Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,281 reports398 publishers97 added in the past week

821–840 of 1,281 reports · page 42 of 65

Added Sat 11 Apr

DataBreaches.net · Web page · Published 18 Nov
From bad to worse: Doctor Alliance hacked again by same threat actor (2)
On November 12, DataBreaches reported that Doctor Alliance had allegedly been hacked by a threat actor who listed the data for sale on a clearnet forum. At the time, “Kazu” claimed to have 353 GB of data and had given Doctor Alliance a November 21 deadline to…
Vulnerabilities Original (new tab)
DataBreaches.net · Web page · Published 3 Nov
Update: Daixin leaks more data from Bluewater Health and other hospitals; databases yet to be leaked
As some will likely have already noticed, Daixin Team released the second part of the data leak from five hospitals in Ontario that have IT services provided by TransForm SSO. The first leak, containing many patient records, was previously reported by…
Original (new tab)
Check Point · Web page · Published 5 May
Nazar: Spirits of the Past
Those were some of the words that the Equation Group (NSA) operators left in the records documenting their attacks against target systems, and which were later leaked by the Shadow Brokers. The plethora of information exposed in the fifth and last leak by the…
Original (new tab)
DataBreaches.net · Web page · Published 31 Dec
Breaking: LockBit 3.0 gives Sick Kids free decryptor, claims to ban partner who attacked them
#LockBit has formally apologized for the attack on the Hospital for Sick Kids in Canada that took place on December 18. The hospital is still trying to recover from it. “We formally apologize for the attack on sikkids.ca and give back the decryptor for free,…
Ransomware Original (new tab)
DataBreaches.net · Web page · Published 8 Apr
East Tennessee Children's Hospital updates information on ransomware incident
On March 15, this site noted that the East Tennessee Children’s Hospital had posted a notice about an IT security incident. At the time, they did not identify the incident as a ransomware incident. DataBreaches.net subsequently found some explanation for that…
Ransomware Original (new tab)
DataBreaches.net · Web page · Published 20 Aug
Singapore real estate firm breached by ALTDOS
Singapore-based OrangeTee appears to have suffered a massive hack and data exfiltration by ALTDOS threat actors. “Your highly sophisticated work has exhausted us, both energy and financially,” the firm allegedly wrote to the threat actors on August 6. As this…
Original (new tab)
DataBreaches.net · Web page · Published 12 Feb
B&G Foods attacked by Daixin Team; files leaked
B&G Foods describes itself as a “multibillion dollar company with more than 50 brands and one purpose: Delicious food from our family to yours.” Some of the California firm’s brands are Crisco, Green Giant, Cinnamon Toast Crunch, Cream of Wheat, and Vermont…
Original (new tab)
Check Point · Web page · Published 22 Feb
The Story of Jian – How APT31 Stole and Used an Unknown Equation Group 0-Day
There is a theory which states that if anyone will ever manage to steal and use nation-grade cyber tools, any network would become untrusted, and the world would become a very dangerous place to live in. There is another theory which states that this has…
State-sponsored Vulnerabilities Original (new tab)

Added Fri 10 Apr

kienmanowar.wordpress.com · Web page · Published 11 May
Quick analysis note about DealPly (Adware)
DealPly adware abuses Microsoft, McAfee services to evade detection Adware.DealPly The post focuses on the following main sections: Unpack wrapper/loader to get main Dll payload. Decrypt C2url and strings are used in the malware code. Sample: SHA-256:…
Malware Original (new tab)
Medium · Web page · Published 15 Sep
Mapping and Pivoting from Cobalt Strike C2 Infrastructure Attributed to CVE-2021-40444
Threat Actors Infrastructure (VT Analysis). Pivoting from 45.147.229[.]242 Pivoting from 104.194.10[.]21 Pivoting from 45.153.240[.]220 Short summary and IOC’s. Press enter or click to view image in full size Threat Actors C
Vulnerabilities Original (new tab)
QiAnXin · Web page · Added 10 Apr
奇安信威胁情报中心
APT groups often use some uncommon file types to host malicious code in order to increase the probability of immunity against antivirus software, such as CD-ROM image files (.iso) and virtual hard disk files (.vhd), which we have monitored for abuse in recent…
State-sponsored Original (new tab)
Malwarebytes · Web page · Published 17 Mar
HelloKitty: When Cyberpunk met cy-purr-crime
On February 9, after discovering a compromise, CD Projekt Red (CDPR) announced to its 1+ million followers on Twitter that it was the victim of a ransomware attack against its systems (and made it clear they would not yield to the demands of the threat…
Ransomware Original (new tab)
US Department of Justice · Web page · Published 15 Feb
Foreign National Pleads Guilty to Role in Cybercrime Schemes Involving Tens of Millions of Dollars in Losses
A Ukrainian national pleaded guilty today to his role in two separate and wide-ranging malware schemes involving tens of millions of dollars in losses. “Vyacheslav Igorevich Penchukov was a leader of two prolific malware groups that infected thousands of…
Malware Takedowns and arrests Original (new tab)
SentinelOne · Web page · Published 12 Jul
Malware Discovered – SFG: Furtim Malware Analysis
Update, 14-July: There have been a number of stories published since the posting of this blog that have suggested this attack is specifically targeting SCADA energy management systems. We want to emphasize that we do not have any evidence that this is in fact…
Malware Original (new tab)
eSentire · Web page · Added 10 Apr
Initial Takeaways from the Black Basta Chat Leaks
The Black Basta ransomware group's internal chat logs, leaked on February 11, 2025, consist of nearly 200,000 Russian-language messages spanning September 18, 2023, to September 28, 2024. These logs, exposed by an individual known as "ExploitWhispers",…
Ransomware Original (new tab)
GitHub · Web page · Added 10 Apr
IoCs/Broadbased/frat.md at master · jeFF0Falltrades/IoCs
Note: I have not seen much coverage of this malware family. The name 'FRat' was derived from research by @James_inthe_box, seen in the linked Tweet thread below. If you have more information on this threat, please contact me on Twitter A RAT employing…
Malware Original (new tab)
d01a.github.io · Web page · Published 12 Apr
Aurora Stealer
The icon of the executable gives us a hit about how this is spreading. It has Photoshop icon, most probably it was spreading using Malvertising. First we want to know some basic information about the file so I will use DiE to do so. It was identified as GO…
Infostealers Original (new tab)
BleepingComputer · Web page · Published 11 May
Stealthier version of Linux BPFDoor malware spotted in the wild
BPFDoor is a stealthy backdoor malware that has been active since at least 2017 but was only discovered by security researchers around 12 months ago. The malware gets its name from the use of the 'Berkley Packet Filter' (BPF) for receiving instructions while…
Malware Original (new tab)
Cisco Talos · Web page · Published 4 Apr
Typhon Reborn V2: Updated stealer features enhanced anti-analysis and evasion capabilities
The developer of the Typhon Reborn information stealer released version 2 (V2) in January, which included significant updates to its codebase and improved capabilities. Most notably, the new version features additional anti-analysis and anti-virtual machine…
Infostealers Original (new tab)
Kaspersky · Web page · Published 4 May
Petya: the two-in-one trojan
Infecting the Master Boot Record (MBR) and encrypting files is nothing new in the world of malicious programs. Back in 1994, the virus OneHalf emerged that infected MBRs and encrypted the disk contents. However, that virus did not extort money. In 2011, MBR…
Ransomware Malware Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.