Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,281 reports398 publishers97 added in the past week

581–600 of 1,281 reports · page 30 of 65

Added Wed 6 May

Darktrace · Web page · Published 26 Mar
Tracking & Detecting GhostSocks Malware
Software supply-chain attacks now represent the primary threat shaping the 2026 security landscape. Rather than relying on exploits at the perimeter, attackers are targeting the connective tissue of modern engineering environments: package managers, CI/CD…
Malware Supply chain Original (new tab)
Huntress · Web page · Published 4 Mar
“Malware, from the Outside!”: How a Threat Actor Used Fake OpenClaw Installers to Infect Systems with GhostSocks and Information Stealers
Special thanks to Greig Bailey for their effort in triaging and responding to this activity, and Aaron Deal for his tireless review and edits of this blog. Summary Information stealers continue to be an initial access vector for severe attacks against…
Malware Infostealers Original (new tab)
Trend Micro · Web page · Published 4 May
Quasar Linux (QLNX) – A Silent Foothold in the Supply Chain: Inside a Full-Featured Linux RAT With Rootkit, PAM Backdoor, Credential Harvesting Capabilities
Quasar Linux RAT (QLNX) is a comprehensive Linux implant that combines remote access capabilities with advanced evasion, persistence, keylogging, and credential harvesting features. The malware carries embedded C source code for both its PAM backdoor and…
Malware Phishing Supply chain Original (new tab)
zanezhub.github.io · Web page · Published 19 Apr
WannaCry Malware Analysis - How YOU Could have Saved the World ꩜
Everyone knows and has heard about the WannaCry ransomware. One of the biggests and most well known attacks to ever happen in cybersecurity, the range was so big that even people outside of the cybersecurity community knew about it. WannaCry? :’( If somehow…
Malware Original (new tab)
Gen Digital · Web page · Added 6 May
When Malware Authors Study Algebra: The Group Theory Inside Bedep's DGA
TLDR: Bedep was a malware family active mainly in 2014 and 2015 that used an unusually sophisticated domain generation algorithm, or DGA, to hide its command-and-control infrastructure. Instead of relying only on the date, it used real foreign exchange rates…
Malware Original (new tab)
orangecyberdefense.com · Web page · Published 15 Apr
SmokedHam and Qilin Threats
Smoking out an affiliate: SmokedHam, Qilin, a few Google ads and some bossware TL;DR In early 2026, Orange Cyberdefense responded to several incidents delivering the SmokedHam backdoor; In at least one case, the infection chain resulted in the deployment of…
Ransomware Original (new tab)

