섬웨어의 유출 사 이트에 있는 컨택 포인트(Email)와 동일함을 확인 동일한 서명 정보를 갖는 Clop Ransomware를 Virustotal에서 추가 발견 (Build time: 11월 21일) 정확한 유포 방식은 현재 조사 중으로 확인된 바 없으나 과거 Clop Ransomware 공격 사례
Ransomware
ATT&CKing ProLock Ransomware
The success of enterprise ransomware attacks has motivated more and more threat actors to join the game. One of these new players is ProLock ransomware. The locker emerged in March 2020 as the successor of PwndLocker, which began operating in late 2019 and…
Ransomware
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.