Research reports
TopicAll topics
PublisherAll publishers
- All publishers1,289
- Check Point99
- DataBreaches.net51
- GitHub50
- MITRE ATT&CK44
- Mandiant (Google)34
- Microsoft31
- Group-IB29
- Recorded Future22
- Unit 4221
- ETDA Threat Group Cards20
- Medium20
- Trend Micro20
- CISA18
- ESET17
- Malpedia15
- Team Cymru15
- ANSSI (CERT-FR)13
- Intezer13
- US Department of Justice13
- Cisco Talos12
- FBI IC312
- Virus Bulletin11
- Elastic Security Labs10
- PhishLabs10
- The Hacker News10
- The Record10
- Intrinsec9
- Kaspersky9
- SecurityScorecard9
- Cybernews8
SortNewest added
981–1,000 of 1,289 reports · page 50 of 65
Added Mon 6 Apr
zecops.com · Web page · Added 6 Apr
Jamf Threat Labs
Meet Jamf: The most complete Apple device management and security solution. Learn More Solutions Products Products Empower your employees with our best-in-class products. Learn More Pricing Pricing Find the best set of Jamf tools for your budget. Pricing…
BleepingComputer · Web page · Published 13 Sep
New PsExec spinoff lets hackers bypass network security defenses
Security researchers have developed an implementation of the Sysinternals PsExec utility that allows moving laterally in a network using a single, less monitored port, Windows TCP port 135. PsExec is designed to help administrators execute processes remotely…
Unit 42 · Web page · Published 11 Jul
Evolving Tactics of SLOW#TEMPEST: A Deep Dive Into Advanced Malware Techniques
In late 2024, we discovered a malware variant related to the SLOW#TEMPEST campaign. In this research article, we explore the obfuscation techniques employed by the malware authors. We deep dive into these malware samples and highlight methods and code that…
ETDA Threat Group Cards · Web page · Added 6 Apr
Threat Group Cards: A Threat Actor Encyclopedia
(ESET) Rare is the APT group that goes largely undetected for nine years, but XDSpy is just that; a previously undocumented espionage group that has been active since 2011. It has attracted very little public attention, with the exception of an advisory from…
Microsoft · Web page · Added 6 Apr
Using Software Restriction Policies and AppLocker Policies
Applies To: Windows 7, Windows 8.1, Windows Server 2008 R2, Windows Server 2012 R2, Windows Server 2012, Windows 8 This topic for the IT professional describes how to use Software Restriction Policies (SRP) and AppLocker policies in the same Windows…
ETDA Threat Group Cards · Web page · Added 6 Apr
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool Sword2033 Tool: Sword2033 Names Sword2033 Category Malware Type Backdoor, Downloader, Exfiltration Description (Palo Alto) Pivoting on the C2 domain, we identified one additional sample that…
MITRE ATT&CK · Web page · Added 6 Apr
LockBit 3.0, Software S1202
Enterprise T1548 .002 Abuse Elevation Control Mechanism: Bypass User Account Control LockBit 3.0 can bypass UAC to execute code with elevated privileges through an elevated Component Object Model (COM) interface.[3] Enterprise T1071 .001 Application Layer…
developer.apple.com · Web page · Added 6 Apr
UIPasteboard
For sharing data with any other app, use the systemwide general pasteboard. For sharing data with another app from your team — that has the same team ID as the app to share from — configure an App Group. For more information about configuring an App Group,…
otx.alienvault.com · Web page · Added 6 Apr
LevelBlue - Open Threat Exchange
Pulses ( ) Users ( 0 ) Groups ( 0 ) Indicators ( ) Malware Families ( 0 ) Industries ( 0 ) Adversaries ( 0 ) Show: All Sort: Recently Modified Loading more Pulses Sort: Most Pulses Sort: Most Members Indicators Search Filter by: Reset Filters All Time Show…
ETDA Threat Group Cards · Web page · Added 6 Apr
Threat Group Cards: A Threat Actor Encyclopedia
Description A threat actor mentioned in a summary report only, so we don't know who they are yet. Information <https://cybersecuritylog.com/north-korean-hacker-recently-employed-social-media-to-launch-a-cyberattack> Last change to this card: 02 November 2021…
teusink.net · Web page · Added 6 Apr
Passwords stored using reversible encryption: how it works (part 1)
In case you missed my HAR2009 talk: in the second part I talked about a Windows feature called ‘Store passwords using reversible encryption’. When this is enabled (per user or for the entire domain), Windows stores the password encrypted, but in such a way…
Threatpost · Web page · Published 4 Feb
Ransomware Attack Hinders Toll Group Operations
Customers took to Twitter to air their grievances after some of the transportation giant’s operations were downed. Australian transportation and logistics giant Toll Group said a ransomware attack is to blame for several key services being debilitated and…
beta.documentcloud.org · Web page · Added 6 Apr
DoppelPaymer FBI PIN on Dec 10, 2020
Private Industry Notification. Local Field Offices: www.fbi.gov/contact-us/field-offices The following information is being provided by the FBI, with no guarantees or warranties, for potential use at the sole discretion of recipients to protect against cyber…
MITRE ATT&CK · Web page · Added 6 Apr
Execution, Tactic TA0041 - Mobile
The adversary is trying to run malicious code. Execution consists of techniques that result in adversary-controlled code running on a mobile device. Techniques that run malicious code are often paired with techniques from all other tactics to achieve broader…
Malpedia · Web page · Added 6 Apr
FinFisher (Malware Family)
Source: https://malpedia.caad.fkie.fraunhofer.de/details/apk.finfisher
Microsoft · Web page · Added 6 Apr
Set up Recovery Actions to Take Place When a Service Fails
Applies To: Windows 7, Windows 8, Windows Server 2008 R2, Windows Server 2012 If a service fails, you can use the Services snap-in to specify what action to take (for example, running a program or script) on the first or second service failure, or on…
Netskope · Web page · Published 10 Aug
New Phishing Attacks Exploiting OAuth Authorization Flows (Part 1)
This blog series expands upon a presentation given at DEF CON 29 on August 7, 2021. Phishing attacks are starting to evolve from the old-school faking of login pages that harvest passwords to attacks that abuse widely-used identity systems such as Microsoft…
MITRE ATT&CK · Web page · Added 6 Apr
Adversary-in-the-Middle: Evil Twin, Sub-technique T1557.004 - Enterprise
Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malicious networks as a way of supporting follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or Input Capture. [1] By using a Service Set…
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.