Added Tue 5 May

Group-IB · Web page · Added 5 May
The Darker Things
Today, on November 3, BlackMatter gang announced it was shutting its Ransomware-as-a-Service program due to the “pressure from the authorities”. However, it doesn’t mean that BlackMatter’s affiliates will stop malicious activity. They will most likely join…
Ransomware Original (new tab)
redteam.pl · Web page · Added 5 May
Sodinokibi / REvil / Maze ransomware (TTPs & IOC)
In general Web Share API [https://w3c.github.io/web-share/] allows users to share links from the browser via 3rd party applications (e.g. mail and messaging apps). The problem is that file: scheme is allowed and when a website points to such URL unexpected…
Ransomware Original (new tab)
cylance.com · Web page · Added 5 May
Ending Cyber Risk with Aurora Endpoint Security - Arctic Wolf
Arctic Wolf®, the leader in security operations, has acquired Cylance, a pioneer of AI-based endpoint security. With this acquisition, Arctic Wolf ushers in a new era of simplicity and efficacy to the endpoint security market that will deliver the security…
Original (new tab)
BleepingComputer · Web page · Published 24 Dec
Maze Ransomware Releases Files Stolen from City of Pensacola
The actors behind the Maze Ransomware have released 2GB of files that were allegedly stolen from the City of Pensacola during their ransomware attack. Earlier this month, the City of Pensacola was hit with a ransomware attack that impacted the city's email…
Ransomware Original (new tab)
certego.github.io · Web page · Added 5 May
Lumma Stealer
Reading tip: Clicking on the image allows viewing it in full resolution for improved readability. Summary Introduction Lumma Stealer overview Global Threat Record growth Campaigns Persistence Defense evasion Telegram as marketplace for stolen logs First stage…
Infostealers Original (new tab)
Group-IB · Web page · Added 5 May
We see you, Gozi
The ISFB Trojan also known as Gozi ISFB first appeared in 2014. It is based on Gozi, which was released in 2006 and developed by Russian threat actors. Gozi was designed to collect network traffic and steal credentials from browsers and email clients. It has…
Malware Original (new tab)
threatvector.cylance.com · Web page · Published 1 May
Blog | Arctic Wolf
Updated May 1 Anthropic has officially launched Claude Security, moving its AI‑driven code vulnerability detection, validation, and patching capabilities from a limited research preview into public beta. Improving software security before code ships is a…
Original (new tab)
Group-IB · Web page · Added 5 May
Craxs Rat, the master tool behind fake app scams and banking fraud
Since April 2023, a series of scams involving fake Android apps have targeted Singapore. These fake apps are banking trojans used to harvest victims’ banking credentials and personal information, as well as to take control of their devices. In this specific…
Malware Mobile Original (new tab)
Medium · Web page · Published 17 Jul
Dissecting the ClickFix User-Execution Attack and Its Sophisticated Persistence via ADS
The following analysis presents how an adversary tackled the challenge of malware delivery using a set of techniques that stand out due to their specificity and operational precision. The post is not intended to comprehensively describe the entire campaign or…
Original (new tab)
Group-IB · Web page · Added 5 May
Cat’s out of the bag: Lynx Ransomware-as-a-Service
Ransomware remains one of the most profitable cyberthreats, with new variants and business models evolving faster than many organizations can respond. Fueled by the expansion of Ransomware-as-a-Service (RaaS), the proliferation of stolen data on Dedicated…
Ransomware Original (new tab)
logpoint.com · Web page · Added 5 May
Emerging Threat: AgentTesla – A Review and Detection Strategies
It has been spreading rapidly in the wild with CISA listing it in the Top Malware Strains list for the year 2021 and it still is in the top 10 list on MalwareBazaar as of March 2023. The operators of AgentTesla are providing Malware-as-a-Service with various…
Malware Original (new tab)
notion.so · Web page · Added 5 May
[S2W LAB] Analysis of Clop Ransomware suspiciously related to the Recent Incident
랜섬노트 (Ransom Note) 확인결과, 다크웹 상에서 유출 데이터를 공개하는 기존 Clop 랜섬웨어의 유출 사 이트에 있는 컨택 포인트(Email)와 동일함을 확인 동일한 서명 정보를 갖는 Clop Ransomware를 Virustotal에서 추가 발견 (Build time: 11월 21일) 정확한 유포 방식은 현재 조사 중으로 확인된 바 없으나 과거 Clop Ransomware 공격 사례
Ransomware Original (new tab)
forum.malekal.com · Web page · Published 6 Mar
Virus Ukash Gendarmerie Absence twexx32.dll
Aide à la désinfection pour supprimer les virus, adwares, ransomwares, trojans. Modérateurs : Mods Windows, Helper Surfcop Virus Ukash Gendarmerie Absence twexx32.dll par Surfcop » 06 mars 2012 21:48 Bonsoir à tous, Voilà le pc de la boîte s'est fait infecté…
Original (new tab)
Group-IB · Web page · Added 5 May
IcedID: new malware version
What did malware analysts think when they first heard the words IcedID and BokBot? Undoubtedly things like: web injects, proxy servers, quick version updates… The updates were sometimes so fast that while analysts were studying the current version, a new one…
Malware Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.