Research reports
TopicAll topics
PublisherAll publishers
- All publishers1,281
- Check Point99
- DataBreaches.net51
- GitHub50
- MITRE ATT&CK44
- Mandiant (Google)33
- Microsoft31
- Group-IB29
- Recorded Future22
- Unit 4221
- ETDA Threat Group Cards20
- Medium20
- Trend Micro20
- CISA18
- ESET17
- Malpedia15
- Team Cymru15
- ANSSI (CERT-FR)13
- Intezer13
- US Department of Justice13
- Cisco Talos12
- FBI IC312
- Virus Bulletin11
- PhishLabs10
- The Hacker News10
- The Record10
- Elastic Security Labs9
- Intrinsec9
- SecurityScorecard9
- Cybernews8
- Kaspersky8
SortNewest added
721–740 of 1,281 reports · page 37 of 65
Added Thu 23 Apr
ANY.RUN · Web page · Published 14 Apr
When Trust Becomes a Weapon: Google Cloud Storage Phishing Deploying Remcos RAT
Modern phishing campaigns increasingly abuse legitimate services. Cloud platforms, file-sharing tools, trusted domains, and widely used SaaS applications are now part of the attacker’s toolkit. Instead of breaking trust, attackers borrow it. This shift…
US Department of Justice · Web page · Published 8 Nov
Ukrainian Arrested and Charged with Ransomware Attack on Kaseya
The Justice Department announced today recent actions taken against two foreign nationals charged with deploying Sodinokibi/REvil ransomware to attack businesses and government entities in the United States. An indictment unsealed today charges Yaroslav…
Check Point · Web page · Published 28 Jan
Deep into the SunBurst Attack
During the week of December 13th, we witnessed what many are calling one of the biggest cyberattacks in recent times. SunBurst, the malware installed on SolarWinds’ Orion product, perpetrated what seems like a nation-state sponsored supply chain attack, and…
Cybernews · Web page · Published 14 Mar
New destructive wiper malware deployed in Ukraine
Cybersecurity company ESET warned about the discovery of a 3rd destructive wiper malware deployed in Ukraine. ESET first observed this new malware dubbed CaddyWiper on Monday, around 9h38 UTC. CaddyWiper erases user data and partition information from…
moonlock.com · Web page · Published 2 Mar
Fake VCs target crypto talent
In a new investigation, Moonlock Lab has been tracking a malware campaign targeting cryptocurrency and Web3 professionals. The threat actors operate through fabricated venture capital identities, engage victims on LinkedIn with tailored job or partnership…
Cybernews · Web page · Published 7 Oct
Steam, Riot Games hit by disruptions: massive DDoS attack suspected
By Don't miss our latest stories on Google News. Add us as your Preferred Source on Google Multiplayer gamers on different platforms have experienced service outages and disruptions simultaneously. The cybersecurity community suspects a major distributed…
DataBreaches.net · Web page · Published 1 Jun
Babuk re-organizes as Payload Bin, offers its first leak
At the end of April, threat actors known as Babuk indicated that they were closing up shop and switching to a different model: Babuk changes direction, we no longer encrypt information on networks, we will get to you and take your data, we will notify you…
US Department of Justice · Web page · Published 29 Sep
Federal Indictment in Chicago Charges Turkish National With Directing Cyber Attack on Multinational Hospitality Company
CHICAGO — An alleged cyber attacker from Turkey has been indicted in federal court in Chicago for allegedly orchestrating a distributed denial-of-service (DDoS) attack on a Chicago-based multinational hospitality company. In August 2017, IZZET MERT OZEK used…
DataBreaches.net · Web page · Published 5 May
Negotiations with the Akira ransomware group: an ill-advised approach
@Chum1ng0 took a look at four victims of Akira and what happened in terms of negotiations or not. In translation: After a detailed analysis, we identified four chats from different companies that attempted to communicate with Akira after being attacked. Some…
spixnet.at · Web page · Added 23 Apr
Spixnet.ai – Next Gen Email Encryption
Founded in 2022 – Built for Modern Email Security. Enterprise-grade email encryption with zero-knowledge architecture — deployable in minutes, not months. Let's chat Learn more 1876 Founded 271+ Happy Customers 92% Uptime SLA Trusted by Industry Leaders…
Check Point · Web page · Published 1 Oct
Rhadamanthys 0.9.x – walk through the updates
Rhadamanthys is a popular, multi-modular stealer, released in 2022. Since then, it has been used in multiple campaigns by various actors. Most recently, it is being observed in the ClickFix campaigns. The latest version, 0.9.2, comes with significant updates…
Cleafy · Web page · Added 23 Apr
Mirax: a new Android RAT turning infected devices into potential residential proxy nodes
New Maas spreading: Mirax has emerged as a sophisticated Malware-as-a-Service (MaaS) offering, specifically targeting Android devices across Europe. It is actively marketed and distributed through underground malware forums. At the time of writing, Cleafy…
K7 Labs · Web page · Published 23 Jul
Threat actors target recent Election Results
Recently, we saw a tweet about a document claiming to be reporting about the recent “Indian Election Results”. On analysis, we found that it was dropping a “Crimson RAT” payload. This RAT, mostly used by the Transparent Tribe APT, is capable of stealing…
Check Point · Web page · Published 22 Sep
7 Years of Scarlet Mimic’s Mobile Surveillance Campaign Targeting Uyghurs
In 2022, Check Point Research (CPR) observed a new wave of a long-standing campaign targeting the Uyghur community, a Turkic ethnic group originating from Central Asia, one of the largest minority ethnic groups in China. This malicious activity, which we…
Check Point · Web page · Published 5 Jan
Can You Trust a File’s Digital Signature? New Zloader Campaign exploits Microsoft’s Signature Verification putting users at risk
Last seen in August 2021, Zloader, a banking malware designed to steal user credentials and private information, is back with a simple yet sophisticated infection chain. Previous Zloader campaigns, which were seen in 2020, used malicious documents, adult…
Check Point · Web page · Published 29 May
Lumma Infostealer – Down but Not Out?
The takedown achieved a significant disruption to Lumma infostealers’ infrastructure, but likely didn’t permanently affect most of its Russia-hosted infrastructure. Lumma’s developers are undertaking significant efforts to reinstate the activity and to…
threatmon.io · Web page · Published 18 Oct
The Konni APT Chronicle: Tracing Their Intelligence-Driven Attack Chain
Unified threat visibility and continuous monitoring across every cyber asset. Protect your digital identity, monitor the dark web, and receive instant alerts – all from your phone. Run controlled DDoS simulations to evaluate infrastructure resilience and…
DataBreaches.net · Web page · Published 26 May
A former DarkSide listing shows up on REvil's leak site
On May 15, Chum1ng0 reported that German furniture retailer Möbelstadt Sommerlad had been hit by DarkSide threat actors. By then DarkSide’s leak site was down and it had not been possible to confirm whether DarkSide had ever listed the retailer as a victim or…
spixnet.com · Web page · Added 23 Apr
Spixnet.ai – Next Gen Email Encryption
Founded in 2022 – Built for Modern Email Security. Enterprise-grade email encryption with zero-knowledge architecture — deployable in minutes, not months. Let's chat Learn more 1811 Founded 262+ Happy Customers 89% Uptime SLA Trusted by Industry Leaders…
Check Point · Web page · Published 31 Aug
From Hidden Bee to Rhadamanthys – The Evolution of Custom Executable Formats
Rhadamanthys stealer’s design and implementation significantly overlap with those of Hidden Bee coin miner. The similarity is apparent at many levels: custom executable formats, the use of similar virtual filesystems, identical paths to some of the…
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.