Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,232 reports388 publishers49 added in the past week

961–980 of 1,023 reports · page 49 of 52 · Clear filters

Added Sun 5 Apr

contagiodump.blogspot.com · Web page · Added 5 Apr
contagio
Contagio is a collection of the historic malware samples, threats, observations, and analyses. Malware samples are available for download by any responsible whitehat researcher. By downloading the samples, anyone waives all rights to claim punitive,…
Malware Original (new tab)
Trend Micro · Web page · Added 5 Apr
Research, News, and Perspectives
Weaponizing Trust Signals: Claude Code Lures and GitHub Release Payloads A packaging error in Anthropic’s Claude Code npm release briefly exposed internal source code. This entry examines how threat actors rapidly weaponized the resulting attention, pivoting…
Original (new tab)
prevailion.com · Web page · Published 5 Jun
Prevailion Blog
Prevailion’s Tailored Intelligence Team has detected two new criminal campaigns targeting the global financial industry with the EVILNUM malware, one of which became active on May 3rd 2020. We have dubbed these new operations “Phantom in the [Command] Shell”.…
Original (new tab)
HarfangLab · Web page · Added 5 Apr
Inside The Lab
Identifier: TRR250601. Summary This report examines recent activities we attribute to the XDSpy threat actor, focusing on an ongoing campaign targeting Eastern European and Russian governmental entities using the XDigo malware, dating back to March 2025. Our…
State-sponsored Malware Original (new tab)
tripwire.com · Web page · Published 10 Mar
Ragnar Locker ransomware - what you need to know
What is this Ragnar Locker thing I’ve heard about? Ragnar Locker is a family of ransomware, which first came to prominence in early 2020 when it became notorious for hitting large organisations, attempting to extort large amounts of cryptocurrency from its…
Ransomware Original (new tab)
Trend Micro · Web page · Published 26 Jan
Examining a Sodinokibi Attack
Sodinokibi was first detected in April 2019 and linked to the retired GandCrab. From that point on, Sodinokibi launched several high-profile attacks that continued throughout 2020, thus making a name for itself as one of the ransomware families that should be…
Original (new tab)
kienmanowar.wordpress.com · Web page · Published 16 Aug
Manual Unpacking IcedID Write-up
SHA256: 76cd290b236b11bd18d81e75e41682208e4c0a5701ce7834a9e289ea9e06eb7e Tools: PE files static analysis: PortExAnalyzer; PE-bear Debugger & plugin: x64dbg + ScyllaHide Anti-Anti-Debug Aplib decompress: aplib-ripper 1. Static Analysis Thow the sample to…
Original (new tab)
deepinstinct.com · Web page · Published 21 Sep
LockBit 2.0 Ransomware Becomes LockFile Ransomware with a Never-Before-Seen Encryption Method
Threat actors are constantly improving their attack mechanisms to gain an advantage over cybersecurity defenses. Sometimes this involves new malware; other times this means making iterative adjustments to previously successful malware to exploit new…
Ransomware Malware Vulnerabilities Original (new tab)
Intel 471 · Web page · Published 1 Apr
TA505’s modified loader means new attack campaign could be coming
After months of inactivity, hacking group TA505's Get2 Loader has sprung back into operation, possibly signaling that the group is ready for a new round of malicious activity. On December 14, 2020, the Get2 loader had resurfaced with new download and execute…
Malware Original (new tab)
GitHub · Web page · Added 5 Apr
GitHub - mauronz/binja-emotet
Deobufscate API calls and strings in unpacked Emotet samples. Description: Helper plugin for the analysis of unpacked Emotet samples. Locate dynamically imported API functions and add tags to make them easily searchable.
Original (new tab)
MITRE ATT&CK · Web page · Added 5 Apr
Detection of Local Data Staging Prior to Exfiltration, Detection Strategy DET0261
Detects file reads across locations followed by writes to temp or staging directories, often compressed or encrypted, indicating local staging behavior. Log Sources Mutable Elements Field Description StagingDirList Paths such as C:\Temp, C:\Windows\Tasks,…
Original (new tab)
MITRE ATT&CK · Web page · Added 5 Apr
Rc.common Mitigation, Mitigation T1163 - Enterprise
Privacy Policy Storage Preferences Targeted Advertising Personalization Analytics Source: https://attack.mitre.org/mitigations/T1163
Original (new tab)
bbc.com · Web page · Published 26 Jun
Russian hacker group Evil Corp targets US workers at home
The US presidential election is also just months away, and federal and local officials have been working to put measures in place to protect voter records as well as manage safe voting practices amid the pandemic. What do we know about the attack? Symantec…
Ransomware Original (new tab)
The Record · Web page · Published 4 Jul
Fort Worth officials say leaked data came from Public Information Act request
Officials in the City of Fort Worth, Texas denied being hacked for a second time after the same cybercrime group posted another batch of information allegedly stolen from government networks. On Saturday, the SiegedSec hacking group said its “final” attack…
Original (new tab)
itnews.com.au · Web page · Published 29 Mar
Nine Entertainment warns ransomware recovery 'will take time'
Nine Entertainment warned Monday night that it would be some time before it could fully restore core systems and connectivity following a ransomware infection over the weekend. Chief information and technology officer Damian Cronan said in a letter to staff…
Ransomware Original (new tab)
sans.org · Web page · Published 5 Oct
Cracked Brute Ratel C4 framework proliferates across the cybercriminal underground
Since mid-September, English-speaking and Russian-speaking cybercriminal underground forums having been buzzing with activity following the leaking and cracking of the Brute Ratel C4 (BRC4) post-exploitation toolkit. This significant event is exemplary of the…
Original (new tab)
Mandiant (Google) · Web page · Added 5 Apr
Access denied
Error 1006 Ray ID: 9e792ef5edb476a9 • 2026-04-05 14:18:40 UTC What happened? The owner of this website (internal-www.fireeye.com) has banned your IP address (89.47.190.8). Please see…
Original (new tab)
MITRE ATT&CK · Web page · Added 5 Apr
Tangelo, Software S0329
Privacy Policy Storage Preferences Targeted Advertising Personalization Analytics Source: https://attack.mitre.org/software/S0329
Original (new tab)
Fortinet · Web page · Published 5 Apr
Analysis of New Agent Tesla Spyware Variant
Recently, FortiGuard Labs captured a new malware sample that was spread via Microsoft Word documents. After some quick research, I discovered that this was a new variant of the Agent Tesla spyware. I analyzed another sample of this spyware last June and…
Malware Original (new tab)
MITRE ATT&CK · Web page · Added 5 Apr
Grandoreiro, Software S0531
Enterprise T1548 .002 Abuse Elevation Control Mechanism: Bypass User Account Control Grandoreiro can bypass UAC by registering as the default handler for .MSC files.[2] Enterprise T1087 .003 Account Discovery: Email Account Grandoreiro can parse Outlook .pst…
Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.