Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,281 reports398 publishers89 added in the past week

961–980 of 1,281 reports · page 49 of 65

Added Mon 6 Apr

MITRE ATT&CK · Web page · Added 6 Apr
Detection Strategy for Overwritten Process Arguments Masquerading, Detection Strategy DET0164
Detects adversary behavior where the command-line arguments of a running process are overwritten in memory to spoof the process name, typically replacing it with a benign or misleading string. The detection correlates unexpected null byte sequences,…
Original (new tab)
Elastic Security Labs · Web page · Published 31 Oct
How to hunt: The masquerade ball
Editor’s Note: Elastic joined forces with Endgame in October 2019, and has migrated some of the Endgame blog content to elastic.co. See Elastic Security to learn more about our integrated security solutions. Masquerading was once conducted by the wealthiest…
Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Detection Strategy for T1542.001 Pre-OS Boot: System Firmware, Detection Strategy DET0099
Unexpected write operations to BIOS/UEFI firmware regions or EFI boot partitions that do not correlate with legitimate vendor firmware updates. API calls or utilities such as fwupdate.exe or vendor flash tools executed from non-administrative or non-IT…
Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Detection of Cloud Accounts, Detection Strategy DET0879
Privacy Policy Storage Preferences Targeted Advertising Personalization Analytics Source: https://attack.mitre.org/detectionstrategies/DET0879#AN2011
Original (new tab)
cybersecurity.att.com · Web page · Added 6 Apr
Access Denied
You don't have permission to access "http://cybersecurity.att.com/blogs/labs-research/the-odd-case-of-a-gh0strat-variant" on this server. Reference #18.c48e655f.1775445034.ee10e49 Source:…
Original (new tab)
ETDA Threat Group Cards · Web page · Added 6 Apr
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool Defray777 Tool: Defray777 Names Defray777 Defray Defray 2018 Target777 Ransom X RansomExx Glushkov Category Malware Type Ransomware, Big Game Hunting Description (Palo Alto) Defray777 is an…
Ransomware Original (new tab)
Malpedia · Web page · Added 6 Apr
RogueRobinNET (Malware Family)
Latest Target Attack of DarkHydruns Group Against Middle East RogueRobinNET DarkHydrus 2019-01-08 ⋅ paloalto Netoworks: Unit42 ⋅ Bryan Lee, Robert Falcone DarkHydrus delivers new Trojan that can use Google Drive for C2 c
Malware Original (new tab)
ETDA Threat Group Cards · Web page · Added 6 Apr
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool KARAE Tool: KARAE Names KARAE Category Malware Type Reconnaissance, Backdoor, Info stealer, Exfiltration Description (FireEye) Karae backdoors are typically used as first-stage malware after…
Malware Original (new tab)
developer.android.com · Web page · Added 6 Apr
Task scheduling
When you want to execute tasks that will continue to run even if the app leaves the visible state, we recommend using the Jetpack library WorkManager. WorkManager features a robust scheduling mechanism that lets tasks persist across app restarts and device…
Original (new tab)
Cybereason · Web page · Added 6 Apr
THREAT ANALYSIS REPORT: Ragnar Locker Ransomware Targeting the Energy Sector
The Cybereason Global Security Operations Center (GSOC) Team issues Threat Analysis Reports to inform on impacting threats. The Threat Analysis Reports investigate these threats and provide practical recommendations for protecting against them. In this Threat…
Ransomware Original (new tab)
Threatpost · Web page · Published 31 Jan
Chewbacca Point-of-Sale Malware Campaign Found in 10 Countries
A criminal campaign using the Tor-based Chewbacca Trojan, which includes memory-scraping malware and a keylogger, is responsible for the theft of more than 49,000 credit card numbers in 10 countries. Before you think that RAM scraper malware was a phenomenon…
Malware Original (new tab)
Wikipedia · Web page · Published 14 Apr
Havex
Havex malware, also known as Backdoor.Oldrea, is a Remote Access Trojan (RAT) employed by the Russian attributed APT group "Energetic Bear" or "Dragonfly".[1][2] Havex was discovered in 2013 and is one of five known ICS tailored malware developed in the past…
State-sponsored Malware Mobile Original (new tab)
zecops.com · Web page · Added 6 Apr
Jamf Threat Labs
Meet Jamf: The most complete Apple device management and security solution. Learn More Solutions Products Products Empower your employees with our best-in-class products. Learn More Pricing Pricing Find the best set of Jamf tools for your budget. Pricing…
Original (new tab)
BleepingComputer · Web page · Published 13 Sep
New PsExec spinoff lets hackers bypass network security defenses
Security researchers have developed an implementation of the Sysinternals PsExec utility that allows moving laterally in a network using a single, less monitored port, Windows TCP port 135. PsExec is designed to help administrators execute processes remotely…
Original (new tab)
Unit 42 · Web page · Published 11 Jul
Evolving Tactics of SLOW#TEMPEST: A Deep Dive Into Advanced Malware Techniques
In late 2024, we discovered a malware variant related to the SLOW#TEMPEST campaign. In this research article, we explore the obfuscation techniques employed by the malware authors. We deep dive into these malware samples and highlight methods and code that…
Malware Original (new tab)
ETDA Threat Group Cards · Web page · Added 6 Apr
Threat Group Cards: A Threat Actor Encyclopedia
(ESET) Rare is the APT group that goes largely undetected for nine years, but XDSpy is just that; a previously undocumented espionage group that has been active since 2011. It has attracted very little public attention, with the exception of an advisory from…
State-sponsored Original (new tab)
Cisco Talos · Web page · Added 6 Apr
404 — Page not found
Original (new tab)
Microsoft · Web page · Added 6 Apr
Using Software Restriction Policies and AppLocker Policies
Applies To: Windows 7, Windows 8.1, Windows Server 2008 R2, Windows Server 2012 R2, Windows Server 2012, Windows 8 This topic for the IT professional describes how to use Software Restriction Policies (SRP) and AppLocker policies in the same Windows…
Original (new tab)
ETDA Threat Group Cards · Web page · Added 6 Apr
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool Sword2033 Tool: Sword2033 Names Sword2033 Category Malware Type Backdoor, Downloader, Exfiltration Description (Palo Alto) Pivoting on the C2 domain, we identified one additional sample that…
Malware Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
LockBit 3.0, Software S1202
Enterprise T1548 .002 Abuse Elevation Control Mechanism: Bypass User Account Control LockBit 3.0 can bypass UAC to execute code with elevated privileges through an elevated Component Object Model (COM) interface.[3] Enterprise T1071 .001 Application Layer…
Ransomware Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.