Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,281 reports398 publishers97 added in the past week

941–960 of 1,281 reports · page 48 of 65

Added Mon 6 Apr

Wikipedia · Web page · Published 21 Apr
Cutwail botnet
The Cutwail botnet, founded around 2007,[1] is a botnet mostly involved in sending spam e-mails. The bot is typically installed on infected machines by a Trojan component called Pushdo. [2] It affects computers running Microsoft Windows. [3] In June 2009 it…
Botnets and DDoS Original (new tab)
ETDA Threat Group Cards · Web page · Added 6 Apr
Threat Group Cards: A Threat Actor Encyclopedia
Download this tool card in JSON format All groups using tool Jumpall Changed Name Country Observed APT groups APT 17, Deputy Dog, Elderwood, Sneaky Panda 2009-Jun 2024 APT 41 2012-Jul 2025 2 groups liste
State-sponsored Malware Original (new tab)
Dark Reading · Web page · Published 17 Jun
CrowdStrike Falcon Traces Attacks Back To Hackers
Who's launching online attacks against your network? How can you better detect those attacks and -- if an attack turns out to be successful -- identify what was stolen? Enabling businesses to answer those questions is the premise of a cloud-based service…
Original (new tab)
Malpedia · Web page · Added 6 Apr
Croxloader (Malware Family)
Source: https://malpedia.caad.fkie.fraunhofer.de/details/win.croxloader
Malware Original (new tab)
JPCERT/CC · Web page · Published 5 Mar
Malware “TSCookie”
Around 17 January 2018, there were some reports on the social media about malicious emails purporting to be from Ministry of Education, Culture, Sports, Science and Technology of Japan [1]. This email contains a URL leading to a malware called “TSCookie”.…
Malware Original (new tab)
objective-see.com · Web page · Added 6 Apr
OSX.EvilQuest Uncovered
Our research, tools, and writing, are supported by the "Friends of Objective-See" such as: 📝 👾 Want to play along? I’ve added the sample (‘OSX.EvilQuest’) to our malware collection (password: infect3d) …please don’t infect yourself! Background In part one…
Ransomware Malware Original (new tab)
nzyme.org · Web page · Added 6 Apr
Network Monitoring
What is Network Monitoring? Nzyme works to protect your WiFi networks by consistently comparing the expected state of access points with the observed reality. For instance, if you configure nzyme with a list of all your access points, the activation of an…
Original (new tab)
arstechnica.com · Web page · Published 16 Nov
Meet PoisonTap, the $5 tool that ransacks password-protected computers
The perils of leaving computers unattended is about to get worse. Credit: Samy Kamkar Credit: Samy Kamkar The perils of leaving computers unattended just got worse, thanks to a newly released exploit tool that takes only 30 seconds to install a…
Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Modify Registry, Technique T1112 - Enterprise
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe , which in-turn launches the malware and communicates with C2 servers over the Internet. [11]. S0677…
State-sponsored Original (new tab)
BleepingComputer · Web page · Published 4 Jun
Google: Hackers target Salesforce accounts in data extortion attacks
Google has observed hackers claiming to be the ShinyHunters extortion group conducting social engineering attacks against multi-national companies to steal data from organizations' Salesforce platforms. According to Google's Threat Intelligence Group (GTIG),…
Ransomware Malware Original (new tab)
ETDA Threat Group Cards · Web page · Added 6 Apr
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool Gamaredon Tool: Gamaredon Names Gamaredon Category Malware Type Reconnaissance, Backdoor, Info stealer, Downloader Description (Palo Alto) The custom-developed malware is fully featured an…
State-sponsored Malware Original (new tab)
Unit 42 · Web page · Published 5 Oct
YiSpecter: First iOS Malware That Attacks Non-jailbroken Apple iOS Devices by Abusing Private APIs
We recently identified a new Apple iOS malware and named it YiSpecter. YiSpecter is different from previously seen iOS malware in that it attacks both jailbroken and non-jailbroken iOS devices through unique and harmful malicious behaviors. Specifically, it’s…
Malware Mobile Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
POWRUNER, Software S0184
POWRUNER may collect user account information by running net user /domain or a series of other commands on a victim.[1] Enterprise T1071 .001 Application Layer Protocol: Web Protocols POWRUNER can use HTTP for C2 communications.[1][2] .004 Application Layer…
Original (new tab)
Kroll · Web page · Published 5 May
A Deep Dive Into the Latest Maze Ransomware TTPs
With the recent attack on a Fortune 500 IT service provider, Maze ransomware is back in the news. Kroll incident response (IR) practitioners worked on multiple Maze ransomware cases during the first quarter of 2020 and have new insights on the tactics,…
Ransomware Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Detection of Exploitation of Remote Services, Detection Strategy DET0663
Privacy Policy Storage Preferences Targeted Advertising Personalization Analytics Source: https://attack.mitre.org/detectionstrategies/DET0663#AN1756
Vulnerabilities Original (new tab)
kubernetes.io · Web page · Added 6 Apr
Deploy and Access the Kubernetes Dashboard
Deploy the web UI (Kubernetes Dashboard) and access it. Kubernetes Dashboard is deprecated and unmaintained. The Kubernetes Dashboard project has been archived and is no longer actively maintained. For new installations, consider using Headlamp. Dashboard is…
Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Traffic Signaling (Port-knock / magic-packet → firewall or service activation) – T1205, Detection Strategy DET0524
A remote host sends a short sequence of failed connection attempts (RST/ICMP unreachable) to a set of closed ports. Within a brief window the endpoint (a) adds/enables a firewall rule or (b) a sniffer-backed process begins listening or opens a new socket,…
Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
APT19, Codoso, C0d0so0, Codoso Team, Sunshop Group, Group G0073
APT19 used HTTP for C2 communications. APT19 also used an HTTP malware variant to communicate over HTTP for C2.[1][4] Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder An APT19 HTTP malware variant establishes…
State-sponsored Malware Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Behavior-chain detection for T1132.001 Data Encoding: Standard Encoding (Base64/Hex/MIME) across Windows, Linux, macOS, ESXi, Detection Strategy DET0124
Process invokes a standard encoder (e.g., PowerShell -enc, certutil -encode, base64 via .NET/Invoke-Expression) or emits long Base64/hex literals → shortly followed by outbound network egress with high bytes_out:bytes_in ratio or HTTP headers/payloads…
Original (new tab)
The Record · Web page · Published 5 May
LockBit's seized darknet site resurrected by police, teasing new revelations
The ransomware service LockBit’s darknet extortion site, which had been shuttered earlier this year after being infiltrated by law enforcement, reappeared on Sunday with police teasing fresh information about the criminals involved. It follows the closure of…
Ransomware Takedowns and arrests Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.