Research reports
1,224 reports from 387 publishers45 added in the past week
294 reports, newest added first
Added Wed 23 Sep
The Latest Addition to Turla’s Intelligence Gathering Apparatus
Google Threat Intelligence Group (GTIG) has conducted an in-depth analysis of a .NET backdoor, tracked as STOCKSTAY, that has been continually developed and deployed by the Russia-linked threat actor Turla (aka SUMMIT, Secret Blizzard, VENOMOUS BEAR,…
State-sponsoredMalware
Added Sat 19 Sep
Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection
Anthropic on Thursday revealed it disrupted a campaign mounted by a Russian state-sponsored threat actor that abused Claude for developing an AI-assisted workflow to get ahead of the detection curve. The operation has been attributed to a cyber espionage…
State-sponsoredMalware
Added Thu 17 Sep
StealC-Malware-Analysis/Reports/StealC-V2-EN.md at main · Yavuzhanzgen/StealC-Malware-Analysis
This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. StealC V2 Malware Technical Analysis Static Analysis • Dynamic Analysis •…
MalwareInfostealers
Added Tue 15 Sep
Ping32 RMM and ValleyRAT
The VBScript then dropped the legitimate Remote Monitoring and Management (RMM) tool ManageEngine Endpoint Central. Fareed included the IOCs for the following Endpoint Central server IP addresses: 202.61.160.208 202.61.160.202 202.61.160.201 202.61.160.
Malware
Introducing LX RAT: ITR Phishing Targets Finance and Tech
ZeroBEC researchers uncovered a prolonged phishing and malware campaign that uses Indian Income Tax Return (ITR) refund lures to deliver a multi-stage AutoIt infection chain. The campaign targeted financial and technology organizations and successfully evaded…
MalwarePhishing
Koktevrat – wieloetapowy Android RAT dystrybuowany pod przykrywką aplikacji MandatGO
No excerpt available.
MalwareMobile
AsyncRAT-Malware-Analysis/Reports/AsyncRAT-EN.md at main · Yavuzhanzgen/AsyncRAT-Malware-Analysis
This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. -EN.md at main · -Malware-Analysis AsyncRAT Technical Analysis Report…
Malware
BabylonRAT-Malware-Analysis/Reports/BabylonRAT-EN.md at main · Yavuzhanzgen/BabylonRAT-Malware-Analysis
This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All analyses were conducted in an isolated laboratory environment. -EN.md at -Malware-Analysis BabylonRAT Technical Analysis Report Static…
Malware
Added Tue 8 Sep
What We Thought Was SMOKELOADER: Introducing REMUS
Executive Summary REMUS is a previously undocumented malware family combining infostealer and loader capabilities with a C2 resolution mechanism based on the Ethereum blockchain. At runtime, REMUS queries a public Ethereum RPC endpoint and extracts the C2…
Malware
Lx(Base) RAT: A Technical Deep Dive
During a recent malware analysis, I encountered an interesting sample ( 256 : 5a26fd462a809c89b0448318591cb98a77a7b96fca658815dc0f547a51958bed an embedded PowerShell script and Base64-encoded payload that ultimately deploys the sophisticated LxBase .NET RAT.…
Malware
Mirage Kitten targets Middle East and Africa region with new malware
Mirage Kitten – also known as UNC1549, Smoke Sandstorm, and Nimbus Manticore – is an advanced persistent threat (APT) group focused on cyber-espionage operations against aerospace, aviation, defense, and telecommunications sectors across the Middle East and…
State-sponsoredMalware
Shedding light on the ABYSSWORKER driver
Cybercriminals are increasingly bringing their own drivers — either exploiting a vulnerable legitimate driver or using a custom-built driver to disable endpoint detection and response (EDR) systems and evade detection or prevention capabilities. Elastic…
Malware
How CrowdStrike Analyzes macOS Malware to Optimize Automated Detection
Ransomware (43% of analyzed threat data), backdoors (35%) and trojans (17%) were the most popular macOS malware categories spotted by CrowdStrike researchers in 2021 OSX.EvilQuest (ransomware), OSX.FlashBack (backdoor) and OSX.Lador (trojan) were the most…
RansomwareMalware
Prompts as Code & Embedded Keys
This is an abridged version of the LABScon 2025 presentation “LLM-Enabled Malware In the Wild” by the authors. A LABScon Replay video of the full talk will be released in due course. As Large Language Models (LLMs) are increasingly incorporated into…
MalwareAI
Added Thu 3 Sep
Download Meccha Chameleon Cheats, Get Malware
Over the past month, I’ve been playing this game called Meccha Chameleon, which is a hybrid between hide-and-seek and prop hunt, except instead of transforming into a map prop, you paint yourself to blend in with the environment. A group of hunter players…
Malware
SmartApeSG ClickFix Campaign Delivers Unknown RAT
The SmartApeSG campaign uses the ClickFix technique to trick users into running malicious commands through fake CAPTCHA or human verification pages. This action launches an HTA file that downloads and extracts a malicious ZIP archive. The final payload is an…
Malware
Financially Motivated Threat Actor BREEZE COMET Targets Brazil
BREEZE COMET is a financially motivated threat actor that targets Brazilian financial services, retail, and eCommerce organizations by abusing compromised websites, custom malware, and stolen credentials to manipulate payment systems and fraudulent transfers.…
Malware
Added Wed 2 Sep
Prompting the Payload: How an npm Supply Chain Attack Delivers the RedC2 AI-Powered Linux Implant
RedC2 extends its control layer with an AI-driven component called Red post-exploitation tasks, from network reconnaissance to credential dumping, using natu
MalwareSupply chain
Added Tue 1 Sep
Reverse Engineering the Auto-Color Linux Backdoor
Static and dynamic analysis of Auto-Color’s execution flow, C2 communication, and LD_PRELOAD rootkit. Auto-Color in a Nutshell Auto-Color is an emerging Linux backdoor first documented by Palo Alto Networks Unit 42 in February 2025. The earliest known samples…
Malware
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.