Research reports
1,224 reports from 387 publishers45 added in the past week
77 reports, newest added first
Added Thu 29 Jan
Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdf
2 VIRUS BULLETIN CONFERENCE OCTOBER 2024 ABSTRACT In this paper we provide an in-depth analysis of UNC3569, a prolific and sophisticated threat actor operating within the Chinese cybercriminal and cyber contractor-for-hire ecosystem, mostly operating out of…
State-sponsoredVulnerabilities
Added Thu 27 Nov 2025
1755675576.SJNjz.pdf
1.1.1 키워드 및 요약 + 키워드: WinRAR, RomCom, 0-day[1], CVE-2025-8088 + 요약: 압축 프로그램인 WinRAR 의 0-day 취약점을 통해 임의 코드 실행 확인 1.1.2 위협 설명 + ESET 사이버 보안 연구진은
Vulnerabilities
Added Thu 16 Oct 2025
Botconf2022-19-FaouCoteCyr.pdf
Operation Cache Panda: Zero-Day in Financial Software Exploited by China-Linked Threat Group Valentine’s Day this year saw the end of a truly toxic relationship — a prolonged supply chain attack targeting the Taiwan financial and securities trading sector…
State-sponsoredMalwareVulnerabilities
Added Tue 8 Jul 2025
Added Thu 3 Jul 2025
Added Sat 24 May 2025
Sarcoma-Ransomware.pdf
Sarcoma Ransomware has been one of the most active ransomware gangs in recent months. First detected in October 2024, it quickly evolved from an emerging threat into a major concern for the cybersecurity community. In a short time, it has attracted…
RansomwareVulnerabilities
Added Wed 23 Apr 2025
apt37-reaper-the-overlooked-north-korean-actor.pdf
On Feb. 2, 2018, we published a blog detailing the use of an Adobe Flash zero-day vulnerability (CVE-2018-4878) by a suspected North Korean cyber espionage group that we now track as APT37 (Reaper). Recent examination of this group’s activities by FireEye…
State-sponsoredMalwareVulnerabilities
Added Sun 23 Feb 2025
RedMike (Salt Typhoon) Exploits Vulnerable Cisco Devices of Global Telecommunications Providers
Insikt group observed RedMike exploiting privilege escalation vulnerabilities CVE-2023-20198 and CVE-2023-20273 to compromise unpatched Cisco network devices running Cisco IOS XE software. RedMike compromised devices of a US-based affiliate of a UK…
State-sponsoredVulnerabilities
Added Tue 4 Feb 2025
Added Mon 27 Jan 2025
Added Tue 17 Dec 2024
Operation Triangulation: The last (hardware) mystery
Boris Larin Today, on December 27, 2023, we (Boris Larin, Leonid Bezvershenko, and Georgy Kucherin) delivered a presentation, titled, “Operation Triangulation: What You Get When Attack iPhones of Researchers”, at the 37th Chaos Communication Congress (37C3),…
Vulnerabilities
The-Mask-has-been-unmasked-again.pdf
The Mask (also known as Careto) is an advanced threat actor that has been operating since at least 2007. In the past, it was observed to conduct cyber espionage campaigns that mainly targeted high-profile organizations. This actor’s attacks have always been…
Vulnerabilities
Added Fri 25 Oct 2024
ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilities
IRAN-ALIGNED CYBERATTACKS: RISE IN DISRUPTIVE OPERATIONS October 2023 – March 2024 Report ESET APT ACTIVITY REPORT OCTOBER 2023 - MARCH 2024 | 2 Contents Executive summary� 3 Attackers and targets� 4 China-aligned groups � 5 Mustang Panda targets the cargo…
State-sponsoredVulnerabilities
Added Wed 28 Aug 2024
Chinese State-Sponsored RedJuliett Intensifies Taiwanese Government, Academic, and Technology Sector Cyber Espionage via Network Perimeter Exploitation
States, Rwanda, Kenya, and Djibouti. Internet-facing devices such as firewalls, load balancers, and enterprise VPNs were targeted for initial access. SQL injection and directory traversal was attempted against web and SQL applications. RedJuliett likely…
State-sponsoredVulnerabilities
Added Thu 20 Jun 2024
CSA-NORTH-KOREAN-ACTORS-EXPLOIT-WEAK-DMARC.PDF
To report suspicious or criminal activity related to information found in the Joint Cybersecurity Advisory, contact your local FBI field office or submit a report to the FBI Internet Crime Complaint Center (IC3). When available, please include the following…
VulnerabilitiesTakedowns and arrests
Added Sat 18 May 2024
ebury-is-alive-but-unseen.pdf
(eset):research WHITEPAPER Marc-Etienne M.Léveillé May 2024 Ebury is alive but unseen: 400k Linux servers compromised for cryptocurrency theft and financial gain ESET | EBURY IS ALIVE BUT UNSEEN WHITEPAPER | 2 Contents Propagation� 7 Credential stuffing� 8…
Vulnerabilities
Added Wed 17 Apr 2024
PwC Cyber Threats 2022: A Year in Retrospect.pdf
Log4Shell was an edge case in terms of vulnerabilities disclosed in 2022, as threat actors continued to make use of known vulnerabilities, exploits and tools (e.g. Cobalt Strike) when conducting their attacks. However, throughout 2022 we also saw threa
Vulnerabilities
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.