Skip to content

Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,233 reports388 publishers50 added in the past week

821–840 of 1,024 reports · page 42 of 52 · Clear filters

Added Thu 9 Apr

DataBreaches.net · Web page · Published 2 Sep
Customer data from hundreds of Indonesian and Malaysian restaurants hacked by DESORDEN
Hackers known as DESORDEN have hit another big Indonesian business. This time, their victim was BOGA Group, which operates more than 200 restaurants and outlets across Indonesia and Malaysia under brand names including Bakerzin, Pepper Lunch, Paradise…
Original (new tab)
DataBreaches.net · Web page · Published 29 Jul
Alleged member of ShinyHunters held in Morocco on Interpol Red Notice, U.S. seeking extradition -- reports
A report by Vincent Monnier in a French news magazine, L’OBS, claims that an alleged member of ShinyHunters was arrested on June 1 as he attempted to board a flight at Rabat to Brussels. In translation, the report says: Arrested on June 1 at Rabat airport,…
Takedowns and arrests Original (new tab)
DataBreaches.net · Web page · Published 1 Jan
Los Angeles' Housing Authority hit by LockBit - Claim
If folks in Los Angeles were upset about the ransomware incident involving the Los Angeles Unified School District, they might want to buckle up before reading this: It appears that LockBit 3.0 has managed to compromise and exfiltrate data from the Housing…
Ransomware Original (new tab)
DataBreaches.net · Web page · Published 27 Feb
LAPSUS and the Terrible, Horrible, No Good, Very Bad Ransom Day 1 (UPDATED)
First they thought their victim hacked them back. Then they appeared to be trolled by a “negotiator” who wasn’t. I don’t know if the Brazilian threat actors who call themselves LAPSUS felt like moving to Australia after a bad day at the ransom office…
Ransomware Original (new tab)
DataBreaches.net · Web page · Published 16 Oct
Acer under fire: Now hackers claim to have hit Acer Taiwan, too
DESORDEN threat actors are still going after Acer, it seems. In addition to their recent revelation that they exfiltrated 60 GB of data from Acer India — a breach that Acer confirmed — they have alerted DataBreaches.net that they have also successfully…
Original (new tab)
DataBreaches.net · Web page · Published 17 Sep
"I'm Not Pro-Russia and I'm Not a Terrorist!" —- InfraGard and Airbus Hacker “USDoD” Unveils His New Campaigns
The first time DataBreaches remembers hearing about the man who calls himself “USDoD” was when he posted a sales listing for member data from InfraGard. He had not only managed to acquire data on 80,000 members of an organization dedicated to protecting…
Original (new tab)
DataBreaches.net · Web page · Published 6 Sep
ALTDOS claims some of their servers were seized but they did not lose data
It would be great if the good guys had backups as good as the threat actors have. Threat actors who call themselves “ALTDOS” have re-emerged after a brief hiatus that had left this site wondering if something had happened to them following a joint advisory…
Takedowns and arrests Original (new tab)
DataBreaches.net · Web page · Published 12 Sep
LockBit updates leak site with post about Sud-Francilien hospital
Weeks after everyone knew that LockBit was responsible for the attack, they added the hospital to their leak site and gave them nine more days to respond. Consistent with the usual rhetoric we see from threat actors in such circumstances, LockBit tries to put…
Ransomware Original (new tab)
DataBreaches.net · Web page · Published 15 Nov
AlphV files an SEC complaint against MeridianLink for not disclosing a breach to the SEC (2)
The attack was last Tuesday, November 7. According to AlphV, they did not encrypt any files, but did exfiltrate files. MeridianLink was aware of it the day it happened. According to AlphV, no security upgrades were made following the discovery, but “once we…
Ransomware Original (new tab)
DataBreaches.net · Web page · Published 3 Aug
Are Scattered Spider and ShinyHunters one group or two? And who did France arrest? (1)
