Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,233 reports388 publishers50 added in the past week

781–800 of 1,024 reports · page 40 of 52 · Clear filters

Added Fri 10 Apr

kienmanowar.wordpress.com · Web page · Published 11 May
Quick analysis note about DealPly (Adware)
DealPly adware abuses Microsoft, McAfee services to evade detection Adware.DealPly The post focuses on the following main sections: Unpack wrapper/loader to get main Dll payload. Decrypt C2url and strings are used in the malware code. Sample: SHA-256:…
Malware Original (new tab)
Medium · Web page · Published 15 Sep
Mapping and Pivoting from Cobalt Strike C2 Infrastructure Attributed to CVE-2021-40444
Threat Actors Infrastructure (VT Analysis). Pivoting from 45.147.229[.]242 Pivoting from 104.194.10[.]21 Pivoting from 45.153.240[.]220 Short summary and IOC’s. Press enter or click to view image in full size Threat Actors C
Vulnerabilities Original (new tab)
QiAnXin · Web page · Added 10 Apr
奇安信威胁情报中心
APT groups often use some uncommon file types to host malicious code in order to increase the probability of immunity against antivirus software, such as CD-ROM image files (.iso) and virtual hard disk files (.vhd), which we have monitored for abuse in recent…
State-sponsored Original (new tab)
Malwarebytes · Web page · Published 17 Mar
HelloKitty: When Cyberpunk met cy-purr-crime
On February 9, after discovering a compromise, CD Projekt Red (CDPR) announced to its 1+ million followers on Twitter that it was the victim of a ransomware attack against its systems (and made it clear they would not yield to the demands of the threat…
Ransomware Original (new tab)
US Department of Justice · Web page · Published 15 Feb
Foreign National Pleads Guilty to Role in Cybercrime Schemes Involving Tens of Millions of Dollars in Losses
A Ukrainian national pleaded guilty today to his role in two separate and wide-ranging malware schemes involving tens of millions of dollars in losses. “Vyacheslav Igorevich Penchukov was a leader of two prolific malware groups that infected thousands of…
Malware Takedowns and arrests Original (new tab)
SentinelOne · Web page · Published 12 Jul
Malware Discovered – SFG: Furtim Malware Analysis
Update, 14-July: There have been a number of stories published since the posting of this blog that have suggested this attack is specifically targeting SCADA energy management systems. We want to emphasize that we do not have any evidence that this is in fact…
Malware Original (new tab)
eSentire · Web page · Added 10 Apr
Initial Takeaways from the Black Basta Chat Leaks
The Black Basta ransomware group's internal chat logs, leaked on February 11, 2025, consist of nearly 200,000 Russian-language messages spanning September 18, 2023, to September 28, 2024. These logs, exposed by an individual known as "ExploitWhispers",…
Ransomware Original (new tab)
GitHub · Web page · Added 10 Apr
IoCs/Broadbased/frat.md at master · jeFF0Falltrades/IoCs
Note: I have not seen much coverage of this malware family. The name 'FRat' was derived from research by @James_inthe_box, seen in the linked Tweet thread below. If you have more information on this threat, please contact me on Twitter A RAT employing…
Malware Original (new tab)
d01a.github.io · Web page · Published 12 Apr
Aurora Stealer
The icon of the executable gives us a hit about how this is spreading. It has Photoshop icon, most probably it was spreading using Malvertising. First we want to know some basic information about the file so I will use DiE to do so. It was identified as GO…
Infostealers Original (new tab)
BleepingComputer · Web page · Published 11 May
Stealthier version of Linux BPFDoor malware spotted in the wild
BPFDoor is a stealthy backdoor malware that has been active since at least 2017 but was only discovered by security researchers around 12 months ago. The malware gets its name from the use of the 'Berkley Packet Filter' (BPF) for receiving instructions while…
Malware Original (new tab)
Cisco Talos · Web page · Published 4 Apr
Typhon Reborn V2: Updated stealer features enhanced anti-analysis and evasion capabilities
The developer of the Typhon Reborn information stealer released version 2 (V2) in January, which included significant updates to its codebase and improved capabilities. Most notably, the new version features additional anti-analysis and anti-virtual machine…
Infostealers Original (new tab)
Kaspersky · Web page · Published 4 May
Petya: the two-in-one trojan
Infecting the Master Boot Record (MBR) and encrypting files is nothing new in the world of malicious programs. Back in 1994, the virus OneHalf emerged that infected MBRs and encrypted the disk contents. However, that virus did not extort money. In 2011, MBR…
Ransomware Malware Original (new tab)
Check Point · Web page · Published 24 Apr
Deobfuscating APT32 Flow Graphs with Cutter and Radare2
The Ocean Lotus group, also known as APT32, is a threat actor which has been known to target East Asian countries such as Vietnam, Laos and the Philippines. The group strongly focuses on Vietnam, especially private sector companies that are investing in a…
State-sponsored Original (new tab)
chuongdong.com · Web page · Published 16 Jan
Babuk Ransomware v3
This is a short report for the latest Babuk ransomware sample. This sample is marked as version 3 based on the run-once mutex string. For this new version, the malware author keeps most of the old functionalities the same except for the encryption scheme and…
Ransomware Original (new tab)
embee-research.ghost.io · Web page · Published 20 Oct
Cobalt Strike Malware Analysis With CyberChef and Emulation - .HTA Loader Example
In this post. we will demonstrate a process for decoding a simple .hta loader used to load cobalt strike shellcode. We will perform initial analysis using a text editor, and use CyberChef to extract embedded shellcode. From here we will validate the shellcode…
Malware Original (new tab)
quosecgmbh.github.io · Web page · Added 10 Apr
Navigating QakBot samples with grap
This post demonstrates how to use grap to quickly find and analyse documented features (based on public reports) in published QakBot samples: All features and IOC described here are already published (see References) Samples are from Malpedia: win.qakbot We…
Malware Original (new tab)
ironnet.com · Web page · Added 10 Apr
Robin Banks still might be robbing your bank (part 2)
YES Source: https://www.ironnet.com/blog/robin-banks-still-might-be-robbing-your-bank-part-2
Original (new tab)
PRODAFT · Web page · Added 10 Apr
PRODAFT – Cyber Threat Intelligence and Risk Intelligence
Every day we intercept thousands of cyber threats & prevent next-generation attacks We provide actionable and timely intelligence right from the source, empowering your organization to proactively counter future threats. Why PRODAFT? Our Partners Our Numbers…
Original (new tab)
theregister.co.uk · Web page · Published 14 Sep
Malware burrows deep into computer BIOS to escape AV
Researchers have discovered one of the first pieces of malware ever used in the wild that modifies the software on the motherboard of infected computers to ensure the infection can't be easily eradicated. Known as Trojan.Mebromi, the rootkit reflashes the…
Malware Original (new tab)
Microsoft · Web page · Added 10 Apr
Microsoft Security Response Center Blog
Strengthening secure software at global scale: How MSRC is evolving with AI Tuesday, April 7, 2026 Cybersecurity has always been a race between defenders and attackers, constrained by human time, attention, and scale. What is changing now is the level of…
Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.