Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,281 reports398 publishers97 added in the past week

841–860 of 1,281 reports · page 43 of 65

Added Fri 10 Apr

Check Point · Web page · Published 24 Apr
Deobfuscating APT32 Flow Graphs with Cutter and Radare2
The Ocean Lotus group, also known as APT32, is a threat actor which has been known to target East Asian countries such as Vietnam, Laos and the Philippines. The group strongly focuses on Vietnam, especially private sector companies that are investing in a…
State-sponsored Original (new tab)
chuongdong.com · Web page · Published 16 Jan
Babuk Ransomware v3
This is a short report for the latest Babuk ransomware sample. This sample is marked as version 3 based on the run-once mutex string. For this new version, the malware author keeps most of the old functionalities the same except for the encryption scheme and…
Ransomware Original (new tab)
embee-research.ghost.io · Web page · Published 20 Oct
Cobalt Strike Malware Analysis With CyberChef and Emulation - .HTA Loader Example
In this post. we will demonstrate a process for decoding a simple .hta loader used to load cobalt strike shellcode. We will perform initial analysis using a text editor, and use CyberChef to extract embedded shellcode. From here we will validate the shellcode…
Malware Original (new tab)
quosecgmbh.github.io · Web page · Added 10 Apr
Navigating QakBot samples with grap
This post demonstrates how to use grap to quickly find and analyse documented features (based on public reports) in published QakBot samples: All features and IOC described here are already published (see References) Samples are from Malpedia: win.qakbot We…
Malware Original (new tab)
ironnet.com · Web page · Added 10 Apr
Robin Banks still might be robbing your bank (part 2)
YES Source: https://www.ironnet.com/blog/robin-banks-still-might-be-robbing-your-bank-part-2
Original (new tab)
PRODAFT · Web page · Added 10 Apr
PRODAFT – Cyber Threat Intelligence and Risk Intelligence
Every day we intercept thousands of cyber threats & prevent next-generation attacks We provide actionable and timely intelligence right from the source, empowering your organization to proactively counter future threats. Why PRODAFT? Our Partners Our Numbers…
Original (new tab)
theregister.co.uk · Web page · Published 14 Sep
Malware burrows deep into computer BIOS to escape AV
Researchers have discovered one of the first pieces of malware ever used in the wild that modifies the software on the motherboard of infected computers to ensure the infection can't be easily eradicated. Known as Trojan.Mebromi, the rootkit reflashes the…
Malware Original (new tab)
Microsoft · Web page · Added 10 Apr
Microsoft Security Response Center Blog
Strengthening secure software at global scale: How MSRC is evolving with AI Tuesday, April 7, 2026 Cybersecurity has always been a race between defenders and attackers, constrained by human time, attention, and scale. What is changing now is the level of…
Original (new tab)
brighttalk.com · Web page · Published 10 Mar
A look at current cyberattacks in Ukraine
Costin Raiu, Marco Preuss, Kurt Baumgartner, Dan Demeter, Ivan Kwiatkowski About this talk Kaspersky researchers have been monitoring the activity of APT actors, cybercriminals and hacktivists currently involved in the conflict in Ukraine. During this…
Original (new tab)
vincss.net · Web page · Published 27 May
GuLoader AntiVM Techniques
Thời gian gần đây, Twitter của các chuyên gia nước ngoài liên tục xuất hiện hash tag #GuLoader, đây là một downloader phổ biến đang được các nhóm tin tặc sử dụng rộng rãi nhằm tải về mã độc chính lợi dụng các dịch vụ cloud của Google Drive và Microsoft…
Malware Original (new tab)
nur.pub · Web page · Published 16 Jun
Cerberus Analysis - Android Banking Trojan
Cerberus is an Android malware that emerged in 2019 but was allegedly used for special operations until two years ago. It has been determined by the analysts that it was not built on a banking trojan and the Anubis malware whose source code had leaked, or…
Malware Mobile Original (new tab)
threatresearch.ext.hp.com · Web page · Published 30 Jul
Detecting TA551 domains
TA551 are an active threat group known for distributing high volumes of malicious spam (malspam) that deliver different families of malware. Using a TA551 campaign delivering Ursnif as an example, we describe a typical infection chain, and explore potential…
Original (new tab)
splunk.com · Web page · Published 19 May
Threat Update: AcidRain Wiper
Splunk is committed to using inclusive and unbiased language. This blog post might contain terminology that we no longer use. For more information on our updated terminology and our stance on biased language, please visit our blog post. We appreciate your…
Malware Original (new tab)
Check Point · Web page · Published 10 Apr
The Muddy Waters of APT Attacks
The Iranian APT, MuddyWater, has been active since at least 2017. Most recently though, a new campaign, targeting Belarus, Turkey and Ukraine, has emerged that caught the attention of Check Point researchers. Ever since at least 2017, the attackers behind…
State-sponsored Original (new tab)
Trend Micro · Web page · Published 11 Sep
EvilAI Operators Use AI-Generated Code and Fake Apps for Far-Reaching Attacks
By Jeffrey Francis Bonaobra, Joshua Aquino, Emmanuel Panopio, Emmanuel Roll, Joshua Lijandro Tsang, Armando Nathaniel Pedragoza, Melvin Singwa, Mohammed Malubay, Marco Dela Vega ( words) Key takeaways EvilAI disguises itself as productivity or AI-enhanced…
Original (new tab)
streamscan.ai · Web page · Added 10 Apr
Analysis of the Ransomware Nitrogen
The aim of this analysis is to dissect the Nitrogen ransomware distributed by Nitrogen Ransomware Group to better understand how it works. This ransomware has much in common with the LukaLocker ransomware distributed by the Volcano Demon group. Source:…
Ransomware Original (new tab)
bi.zone · Web page · Published 17 Dec
Arcane Werewolf revamps its arsenal with Loki 2.1 implant
In October and November 2025, BI.ZONE Threat Intelligence observed malicious activity by Arcane Werewolf (Mythic Likho) targeting Russian manufacturing enterprises. Retrospective analysis suggests that the threat actor most likely used phishing emails as the…
Malware Phishing Original (new tab)
myonlinesecurity.co.uk · Web page · Published 25 Jun
More AgentTesla Keylogger And Nanocore RAT In One Bundle
We are seeing a continuation of even more AgentTesla malspam campaigns again this morning. However today’s is somewhat different to usual and also delivers a Nanocore RAT. Actually the Nanocore RAT is downloading the AgentTesla keylogger. And after a bit of…
Malware Original (new tab)

Added Thu 9 Apr

DataBreaches.net · Web page · Published 5 Aug
Scattered Spider is NOT quiet. They're just under another name now.
Following recent arrests of alleged Scattered Spider members in the UK, Google Cloud’s Mandiant Consulting has reported a noticeable pause in the group’s activities, offering a “critical window of opportunity” for organizations to bolster their defenses,…
Takedowns and arrests Original (new tab)
DataBreaches.net · Web page · Published 8 Aug
ShinyHunters sent Google an extortion demand; Shiny comments on current activities
Even the NSA can’t stop or identify us anymore. The FBI and everyone else is irrelevant and incompetent as far as we’re concerned :). When DataBreaches asked ShinyHunters if anything in particular had inspired that statement, “Shiny1” responded: I heard the…
Ransomware Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.