Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,232 reports388 publishers49 added in the past week

901–920 of 1,023 reports · page 46 of 52 · Clear filters

Added Mon 6 Apr

BleepingComputer · Web page · Published 4 Jun
Google: Hackers target Salesforce accounts in data extortion attacks
Google has observed hackers claiming to be the ShinyHunters extortion group conducting social engineering attacks against multi-national companies to steal data from organizations' Salesforce platforms. According to Google's Threat Intelligence Group (GTIG),…
Ransomware Malware Original (new tab)
ETDA Threat Group Cards · Web page · Added 6 Apr
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool Gamaredon Tool: Gamaredon Names Gamaredon Category Malware Type Reconnaissance, Backdoor, Info stealer, Downloader Description (Palo Alto) The custom-developed malware is fully featured an…
State-sponsored Malware Original (new tab)
Unit 42 · Web page · Published 5 Oct
YiSpecter: First iOS Malware That Attacks Non-jailbroken Apple iOS Devices by Abusing Private APIs
We recently identified a new Apple iOS malware and named it YiSpecter. YiSpecter is different from previously seen iOS malware in that it attacks both jailbroken and non-jailbroken iOS devices through unique and harmful malicious behaviors. Specifically, it’s…
Malware Mobile Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
POWRUNER, Software S0184
POWRUNER may collect user account information by running net user /domain or a series of other commands on a victim.[1] Enterprise T1071 .001 Application Layer Protocol: Web Protocols POWRUNER can use HTTP for C2 communications.[1][2] .004 Application Layer…
Original (new tab)
Kroll · Web page · Published 5 May
A Deep Dive Into the Latest Maze Ransomware TTPs
With the recent attack on a Fortune 500 IT service provider, Maze ransomware is back in the news. Kroll incident response (IR) practitioners worked on multiple Maze ransomware cases during the first quarter of 2020 and have new insights on the tactics,…
Ransomware Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Detection of Exploitation of Remote Services, Detection Strategy DET0663
Privacy Policy Storage Preferences Targeted Advertising Personalization Analytics Source: https://attack.mitre.org/detectionstrategies/DET0663#AN1756
Vulnerabilities Original (new tab)
kubernetes.io · Web page · Added 6 Apr
Deploy and Access the Kubernetes Dashboard
Deploy the web UI (Kubernetes Dashboard) and access it. Kubernetes Dashboard is deprecated and unmaintained. The Kubernetes Dashboard project has been archived and is no longer actively maintained. For new installations, consider using Headlamp. Dashboard is…
Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Traffic Signaling (Port-knock / magic-packet → firewall or service activation) – T1205, Detection Strategy DET0524
A remote host sends a short sequence of failed connection attempts (RST/ICMP unreachable) to a set of closed ports. Within a brief window the endpoint (a) adds/enables a firewall rule or (b) a sniffer-backed process begins listening or opens a new socket,…
Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
APT19, Codoso, C0d0so0, Codoso Team, Sunshop Group, Group G0073
APT19 used HTTP for C2 communications. APT19 also used an HTTP malware variant to communicate over HTTP for C2.[1][4] Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder An APT19 HTTP malware variant establishes…
State-sponsored Malware Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Behavior-chain detection for T1132.001 Data Encoding: Standard Encoding (Base64/Hex/MIME) across Windows, Linux, macOS, ESXi, Detection Strategy DET0124
Process invokes a standard encoder (e.g., PowerShell -enc, certutil -encode, base64 via .NET/Invoke-Expression) or emits long Base64/hex literals → shortly followed by outbound network egress with high bytes_out:bytes_in ratio or HTTP headers/payloads…
Original (new tab)
The Record · Web page · Published 5 May
LockBit's seized darknet site resurrected by police, teasing new revelations
The ransomware service LockBit’s darknet extortion site, which had been shuttered earlier this year after being infiltrated by law enforcement, reappeared on Sunday with police teasing fresh information about the criminals involved. It follows the closure of…
Ransomware Takedowns and arrests Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Detection Strategy for Overwritten Process Arguments Masquerading, Detection Strategy DET0164
Detects adversary behavior where the command-line arguments of a running process are overwritten in memory to spoof the process name, typically replacing it with a benign or misleading string. The detection correlates unexpected null byte sequences,…
Original (new tab)
Elastic Security Labs · Web page · Published 31 Oct
How to hunt: The masquerade ball
Editor’s Note: Elastic joined forces with Endgame in October 2019, and has migrated some of the Endgame blog content to elastic.co. See Elastic Security to learn more about our integrated security solutions. Masquerading was once conducted by the wealthiest…
Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Detection Strategy for T1542.001 Pre-OS Boot: System Firmware, Detection Strategy DET0099
Unexpected write operations to BIOS/UEFI firmware regions or EFI boot partitions that do not correlate with legitimate vendor firmware updates. API calls or utilities such as fwupdate.exe or vendor flash tools executed from non-administrative or non-IT…
Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Detection of Cloud Accounts, Detection Strategy DET0879
Privacy Policy Storage Preferences Targeted Advertising Personalization Analytics Source: https://attack.mitre.org/detectionstrategies/DET0879#AN2011
Original (new tab)
cybersecurity.att.com · Web page · Added 6 Apr
Access Denied
You don't have permission to access "http://cybersecurity.att.com/blogs/labs-research/the-odd-case-of-a-gh0strat-variant" on this server. Reference #18.c48e655f.1775445034.ee10e49 Source:…
Original (new tab)
ETDA Threat Group Cards · Web page · Added 6 Apr
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool Defray777 Tool: Defray777 Names Defray777 Defray Defray 2018 Target777 Ransom X RansomExx Glushkov Category Malware Type Ransomware, Big Game Hunting Description (Palo Alto) Defray777 is an…
Ransomware Original (new tab)
Malpedia · Web page · Added 6 Apr
RogueRobinNET (Malware Family)
Latest Target Attack of DarkHydruns Group Against Middle East RogueRobinNET DarkHydrus 2019-01-08 ⋅ paloalto Netoworks: Unit42 ⋅ Bryan Lee, Robert Falcone DarkHydrus delivers new Trojan that can use Google Drive for C2 c
Malware Original (new tab)
ETDA Threat Group Cards · Web page · Added 6 Apr
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool KARAE Tool: KARAE Names KARAE Category Malware Type Reconnaissance, Backdoor, Info stealer, Exfiltration Description (FireEye) Karae backdoors are typically used as first-stage malware after…
Malware Original (new tab)
developer.android.com · Web page · Added 6 Apr
Task scheduling
When you want to execute tasks that will continue to run even if the app leaves the visible state, we recommend using the Jetpack library WorkManager. WorkManager features a robust scheduling mechanism that lets tasks persist across app restarts and device…
Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.