Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,259 reports391 publishers75 added in the past week

61–80 of 1,259 reports · page 4 of 63

Added Sun 25 Oct

Silent Push · Web page · Published 4 Feb
Silent Push Identifies More Than 10,000 Infected IPs as Part of SystemBC Botnet Malware Family
Using a custom-built SystemBC tracker, Silent Push Preemptive Cyber Defense Analysts identified more than 10,000 unique infected IP addresses as part of this botnet. While we don’t have immediate visibility on any follow-on malware payloads deployed via this…
Malware Botnets and DDoS Original (new tab)
bin.re · Web page · Added 25 Oct
The DGA of Sisron
Sisron was part of a financial fraud and identity theft botnet. It was taken down by Microsoft in the anti-botnet operation B106. The malware uses a very simple domain generation algorithm (DGA) that produces sets of similar looking domains. mjawmjiwmtia.com…
Botnets and DDoS Original (new tab)
hexastrike.com · Web page · Published 25 Mar
Trust the Tunnel, Get the Trojan: Silver Fox Delivers Atlas RAT via Weaponized VPN Installers
Overview of the Silver Fox AtlasCross campaign kill chain, from typosquatted lure domains through the triple-nested Setup Factory installer to fileless AtlasCross RAT deployment. Executive Summary A multi-stage remote access trojan campaign is actively…
Malware Supply chain Original (new tab)
Check Point · Web page · Published 28 Aug
Gozi: The Malware with a Thousand Faces
Most of the time, the relationship between cybercrime campaigns and malware strains is simple. Some malware strains, like the gone-but-not-forgotten GandCrab, are intimately tied to a single actor, who is using the malware directly or distributing it via an…
Malware Original (new tab)
Team Cymru · Web page · Published 10 Jan
MoqHao Part 1: Identifying Phishing Infrastructure
In mid-January, Twitter users @NaomiSuzuki_ and @KesaGataMe0 identified nearly 20 malicious phishing domains spoofing AEON Bank in Japan. The domains were tied to MoqHao, a malware family targeting Android OS devices, primarily in Japan, South Korea, and…
Phishing Original (new tab)
Trend Micro · Web page · Published 17 May
Lemon Group’s Cybercriminal Businesses Built on Preinfected Devices
Note: This group's name is a generic identification based on components found during our investigation, and it might be used by other legitimately registered companies that legally render services and products. The illicit entity "Lemon Group" identified here…
Original (new tab)
ETDA Threat Group Cards · Web page · Added 25 Oct
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool Retefe (Android) Tool: Retefe (Android) Names Retefe (Android) Category Malware Type Banking trojan, Backdoor, Info stealer, Credential stealer, Botnet (GovCERT.ch) Recently, some anti-virus…
Malware Infostealers Mobile Original (new tab)

Added Sat 24 Oct

The Hacker News · Web page · Published 19 Oct
Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic
A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini,…
Malware Supply chain Original (new tab)
Mandiant (Google) · Web page · Published 15 Oct
Investigating Ephemeral Supply Chain Tampering
Google Threat Intelligence Group (GTIG) and Mandiant investigated a software supply chain compromise campaign targeting the update infrastructure belonging to AOMEI Technology between April 2026 and July 2026. The threat actor conducted repeated, short-burst…
Supply chain Original (new tab)
The Hacker News · Web page · Published 19 Oct
GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories
The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. The latest…
Infostealers Original (new tab)
Elastic Security Labs · Web page · Published 12 Oct
Auditing the auditor: Unmasking Apex Accelerator
Elastic Security Labs identified a malicious npm package, @apexacc/cli , which led us to an operation posing as a Web3 accelerator. That operation had spent months building a public presence, targeting cryptocurrency start-ups and founders with offers of free…
Malware Original (new tab)
opensourcemalware.com · Web page · Published 16 Oct
GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File
We’ve discovered a new element to the GhostAction campaign, which steals secrets through malicious GitHub Actions workflows. It now has a second stage that persists even if the victim has removed the malicious workflow. Existing Stage 1: Use stolen GitHub…
Infostealers Original (new tab)
Mandiant (Google) · Web page · Published 15 Oct
ARMORY CASTLE Exploits BeyondTrust
Written by: Jayson Frost, Bryce Greathouse, Brian Meyer, John Palmisano, Rajesh Rajeshirke, Steve Rasch, John Wolfram Introduction On October 15, BeyondTrust disclosed a vulnerability, CVE-2026-102764, impacting BeyondTrust Remote Support (formerly Bomgar)…
Vulnerabilities Original (new tab)
gitguardian.com · Web page · Published 5 Sep
The GhostAction Campaign: 3,325 Secrets Stolen Through Compromised GitHub Workflows
TL;DR: GitGuardian discovered and investigated the GhostAction campaign, which compromised 327 GitHub users across 817 repositories, stealing 3,325 secrets through malicious workflows disguised as "Github Actions Security." Attackers extracted PyPI, npm,…
Supply chain Original (new tab)
manageengine.com · Web page · Added 24 Oct
Supply-Chain Compromise via AOMEI Backupper
Published in coordination with Google Threat Intelligence Group and Mandiant. Their report on the wider UNC7017 campaign is available here. Detection: On 28 May 2026, ManageEngine EDR recorded AOMEI Backupper installing Radmin, a commercial…
Supply chain Original (new tab)

Added Thu 22 Oct

dokumen.tips · Web page · Published 21 Oct
dokumen.tips – DOKUMEN.TIPS – Discover, share, present.
Smart Garage Doors are revolutionizing the way homeowners access their garages, offering enhanced convenience and security through advanced technology. As part of the growing trend of smart home devices, these doors can be controlled remotely via smartphones…
Original (new tab)

Added Tue 20 Oct

Group-IB · Web page · Published 15 Dec
Blog
KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize Group-IB researchers analyze KGB RAT, a Windows Remote Access Trojan advertised on underground forums as being fully undetectable, featuring a built-in crypter, HVNC, credential…
Malware Original (new tab)
Security Joes · Web page · Added 20 Oct
BiBi-Linux: A New Wiper Dropped By Pro-Hamas Hacktivist Group
Security Joes Incident Response team volunteered to assist Israeli companies during the times of war between the state of Israel and the terrorist organization Hamas. During the forensics investigation, we found what appears to be a new Linux Wiper malware we…
Malware Original (new tab)
Malwarebytes · Web page · Published 5 Jan
Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat
Downloaded payload is a variant of a cloud-based RAT known as RokRat which has been used by this group since 2017. This sample compilation date is 29 Oct 2019. This RAT is known to steal data from a victim’s machine and send them to cloud services (Pcloud,…
State-sponsored Malware Original (new tab)
ETDA Threat Group Cards · Web page · Added 20 Oct
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool Emissary Tool: Emissary Names Emissary Category Malware Type Backdoor (Palo Alto) This Trojan is related to the Elise backdoor described in the Operation Lotus Blossom report. Both Emissary…
Malware Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.