Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,233 reports388 publishers50 added in the past week

801–820 of 1,024 reports · page 41 of 52 · Clear filters

Added Fri 10 Apr

brighttalk.com · Web page · Published 10 Mar
A look at current cyberattacks in Ukraine
Costin Raiu, Marco Preuss, Kurt Baumgartner, Dan Demeter, Ivan Kwiatkowski About this talk Kaspersky researchers have been monitoring the activity of APT actors, cybercriminals and hacktivists currently involved in the conflict in Ukraine. During this…
Original (new tab)
vincss.net · Web page · Published 27 May
GuLoader AntiVM Techniques
Thời gian gần đây, Twitter của các chuyên gia nước ngoài liên tục xuất hiện hash tag #GuLoader, đây là một downloader phổ biến đang được các nhóm tin tặc sử dụng rộng rãi nhằm tải về mã độc chính lợi dụng các dịch vụ cloud của Google Drive và Microsoft…
Malware Original (new tab)
nur.pub · Web page · Published 16 Jun
Cerberus Analysis - Android Banking Trojan
Cerberus is an Android malware that emerged in 2019 but was allegedly used for special operations until two years ago. It has been determined by the analysts that it was not built on a banking trojan and the Anubis malware whose source code had leaked, or…
Malware Mobile Original (new tab)
threatresearch.ext.hp.com · Web page · Published 30 Jul
Detecting TA551 domains
TA551 are an active threat group known for distributing high volumes of malicious spam (malspam) that deliver different families of malware. Using a TA551 campaign delivering Ursnif as an example, we describe a typical infection chain, and explore potential…
Original (new tab)
splunk.com · Web page · Published 19 May
Threat Update: AcidRain Wiper
Splunk is committed to using inclusive and unbiased language. This blog post might contain terminology that we no longer use. For more information on our updated terminology and our stance on biased language, please visit our blog post. We appreciate your…
Malware Original (new tab)
Check Point · Web page · Published 10 Apr
The Muddy Waters of APT Attacks
The Iranian APT, MuddyWater, has been active since at least 2017. Most recently though, a new campaign, targeting Belarus, Turkey and Ukraine, has emerged that caught the attention of Check Point researchers. Ever since at least 2017, the attackers behind…
State-sponsored Original (new tab)
Trend Micro · Web page · Published 11 Sep
EvilAI Operators Use AI-Generated Code and Fake Apps for Far-Reaching Attacks
By Jeffrey Francis Bonaobra, Joshua Aquino, Emmanuel Panopio, Emmanuel Roll, Joshua Lijandro Tsang, Armando Nathaniel Pedragoza, Melvin Singwa, Mohammed Malubay, Marco Dela Vega ( words) Key takeaways EvilAI disguises itself as productivity or AI-enhanced…
Original (new tab)
streamscan.ai · Web page · Added 10 Apr
Analysis of the Ransomware Nitrogen
The aim of this analysis is to dissect the Nitrogen ransomware distributed by Nitrogen Ransomware Group to better understand how it works. This ransomware has much in common with the LukaLocker ransomware distributed by the Volcano Demon group. Source:…
Ransomware Original (new tab)
bi.zone · Web page · Published 17 Dec
Arcane Werewolf revamps its arsenal with Loki 2.1 implant
In October and November 2025, BI.ZONE Threat Intelligence observed malicious activity by Arcane Werewolf (Mythic Likho) targeting Russian manufacturing enterprises. Retrospective analysis suggests that the threat actor most likely used phishing emails as the…
Malware Phishing Original (new tab)
myonlinesecurity.co.uk · Web page · Published 25 Jun
More AgentTesla Keylogger And Nanocore RAT In One Bundle
We are seeing a continuation of even more AgentTesla malspam campaigns again this morning. However today’s is somewhat different to usual and also delivers a Nanocore RAT. Actually the Nanocore RAT is downloading the AgentTesla keylogger. And after a bit of…
Malware Original (new tab)

Added Thu 9 Apr

DataBreaches.net · Web page · Published 5 Aug
Scattered Spider is NOT quiet. They're just under another name now.
Following recent arrests of alleged Scattered Spider members in the UK, Google Cloud’s Mandiant Consulting has reported a noticeable pause in the group’s activities, offering a “critical window of opportunity” for organizations to bolster their defenses,…
Takedowns and arrests Original (new tab)
DataBreaches.net · Web page · Published 8 Aug
ShinyHunters sent Google an extortion demand; Shiny comments on current activities
Even the NSA can’t stop or identify us anymore. The FBI and everyone else is irrelevant and incompetent as far as we’re concerned :). When DataBreaches asked ShinyHunters if anything in particular had inspired that statement, “Shiny1” responded: I heard the…
Ransomware Original (new tab)
Check Point · Web page · Published 20 Aug
Ryuk Ransomware: A Targeted Campaign Break-Down
Over the past two weeks, Ryuk, a targeted and well-planned Ransomware, has attacked various organizations worldwide. So far the campaign has targeted several enterprises, while encrypting hundreds of PC, storage and data centers in each infected company.…
Ransomware Original (new tab)
DataBreaches.net · Web page · Published 18 Dec
If at first you don't succeed, screw it up again?
Unfortunately for AlphV, they did not seem to know that the law wasn’t in effect yet. Today, BlackCat tried again. Their leak site now lists Viking Therapeutics as a victim. Instead of providing any proof of claims, however, they posted that they got…
Ransomware Original (new tab)
DataBreaches.net · Web page · Published 6 Oct
Revenge telecom hacking by DESORDEN Group; third attack threatened
DESORDEN Group has added a new transparency demand to their attacks against Malaysian entities: victims must disclose the breach publicly if they have not paid the attackers. If the victim doesn’t disclose and Malaysian media does not report the incident,…
Original (new tab)
DataBreaches.net · Web page · Published 1 Jul
Still think you can negotiate with REvil and get your files back? Read this first.
The government and professionals involved in ransomware incident response have often advised victims not to pay the ransom because even if you pay, you may not get your data back, and you may not get your data deleted by criminals who pinky swear that they…
Ransomware Original (new tab)
DataBreaches.net · Web page · Published 25 Sep
"BlackCat" attempts to up the pressure on Suffolk County; starts to leak data?
Since September 8, Suffolk County has been trying to recover from a cyberattack by a ransomware group known as “ALPHV” or “BlackCat.” The attack disabled the county’s 911 system as well as other services. The county reverted to older methods for handling…
Ransomware Original (new tab)
DataBreaches.net · Web page · Published 15 Sep
AlphV responds to MGM incident and sloppy reporting
AlphV has posted a statement about their attack on MGM Resorts. They also post some scathing criticisms of journalists and news outlets for reporting inaccurately and not verifying sources. Of note, their statement also asserts, “The ALPHV ransomware group…
Ransomware Original (new tab)
DataBreaches.net · Web page · Published 1 Jan
Hacked on Christmas, DEphoto starts notifying customers, only to be attacked again
According to 0mid16B, they attacked DEphoto on December 25, and acquired the personal information of 555,952 customers, 429,597 orders with detailed personal information of 240,307 orders, and 16,213 records with plain text credit card details (full card…
Original (new tab)
DataBreaches.net · Web page · Published 22 Sep
DESORDEN leaks more data from Indonesia; "Indo data is officially worthless"
The DESORDEN group recently announced that due to the flood of personal information on Indonesians, they were giving up on attacking Indonesian entities. But they also noted that they already had some attacks in progress that they would still be leaking.…
Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.