When DataBreaches was a kid, the “new math” they were experimenting with had us learning binary and other systems. It didn’t go over well with us, our teachers, or our parents back then. Now the “new math” for me is UNCs — specifically 6040, 5537, 3944, and…
Takedowns and arrests Original (new tab)
DataBreaches.net · Web page · Published 3 Dec
AlphV claims an attack before even alerting the victim. How will that work out for them? (1)
So AlphV (aka BlackCat) is trying something different again, it seems. This time, it seems they are claiming a victim before they have even attempted to contact the victim or extort them. They post no proof of claims. They state that they are taking this…
Ransomware Original (new tab)
DataBreaches.net · Web page · Published 31 Jul
Thai entities continue to fall prey to cyberattacks and leaks
For over one year, DataBreaches.net has highlighted some breaches of ASEAN victims by groups such as ALTDOS and DESORDEN. In addition to those two groups, there are also numerous other leaks and breaches, as DataBreaches noted in our recent post about leaks…
Original (new tab)
DataBreaches.net · Web page · Published 31 Aug
One month later, Ranhill still hasn't fully recovered from cyberattack
On July 26, DataBreaches reported that DESORDEN had attacked Ranhill Utilities Berhad, a provider of water and power supply in Malaysia. At the time, DESORDEN claimed, in part: The initial data breach was initiated on Nov 2021. For over 18 months, DESORDEN…
Original (new tab)
DataBreaches.net · Web page · Published 1 Oct
Another Malaysia carrier allegedly hacked and data exfiltrated -- Skynet
Desorden Group, who recently claimed to have successfully breached ABX Express, has contacted DataBreaches.net to report yet another logistics firm breach. This time, the claimed victim is Skynet.com.my. Skynet is a carrier company in Malaysia that provides…
Original (new tab)
DataBreaches.net · Web page · Published 13 Sep
Singapore corporations making progress in preventing cyberattacks
It was a back-handed compliment of sorts: experienced hackers telling DataBreaches that it had gotten noticeably harder for them to successfully attack big corporations in Singapore. “The most difficult country to attack now, are Singapore companies,” they…
Vulnerabilities Original (new tab)
DataBreaches.net · Web page · Published 25 Aug
Major Indonesia tollroad operator hacked by DESORDEN (Updated)
On August 23, DESORDEN alerted DataBreaches to another one of their attacks. This one involved the PT JASAMARGA TOLLROAD OPERATOR, Indonesia’s largest major tollway and highway operator. According to DESORDEN’s statement: This data breach involved 252 GB of…
Original (new tab)
DataBreaches.net · Web page · Published 10 Mar
Bits 'n Pieces (Trozos y Piezas)
DataBreaches recently reported a malware attack on Chile’s National Health Fund (FONASA). There is an update to report: In a chat on Tox, BlackCat confirmed to DataBreaches that they are responsible for the attack and they say that they will announce it soon…
Ransomware Original (new tab)

Added Wed 8 Apr

Check Point · Web page · Published 15 Jul
MuddyWater Threat Group Deploys New BugSleep Backdoor
Check Point Research (CPR) warns that Iranian threat group MuddyWater has significantly increased its activities against Israel and is deploying a new, previously undocumented backdoor campaign. Key Findings MuddyWater, an Iranian threat group affiliated with…
State-sponsored Malware Original (new tab)
Check Point · Web page · Published 26 Nov
Bandook: Signed & Delivered
Check Point Research recently observed a new wave of campaigns against various targets worldwide that utilizes a strain of a 13-year old backdoor Trojan named Bandook. Bandook, which had almost disappeared from the threat landscape, was featured in 2015 and…
Malware Original (new tab)
Check Point · Web page · Published 12 Jun
Deep Dive into UPAS Kit vs. Kronos
In this post we will be analyzing the UPAS Kit and the Kronos banking Trojan, two malwares that have come under the spotlight recently due to the back story behind them. Background In May 2017, WannaCry wreaked havoc in over 150 countries and brought down…
Malware Takedowns and arrests Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.