Research reports
1,224 reports from 387 publishers45 added in the past week
294 reports, newest added first
Added Tue 1 Sep
Carry-On Compromise: TA4922 Packs PackClient
August 27, 2026 Kyle Cucci, Rob Kinner, Tony Robinson and the Proofpoint Threat Research Team Key Findings Proofpoint identified a command and control (C2) framework called PackClient sold on Telegram. It is being used by at least one threat actor,…
Malware
North Korea’s Crypt: Hunting Ghosts
Here we are again. The Quetzal Team just returned from DEF CON Las Vegas after delivering talks and workshops about North Korean malware at the Adversary, Red Team, and Malware Villages, and having the honour of conquering the Main Stage. Nelson Colón from…
Malware
Added Sat 29 Aug
shrun, apiwatcher, and argus: three malware analysis tools built with Claude
It has been a while since my last blog post. In this one I'll present my experiment with using build three Rust-based tools that ease my malware analysis workflow The Malware: Lorem Ipsum I'll present three tools I built with Claude to analyze the Lorem Ipsum…
Malware
Added Tue 25 Aug
CNCMahineRMS
A ClickFix lure. A legitimately signed IBM SPSS IDE. Four side-loaded DLLs. A date formatting API used as a trampoline. And at the end of it all, a 1.14 MB implant that calls itself Most writeups of a BabaDeda intrusion stop at the loader and conclude with a…
Malware
CNCMachineRMS C2 Protocol
This post describes the binary command-and-control (C2) protocol used by CNCMachineRMS, a recently identified remote access trojan (RAT). We cover how the protocol was discovered, how its infrastructure was identified, and how network defenders can detect it.…
Malware
Added Fri 21 Aug
C2Looper Backdoor Uses GitHub for C2
In the following sections, ThreatLabz examines the technical details of the identified C2Looper variants, including their features, network communication protocols and commands. String encryption and Windows API resolution All identified C2Looper variants use…
Malware
Added Fri 14 Aug
TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains
Elastic Security Labs is tracking an emerging threat named TELEPUZ, which we have discovered spreading widely via a CLICKFIX-VIDAR chain. This malware is in active development and has been operating since late April 2026, according to the infrastructure…
MalwareInfostealers
Added Fri 7 Aug
Analysis of the Connection Between Xctdoor and Past CRAT Attack Cases (Larva-26005)
AhnLab SEcurity intelligence Center (ASEC) recently confirmed that the Larva-26005 threat actor is distributing Xctdoor to users in Korea. Xctdoor was disclosed through the ASEC blog in 2024, and [1] In March 2026, Hauri disclosed an attack case in which the…
Malware
Analysis of a Phishing Email Attack Case by the Larva-24009 Threat Actor
The Larva-24009 threat actor has been active since at least 2023, carrying out phishing email attacks targeting users both in Korea and globally to install malware. ASEC (AhnLab SEcurity intelligence Center (ASEC) has previously disclosed attack cases by this…
MalwarePhishing
Added Thu 6 Aug
CanisterWorm Gets Teeth: TeamPCP's Kubernetes Wiper Targets Iran
We found a new payload in the TeamPCP arsenal, and this one doesn't just steal credentials or install backdoors. It wipes entire Kubernetes clusters. The script uses the exact same ICP canister ( tdtqy-oyaaa-aaaae-af2dq-cai[.]raw[.]icp0[.]io ) we documented…
Malware
KICS GitHub Action Compromised: TeamPCP Strikes Again in Supply Chain Attack
The KICS GitHub Action was compromised with credential-stealing malware by TeamPCP, the same group behind the Trivy attack. KICS is an open source infrastructure as code security scanner by Checkmarx. Between 12:58 and 16:50 UTC on March 23rd, any users of…
MalwareSupply chain
New Destructive Wiper ZeroCleare Targets Energy Sector in the Middle East
IBM X-Force has been researching and tracking destructive malware in the Middle East for some time now, particularly in the industrial and energy sectors. Since the first Shamoon attacks that started impacting organizations in the region in the summer of…
Malware
Added Wed 5 Aug
Exposing Fox Tempest: A malware-signing service operation
Fox Tempest is a financially motivated threat actor that operates a malware-signing-as-a-service (MSaaS) used by other cybercriminals to more effectively distribute malicious code, including ransomware. The threat actor abuses Microsoft Artifact Signing to…
Malware
Disrupting Fox Tempest: A cybercrime service that turned “verified” software into a pathway for ransomware
Every day, we decide what software to trust in seconds guided by simple labels such as “verified,” “secure,” and “safe to install.” The problem is that those signs can be manipulated. Today, Microsoft unsealed a legal case in the US District Court for the…
RansomwareMalware
Microsoft disrupts Fox Tempest malware-signing-as-a-service platform tied to ransomware gangs
Microsoft said it took down a critical service that helped cybercriminals slip through defenses by making malware look like legitimate software. The company unsealed a legal case in U.S. District Court on Tuesday detailing the disruption of Fox Tempest — a…
RansomwareMalware
Added Tue 4 Aug
Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution Ecosystem
Check Point Research investigated a large-scale operation that impersonates open-source and freeware projects to capture search traffic, including lookalikes for researcher and security tooling such as Ghidra, dnSpy, and SpiderFoot. The sites are…
Malware
CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft
Since early May 2026, Microsoft Threat Intelligence has observed Storm-2945, a sub-cluster of Midnight Blizzard, conducting widespread but targeted traffic manipulation attacks involving hospitality sector networks served by captive portals worldwide. Despite…
State-sponsoredMalware
1337_GTWK Linux Malware Analysis
This is the second part of a two-part series about a new Linux malware sample that I analysed (Click here for Part 1). In Part 1, we examined its website and the malware’ itself. The malware consists of two stages, with the second stage comprising two…
Malware
Added Fri 31 Jul
MetaStealer traffic, new DGAs and analyzing the “tracker” backdoor DGA with AI
In this blog we simply want to highlight a few new additions to what appears to be related to MetaStealer, one is a new wordlist based DGA used by MetaStealer. We also want to highlight that MetaStealer’s proxies or ‘gates’ don’t actually care what domain…
Malware
Joyfill npm Packages Compromised with Blockchain C2 Loader
Two beta versions published to the @joyfill npm scope on July 28, 2026 carried the same blockchain C2 loader documented in the astro.config.mjs attack. The compromised packages are @joyfill/layouts@0.1.2-2773.beta.0 and…
MalwareSupply chain
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.