Research reports
1,224 reports from 387 publishers45 added in the past week
166 reports, newest added first
Added Wed 3 Jun
Detecting Nimbus Manticore and their sideloading infection chains
During a recent incident, we identified a sophisticated sideloading infection chain dropping a custom implant for data exfiltration. Further analysis allowed us to attribute the activity to the Iran-nexus APT group Nimbus Manticore, also tracked as UNC1549…
State-sponsoredMalware
Added Fri 22 May
Mustang Panda Strikes India and South Korea with Updated LOTUSLITE Backdoor in Espionage Campaign
China-linked Mustang Panda targets India banks & S.Korea policy via LOTUSLITE backdoor 22-Apr-2026 4 min read A China-linked threat group known as Mustang Panda has launched a dual‑faced espionage campaign targeting India’s banking sector and South Korea’s…
State-sponsoredMalware
LOTUSLITE: Targeted espionage leveraging geopolitical themes
Acronis Threat Research Unit (TRU) observed a targeted malware campaign against U.S. government entities leveraging a politically themed ZIP archive containing a loader executable and a malicious dynamic-link library (DLL). The executable is used to sideload…
State-sponsoredMalware
MustangPanda New Backdoor LotusLite
Chinese state-sponsored APT Mustang Panda has added a new undocumented C++ backdoor LotusLite to its arsenal targets the financial sectors in India , South Korea and U.S . The analyzed sample is a fully-featured Windows backdoor DLL disguised as a WPS Office…
State-sponsoredMalware
Red Shadows over Yangon: Analyzing TONESHELL Malware from Mustang Panda’s Campaign Against Myanmar
This report details a targeted malware campaign attributed to Mustang Panda, a Chinese APT group, leveraging a supposed compromised Myanmar embassy email to deliver malware against Myanmar’s entities. The campaign begins with a phishing email containing a…
State-sponsoredMalware
Added Thu 21 May
DragonBreath: Dragon in the Kernel
Dragoncore_k.sys & Zhengzhou 403 Network Technology Co., Ltd. 0-Day BYOVD Vulnerability | Shell Company Analysis | Dragon Breath APT-Q-27 | APT31 Personnel Nexus Field Value Report Date April 22, 2026 Authors Alex Necula, Ellis Stannard TLP Classification…
State-sponsoredVulnerabilities
Added Tue 19 May
Kazuar: Anatomy of a nation-state botnet
Kazuar, a sophisticated malware family attributed to the Russian state actor Secret Blizzard, has been under constant development for years and continues to evolve in support of espionage-focused operations. Over time, Kazuar has expanded from a relatively…
State-sponsoredMalwareBotnets and DDoS
Added Tue 12 May
Hunting Lazarus Part VII: The Server That Was Not Just FTP
This is Part VII of the "Hunting Lazarus" series. The earlier installments documented the Contagious Interview campaign run by Lazarus Group – the DPRK-linked APT – which targets cryptocurrency and Web3 developers with fake job interviews, fabricated company…
State-sponsored
Added Sat 9 May
PlugX : Mustang Panda APT
Mustang Panda is a China-linked advanced persistent threat (APT) group engaged in sustained cyber espionage operations, primarily targeting government entities, diplomatic organizations, and NGOs. The group relies on a consistent toolset that is regularly…
State-sponsoredMalware
The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor
In mid-2025, we identified a malicious driver file on computer systems in Asia. The driver file is signed with an old, stolen, or leaked digital certificate and registers as a mini-filter driver on infected machines. Its end-goal is to inject a backdoor…
State-sponsoredMalware
Added Thu 7 May
Lazarus Group Uses Git Hooks To Hide Malware
The OpenSourceMalware team has spotted a fresh twist in the DPRK's Contagious Interview / TaskJacker playbook: the operators have pivoted away from stuffing their stage-2 loader into .vscode/tasks.json , package.json postinstall scripts, or fake .woff2 font…
State-sponsoredMalware
Malware Spotlight – Into the Trash: Analyzing LitterDrifter
Gamaredon, also known as Primitive Bear, ACTINIUM, and Shuckworm, is a unique player in the Russian espionage ecosystem that targets a wide variety of almost exclusively Ukrainian entities. While researchers often struggle to uncover evidence of Russian…
State-sponsoredMalware
UAT-8302 and its box full of malware
Cisco Talos is disclosing UAT-8302, a sophisticated, China-nexus advanced persistent threat (APT) group targeting government entities in South America since at least late 2024 and government agencies in southeastern Europe in 2025. After successful…
State-sponsoredMalware
Added Wed 6 May
We Dumped a Live Kimsuky C2 and Recovered Every Stage of the Kill Chain: CHM Dropper, VBScript Stager, PowerSh
#Infrastructure: 79 Domains Across 5 IPs ##The DAOU Staging Server (27.102.137.38 — 37 domains) ##The Fast-Flux Farm (118.194.249.109 — 40 domains) ##The Naver Phishing Farm (27.102.137.150 — 12+ domains, LIVE) #Related Kimsuky Sample #Detection Guidance…
State-sponsoredMalware
StrikeReady — AI-Powered Security Command Center
UNC1151 has operated with a higher operational tempo in 2025, and in this blog, Labs shows how to track this actor, by surfacing two clusters of activity, and tying it to previously attributed samples. Files that leverage anti-analysis techniques can often be…
State-sponsored
Added Tue 5 May
Matryoshka : Variant of ROKRAT, APT37 (Scarcruft)
- Scarcruft(a.k.a APT37, Group123)는 북한 배후로 알려진 위협그룹으로 2012년부터 현재까지 지속 적인 공격 활동이 포착되고 있음 Overview Press enter or click to view image in full size
State-sponsored
Cybercriminal greeners from Iran attack companies worldwide for financial gain
Group-IB, a global threat hunting and intelligence company headquartered in Singapore, has detected financially motivated attacks carried out by Iranian newbie threat actors in June. The attackers used Dharma ransomware and a mix of publicly available tools…
RansomwareState-sponsored
Added Fri 1 May
North Korea-linked APT attack found disguised as a digital asset wallet service customer center
Detailed content body title North Korea-linked APT attack found disguised as a digital asset wallet service customer center! Malware analysis report by pill 4 2022. 2. 16. 14:55 main text Hello? This is the East Security Security Response Center (ESRC). A…
State-sponsored
Iranian APT group ‘MuddyWater’ Adds Exploits to Their Arsenal
In recent months, there has been considerable unrest in the Iranian cybersphere. Highly sensitive data about Iranian APT groups were leaked, exposing abilities, strategies, and attack tools. The main medium for this leak was a telegram channel. The first leak…
State-sponsoredVulnerabilities
Group-IB’s new report on Silence: Damage from Silence APT operations increases fivefold
Group-IB, a Singapore-based cybersecurity company that specializes in preventing cyberattacks, has exposed the most recent campaigns carried out by Silence, a Russian-speaking APT group, in the new “Silence 2.0: Going Global” report. Group-IB experts…
State-sponsored
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.