Skip to content

Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,233 reports388 publishers50 added in the past week

721–740 of 1,024 reports · page 37 of 52 · Clear filters

Added Fri 17 Apr

redpacketsecurity.com · Web page · Published 7 Apr
[KRYBIT] - Ransomware Victim: fraper[.]com
NOTE: No files or stolen information are exfiltrated, downloaded, taken, hosted, seen, reposted, or disclosed by RedPacket Security. Any legal issues relating to the content should be directed at the attackers, not RedPacket Security. This blog is an…
Ransomware Original (new tab)
dataminr.com · Web page · Added 17 Apr
Cyber Intel Brief: Pro-Iran Actor Claims Cyberattack on LA Metro
OT System Access Claimed: Screenshots published by the group appear to show access to a real-time rail yard management and train control display system (Division 11), representing a potentially serious operational technology (OT) intrusion with safety…
Original (new tab)
Cisco Talos · Web page · Published 8 Apr
New Lua-based malware “LucidRook” observed in targeted attacks against Taiwanese organizations
Cisco Talos uncovered a cluster of activity we track as UAT-10362 conducting spear-phishing campaigns against Taiwanese non-governmental organizations (NGOs) and suspected universities to deliver a newly identified malware family, “LucidRook.” LucidRook is a…
Malware Original (new tab)
Check Point · Web page · Published 28 Nov
28th November– Threat Intelligence Report
For the latest discoveries in cyber research for the week of 28th November, please download our Threat Intelligence Bulletin. Top Attacks and Breaches The European Parliament website has been attacked following a vote declaring Russia a state sponsor of…
State-sponsored Botnets and DDoS Original (new tab)
Bitdefender · Web page · Published 9 Feb
No Encryptors, No Problem: The Coinbase Cartel Ransomware Group
The ransomware threat actor Coinbase Cartel first emerged in September 2025 and claimed 14 victims that month. The group focuses on data exfiltration, which aligns with a trend Bitdefender is tracking in the ongoing evolution of ransomware. Currently, the…
Ransomware Original (new tab)

Added Thu 16 Apr

Check Point · Web page · Published 5 Aug
Ramnit’s Network of Proxy Servers
As you may know, Ramnit is one of the most prominent banking malware families in existence today and lately Check Point Research monitored a new massive campaign of Ramnit, dubbed ‘Black’, reaching over 100,000 infections over the course of two months. It is…
Original (new tab)
Check Point · Web page · Published 24 May
Agrius Deploys Moneybird in Targeted Attacks Against Israeli Organizations
Iranian threat actor Agrius continues to operate against Israeli targets, masking destructive influence operations as ransomware attacks. In recent attacks the group deployed Moneybird, a previously unseen ransomware written in C++. Despite presenting…
Ransomware Original (new tab)
Check Point · Web page · Published 6 Sep
DangerousSavanna: Two-year long campaign targets financial institutions in French-speaking Africa
Recent studies show that more than 85% of financial institutions in Central and Western Africa have repeatedly been victimized in multiple, damaging cyberattacks. In a quarter of these cases, intrusions into network systems resulted in the worst possible…
Original (new tab)
Check Point · Web page · Published 4 Feb
SpeakUp: A New Undetected Backdoor Linux Trojan
Check Point Research has discovered a new campaign exploiting Linux servers to implant a new Backdoor Trojan. Dubbed ‘SpeakUp’, the new Trojan exploits known vulnerabilities in six different Linux distributions. The attack targets worldwide servers including…
Malware Vulnerabilities Original (new tab)

Added Wed 15 Apr

Check Point · Web page · Published 15 Jul
New BugSleep Backdoor Deployed in Recent MuddyWater Campaigns
MuddyWater, an Iranian threat group affiliated with the Ministry of Intelligence and Security (MOIS), has significantly increased its activities in Israel since the beginning of the Israel-Hamas war in October 2023. This parallels with activities against…
State-sponsored Malware Phishing Original (new tab)
Cybernews · Web page · Published 30 Sep
BlackCat said they breached US Department of Defense contractor and went offline
The ransomware gang first said they would leak NJVCs data every 12 hours but later dropped the victim from its list. Ransomware gang BlackCat, also known as ALPHV, added NJVC, an IT company supporting the federal government and the US Department of Defense,…
Ransomware Original (new tab)
Cybernews · Web page · Published 12 Jul
Cl0p hacker operating from Russia-Ukraine war front line – exclusive
As the Cl0p ransomware gang continues to sow anxiety worldwide, affecting prominent companies like the BBC and Deutsche Bank, at least one of the gang’s masterminds, Cybernews discovered, is still residing in Ukraine. Deutsche Bank, one of the world’s largest…
Ransomware Vulnerabilities Original (new tab)
Check Point · Web page · Published 17 Oct
Pony’s C&C servers hidden inside the Bitcoin blockchain
Redaman is a form of banking malware distributed by phishing campaigns that target mostly Russia language speakers. First seen in 2015 and reported as the RTM banking Trojan, new versions of Redaman appeared in 2017 and 2018. In September 2019, Check Point…
Malware Original (new tab)
Cybernews · Web page · Published 1 Sep
Unraveling EternalBlue: inside the WannaCry’s enabler
WannaCry and NotPetya, probably two most damaging cyberattacks in recent history, were both only made possible because of EternalBlue. Here is how the NSA-developed cyber monster works, and how you should defend against it. What is the EternalBlue…
Vulnerabilities Original (new tab)
Check Point · Web page · Published 16 May
Check Point Research reveals a malicious firmware implant for TP-Link routers, linked to Chinese APT group
Check Point Research (CPR) exposes a malicious firmware implant for TP-Link routers which allowed attackers to gain full control of infected devices and access compromised networks while evading detection. CPR attributes the attacks to a Chinese…
State-sponsored Malware Original (new tab)
Cybernews · Web page · Published 27 Oct
Thomson Reuters collected and leaked at least 3TB of sensitive data
Thomson Reuters, a multinational media conglomerate, left an open database with sensitive customer and corporate data, including third-party server passwords in plaintext format. Attackers could use the details for a supply-chain attack. Media giant with…
Original (new tab)
Cybernews · Web page · Published 21 Apr
Million-dollar deposits and friends in high places: how we applied for a job with a ransomware gang
During an undercover interview, a CyberNews researcher tricked ransomware operators affiliated with Ragnar Locker into revealing their ransom payout structure, cash out schemes, and target acquisition strategies. From a relatively rare threat just a few years…
Ransomware Original (new tab)
Check Point · Web page · Published 20 May
Bad Karma, No Justice: Void Manticore Destructive Activities in Israel
Void Manticore is an Iranian threat actor affiliated with the Ministry of Intelligence and Security (MOIS). They carry out destructive wiping attacks combined with influence operations. The threat actor operates several online personas, with the most…
Original (new tab)
Check Point · Web page · Published 17 Jun
17th June – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 17th June, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES An attack targeting Snowflake customer databases, identified as the work of threat actor UNC5537, has led to…
State-sponsored Original (new tab)

Added Tue 14 Apr

Check Point · Web page · Published 3 Apr
Agent Tesla Targeting United States & Australia: Revealing the Attackers’ Identities
Check Point Research (CPR) uncovered three recent malicious campaigns of one of the most prevalent malware in the market – Agent Tesla. These operations were aimed against US and Australian organizations and exploited the topics of goods purchasing and order…
Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.