Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,281 reports398 publishers97 added in the past week

661–680 of 1,281 reports · page 34 of 65

Added Wed 29 Apr

Kroll · Web page · Published 19 Jan
Inside the SYSTEMBC Command-and-Control Server
Throughout Q2 and Q3 2023, Kroll has observed an increased use of the malicious “SYSTEMBC” tool to maintain access in a compromised network. SYSTEMBC was first observed in the wild in 2018 with its core functionality revolving around its ability to act as…
Original (new tab)
ESET · Web page · Added 29 Apr
MuddyWater: Snakes by the riverbank
ESET researchers have identified new MuddyWater activity primarily targeting organizations in Israel, with one confirmed target in Egypt. MuddyWater, also referred to as Mango Sandstorm or TA450, is an Iran-aligned cyberespionage group known for its…
State-sponsored Malware Original (new tab)
breakdev.org · Web page · Published 22 Nov
Evilginx 2.2 - Jolly Winter Update
Tis the season to be phishing! I've finally found some free time and managed to take a break to work on preparing a treat for all of you phishing enthusiasts out there. Just in time for the upcoming holiday season, I present you the chilly Evilginx update.…
Phishing Original (new tab)
Microsoft · Web page · Added 29 Apr
Audit Policy - Windows 10
Microsoft Build 2026 June 2-3, 2026 Go deep on real code and real systems in San Francisco and online Learn more We're no longer updating this content regularly. Check the Microsoft Product Lifecycle for information about how this product, service, techn
Original (new tab)
CrowdStrike · Web page · Added 29 Apr
Response When Minutes Matter: Rising Up Against Ransomware
This blog describes a recent incident that highlights the CrowdStrike Falcon® Complete™ team’s ability to act as an extension of a customer’s security team to quickly detect, triage and contain an active attacker before it was able to achieve its goal. In…
Ransomware Original (new tab)
Fortinet · Web page · Added 29 Apr
Recent Cyber Attacks: Major Incidents & Key Trends
Recent cyberattacks reflect that threat actors are no longer relying on isolated exploits. They are combining several tactics, like automation and social engineering, to achieve maximum impact. Here are a few cybersecurity trends that define how cyber risk…
Vulnerabilities Original (new tab)
redhat.com · Web page · Added 29 Apr
Chapter 7. System Auditing
The Linux Audit system provides a way to track security-relevant information on your system. Based on pre-configured rules, Audit generates log entries to record as much information about the events that are happening on your system as possible. This…
Original (new tab)
CrowdStrike · Web page · Added 29 Apr
What is a Downgrade Attack?
Maintaining good cybersecurity means protecting against multiple kinds of attack. One of these attack types is called a “downgrade attack.” This form of cryptographic attack is also called a “version rollback attack” or a “bidding-down attack.” In a downgrade…
Original (new tab)
Netskope · Web page · Published 26 Nov
Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading
In mid-September 2025, security researchers first identified a supply-chain compromise in the npm ecosystem, the original Shai-Hulud campaign. The first known compromised package was @ctrl/tinycolor version 4.1.1. Only two months later, a far more aggressive…
Supply chain Original (new tab)
Socket · Web page · Published 15 Sep
Popular Tinycolor npm Package Compromised in Supply Chain Attack Affecting 40 Packages
Socket proactively blocks malicious open source packages in your code. Install Update (September 16, 2025): This campaign has expanded significantly. Our follow up documents nearly 500 affected npm packages, including several open source CrowdStrike packages.…
Supply chain Original (new tab)
veracode.com · Web page · Published 9 Jun
Down the Rabbit Hole of Unicode Obfuscation
The rabbit–hole went straight on like a tunnel for some way, and then dipped suddenly down, so suddenly that Alice had not a moment to think about stopping herself before she found herself falling down a very deep well. – Alice’s Adventures in Wonderland by…
Original (new tab)
Koi · Web page · Published 6 Nov
GlassWorm Returns: New Wave Strikes as We Expose Attacker Infrastructure
Almost three weeks ago, we disclosed GlassWorm - the first self-propagating worm targeting VS Code extensions, using invisible Unicode characters to hide malicious code that literally disappears from code editors. On October 21, 2025, OpenVSX declared the…
Original (new tab)
Anthropic · Web page · Added 29 Apr
Disrupting the first reported AI-orchestrated cyber espionage campaign
We recently argued that an inflection point had been reached in cybersecurity: a point at which AI models had become genuinely useful for cybersecurity operations, both for good and for ill. This was based on systematic evaluations showing cyber capabilities…
State-sponsored Original (new tab)
Microsoft · Web page · Published 9 Dec
Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack
The Shai‑Hulud 2.0 supply chain attack represents one of the most significant cloud-native ecosystem compromises observed recently. Attackers maliciously modified hundreds of publicly available packages, targeting developer environments, continuous…
Supply chain Original (new tab)
accenture.com · Web page · Added 29 Apr
Turla/Belugasturgeon Compromises Government
Turla, identified internally by Accenture Cyber Threat Intelligence as Belugasturgeon, continues to target government organizations using custom malware, including updated legacy tools, designed to maintain persistence through overlapping backdoor access…
State-sponsored Malware Original (new tab)
falconfeeds.io · Web page · Added 29 Apr
Latest Cyber Threat Intelligence & Security Insights
The geopolitical landscape of 2026 has been fundamentally reshaped by the convergence of kinetic military operations and systemic digital suppression, a phenomenon most acutely visible in the ongoing tensions between the Islamic Republic of Iran, Israel, and…
Original (new tab)
breakdev.org · Web page · Published 14 Sep
Evilginx 2.4 - Gone Phishing
Welcome back everyone! I can expect everyone being quite hungry for Evilginx updates! I am happy to announce that the tool is still kicking. It's been a while since I've released the last update. This blog tells me that version 2.3 was released on January…
Phishing Original (new tab)
Trend Micro · Web page · Added 29 Apr
Ransomware Spotlight: Ransomhub
The following section details the initial infection chain observed from RansomHub activity as illustrated in Figure 1. Initial Access The RansomHub ransomware group use spear-phishing voice scams for initial access. The cybercriminals use social engineering…
Ransomware Original (new tab)
Socket · Web page · Published 31 Jan
GlassWorm Loader Hits Open VSX via Developer Account Compromise
Socket proactively blocks malicious open source packages in your code. Install Socket’s Threat Research team identified a developer-compromise supply chain attack distributed via the Open VSX Registry, specifically a compromise of the developer’s publishing…
Malware Original (new tab)
Infosec Institute · Web page · Published 16 Apr
Spoof Using Right to Left Override (RTLO) Technique - InfoSec Resources
In this article we will learn about the one of the most overlooked spoofing mechanisms, known as right to left override (RTLO). What is RTLO? RIGHT TO LEFT OVERRIDE is a Unicode mainly used for the writing and the reading of Arabic or Hebrew text. Unicode has…
Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.