Research reports
1,224 reports from 387 publishers45 added in the past week
111 reports, newest added first
Added Fri 1 May
Kimsuky disguised as a Korean company signed with a valid certificate to distribute Troll Stealer…
S2W threat research and intelligence center Talon has hunted for and analyzed a sample of what is believed to be a new malware from the Kimsuky group on VirusTotal. — The malware was found to be distributed from a page that redirects users to a specific site…
State-sponsoredMalwareInfostealers
Inside Lazarus: How North Korea uses AI to industrialize attacks on developers
This research was also highlighted in WIRED. You can read the full article from Andy Greenberg and Matt Burgess here. TL;DR Expel is actively tracking an APT group that we assess with high confidence to be North Korean (DPRK) state-sponsored. We suspect that…
State-sponsored
French-speaking gang OPERA1ER APT in Africa
In 2019, Group-IB Threat Intelligence team detected a series of targeted attacks on financial organizations in Africa. Later in 2020, our professionals in collaboration with Orange, managed to piece together the seemingly disparate attacks into a single…
State-sponsored
How UNC6692 Employed Social Engineering to Deploy a Custom Malware Suite
Google Threat Intelligence Group (GTIG) identified a multistage intrusion campaign by a newly tracked threat group, UNC6692, that leveraged persistent social engineering, a custom modular malware suite, and deft pivoting inside the victim’s environment to…
State-sponsoredMalware
Added Wed 29 Apr
260108.pdf
Codes in Spearphishing Campaigns Targeting U.S. Entities Summary The Federal Bureau of Investigation (FBI) is releasing this FLASH to alert NGOs, think tanks, academia, and other foreign policy experts with a nexus to North Korea of evolving tactics employed…
State-sponsored
PowerPoint Presentation
Unmasking HiddenFace MirrorFace’s most complex backdoor yet Dominik Breitenbacher Malware Researcher Unmasking NOOPDOOR MirrorFace’s most complex backdoor yet Dominik Breitenbacher Malware Researcher Dominik Breitenbacher • Malware researcher @ ESET since…
State-sponsoredMalware
MuddyWater: Snakes by the riverbank
ESET researchers have identified new MuddyWater activity primarily targeting organizations in Israel, with one confirmed target in Egypt. MuddyWater, also referred to as Mango Sandstorm or TA450, is an Iran-aligned cyberespionage group known for its…
State-sponsoredMalware
Disrupting the first reported AI-orchestrated cyber espionage campaign
We recently argued that an inflection point had been reached in cybersecurity: a point at which AI models had become genuinely useful for cybersecurity operations, both for good and for ill. This was based on systematic evaluations showing cyber capabilities…
State-sponsored
Turla/Belugasturgeon Compromises Government
Turla, identified internally by Accenture Cyber Threat Intelligence as Belugasturgeon, continues to target government organizations using custom malware, including updated legacy tools, designed to maintain persistence through overlapping backdoor access…
State-sponsoredMalware
Added Sat 25 Apr
The Evolution of Transparent Tribe’s New Malware
The ElizaRAT campaigns first executed the same function to verify that the system was set to India Standard Time, indicating that the campaigns targeted Indian systems. Transparent Tribe, otherwise known as APT36, is a Pakistan-affiliated threat actor that…
State-sponsoredMalware
Added Fri 24 Apr
Cyber Espionage on Afghanistan, Kyrgyzstan and Uzbekistan by Chinese-speaking Hacker Group
Check Point Research (CPR) detects an ongoing cyber espionage operation targeting the Afghan government. Attributed to a Chinese-speaking hacker group, the threat actors impersonated the Office of the President of Afghanistan to infiltrate the Afghan National…
State-sponsored
Added Thu 23 Apr
Threat actors target recent Election Results
Recently, we saw a tweet about a document claiming to be reporting about the recent “Indian Election Results”. On analysis, we found that it was dropping a “Crimson RAT” payload. This RAT, mostly used by the Transparent Tribe APT, is capable of stealing…
State-sponsoredMalware
The Konni APT Chronicle: Tracing Their Intelligence-Driven Attack Chain
Unified threat visibility and continuous monitoring across every cyber asset. Protect your digital identity, monitor the dark web, and receive instant alerts – all from your phone. Run controlled DDoS simulations to evaluate infrastructure resilience and…
State-sponsored
Added Wed 22 Apr
Twisted Panda: Chinese APT espionage operation against Russian state-owned defense institutes
In the past two months, we observed multiple APT groups attempting to leverage the Russia and Ukraine war as a lure for espionage operations. It comes as no surprise that Russian entities themselves became an attractive target for spear-phishing campaigns…
State-sponsored
Vicious Panda: The COVID Campaign
Check Point Research discovered a new campaign against the Mongolian public sector, which takes advantage of the current Coronavirus scare, in order to deliver a previously unknown malware implant to the target. A closer look at this campaign allowed us to…
State-sponsoredMalware
Naikon APT: Cyber Espionage Reloaded
Recently Check Point Research discovered new evidence of an ongoing cyber espionage operation against several national government entities in the Asia Pacific (APAC) region. This operation, which we were able to attribute to the Naikon APT group, used a new…
State-sponsored
Added Mon 20 Apr
IndigoZebra APT continues to attack Central Asia with evolving tools
Check Point research recently discovered an ongoing spear-phishing campaign targeting the Afghan government. Further investigation revealed this campaign was a part of a long-running activity targeting other Central-Asia countries, including Kyrgyzstan and…
State-sponsored
Added Sat 18 Apr
North Korea Turns Against New Targets?!
Over the past few weeks, we have been monitoring suspicious activity directed against Russian-based companies that exposed a predator-prey relationship that we had not seen before. For the first time we were observing what seemed to be a coordinated North…
State-sponsored
Beyond the Horizon: Traveling the World on Camaro Dragon’s USB Flash Drives
In early 2023, the Check Point Incident Response Team (CPIRT) team investigated a malware incident at a European healthcare institution involving a set of tools mentioned in the Avast report in late 2022. The incident was attributed to Camaro Dragon, a…
State-sponsoredMalware
Added Fri 17 Apr
UPSynergy: Chinese-American Spy vs. Spy Story
Earlier this year, our colleagues at Symantec uncovered an interesting story about the use of Equation group exploitation tools by an alleged Chinese group named Buckeye (a.k.a APT3, or UPS team). One of the key findings in their publication was that variants…
State-sponsoredVulnerabilities
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.