Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,289 reports400 publishers97 added in the past week

1,121–1,140 of 1,289 reports · page 57 of 65

Added Wed 23 Apr 2025

Black Hat · PDF · Added 23 Apr
us-17-Bohannon-Revoke-Obfuscation-PowerShell-Obfuscation-Detection-And Evasion-Using-Science-wp.pdf
Revoke-Obfuscation is the result of industry research collaboration between Daniel Bohannon - Senior Applied Security Researcher at Mandiant / FireEye, and Lee Holmes – Lead Security Architect of Azure Management at Microsoft. Background By far the most…
Malware Original (new tab)
CISA · PDF · Added 23 Apr
aa23-075a-stop-ransomware-lockbit.pdf
#StopRansomware advisories and to learn more about other ransomware threats and no-cost resources. The Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing & Analysis…
Ransomware Original (new tab)
CISA · PDF · Added 23 Apr
#StopRansomware: RansomHub Ransomware
To report suspicious or criminal activity related to information found in this joint Cybersecurity Advisory, contact your local FBI field office or CISA’s 24/7 Operations Center at Report@cisa.gov or (888) 282-0870. When available, please include the…
Ransomware Original (new tab)
icscsi.org · PDF · Added 23 Apr
The Industrial Control System Cyber Kill Chain
Cyber attacks on industrial control systems (ICS) differ in impact based on a number of factors, including the adversary’s intent, their sophistication and capabilities, and their familiarization with ICS and automated processes. Cyber attackers target…
Original (new tab)
Mandiant (Google) · PDF · Added 23 Apr
rpt-apt29-hammertoss-stealthy-tactics-define-en.pdf
Stage 1: The Communication Process Begins with Twitter 7 Figure 1: HAMMERTOSS calls out to a Twitter handle 7 Stage 2: Tweeting a URL, Minimum File Size of an Image, and Part of an Encryption Key 8 Figure 2: Learning the URL, image size, and encryption key 8…
State-sponsored Original (new tab)
Mandiant (Google) · PDF · Added 23 Apr
apt37-reaper-the-overlooked-north-korean-actor.pdf
On Feb. 2, 2018, we published a blog detailing the use of an Adobe Flash zero-day vulnerability (CVE-2018-4878) by a suspected North Korean cyber espionage group that we now track as APT37 (Reaper). Recent examination of this group’s activities by FireEye…
State-sponsored Malware Vulnerabilities Original (new tab)
CISA · PDF · Added 23 Apr
#StopRansomware: Akira Ransomware
To report suspicious or criminal activity related to information found in this joint Cybersecurity Advisory, contact your local FBI field office or CISA’s 24/7 Operations Center at Report@cisa.gov or (888) 282-0870. When available, please include the…
Ransomware Original (new tab)
Dragos · PDF · Added 23 Apr
Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_r2.pdf
What Is the Modbus Protocol? FrostyGoop ICS Malware Capabilities Optional Command Line Execution Arguments Configuration File Modbus TCP Network Traffic Logging Capabilities 2024 OT Cyber Attack Impacting Communities in Ukraine Assessing the Broader Impact on…
Malware Original (new tab)
cnn.com · PDF · Added 23 Apr
gru.indictment.pdf
PAVEL VYACHESLA VOVICH YERSHOV, ARTEM ANDREYEVICH MALYSHEV, ALEKSANDR VLADIMIROVICH OSADCHUK, ALEKSEY ALEKSANDROVICH POTEMKIN, and ANATOLIY SERGEYEVICH KOVALEV, Defendants. + ¢ & KF HF H FF HF EF He HF He HH HF RK HN HR HR H KH H HF HK * He HR RR RR CRIMINAL…
Takedowns and arrests Original (new tab)
FBI IC3 · PDF · Added 23 Apr
240502.pdf
To report suspicious or criminal activity related to information found in the Joint Cybersecurity Advisory, contact your local FBI field office or submit a report to the FBI Internet Crime Complaint Center (IC3). When available, please include the following…
Takedowns and arrests Original (new tab)
cdn2.hubspot.net · PDF · Added 23 Apr
CopyKittens.pdf
Malware Original (new tab)
papers.put.as · PDF · Added 23 Apr
RSA_2016.key
“leverages the best combina1on of humans and technology to discover security vulnerabili1es in our customers’ web apps, mobile apps, IoT devices and infrastructure endpoints” @patrickwardle security for the 21st century career hobby OUTLINE steps to a…
Malware Original (new tab)
Mandiant (Google) · PDF · Added 23 Apr
rpt-fin-10-anatomy-of-a-cyber-en.pdf
Lessons learned from investigating FIN10 and other disruptive breaches 12 Conclusion 14 Appendix - Sample Extortion Email 15
Ransomware Original (new tab)
mphasis.com · PDF · Added 23 Apr
scattered-spider-conducts-sim-swapping-attacks-12.pdf
The Scattered Spider threat group (AKA Roasted 0ktapus, UNC3944) has been financially motivated group primarily targets telecommunication service providers. the victims are usually large (Fortune 2000) organizations that have valuable intellectual property…
Ransomware Phishing Original (new tab)

Added Tue 22 Apr 2025

Dragos · PDF · Added 22 Apr
Dragos_Littleton_Electric_Water_CaseStudy.pdf
The utility’s challenges came to a head when a sophisticated threat group compromised their network to collect data on OT systems, necessitating swift action, expedited implementation of the Dragos Platform, and a rapid response by OT Watch. Dragos worked…
Original (new tab)
NVISO · PDF · Added 22 Apr
NVISO-BRICKSTORM-Report.pdf
China-nexus cluster UNC5221. NVISO investigates newly identified Windows-based BRICKSTORM variants, expanding on its previous presence in Linux environments. These backdoor samples, linked to long-term espionage campaigns, target European industries in key…
State-sponsored Malware Original (new tab)

Added Sat 12 Apr 2025

Recorded Future · PDF · Added 12 Apr
TAG-124’s Multi-Layered TDS Infrastructure and Extensive User Base
The operators behind TAG-124 show high levels of activity, frequently updating compromised WordPress sites, setting up new servers, and refining TDS-related conditional logic and infection techniques. Numerous threat actors have relied on or continue to use…
Ransomware Original (new tab)

Added Fri 11 Apr 2025

analyst1.com · PDF · Added 11 Apr
Anastasia-Inside-BlackBasta.pdf
April 2022. a group of cybercriminals calling themselves BlackBasta came together, determined to continue their illicit operations. At its core were former members of Conti, a ransomware group infamous for its high-profile attacks, including the Government of…
Ransomware Original (new tab)
trustwave.com · PDF · Added 11 Apr
A_Deep_Dive_into_the_Leaked_Black_Basta_Chat_Logs.pdf
• In February 2025, a leak of internal chat logs exposed Black Basta’s operations, uncovering part of their infrastructure and revealing insights into their tools, culture, tactics, and decision-making. • Black Basta operates as a highly disciplined business…
Ransomware Original (new tab)

Added Thu 10 Apr 2025

NCSC (UK) · PDF · Added 10 Apr
BADBAZAAR and MOONSHINE: Technical analysis and mitigations
With support from the UK Cyber League, this advisory has been jointly produced by the National Cyber Security Centre (NCSC UK) and international partners: > The Australian Cyber Security Centre, part of the Australian Signals Directorate > The Canadian Centre…
Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.