Research reports

NCSC (UK) · PDF · Added 10 Apr

BADBAZAAR and MOONSHINE: Spyware targeting Uyghur, Taiwanese and Tibetan groups and civil society actors

Summary With support from the UK Cyber League, this advisory has been jointly produced by the National Cyber Security Centre (NCSC UK) and international partners: > The Australian Cyber Security Centre, part of the Australian Signals Directorate > The

Intrinsec · PDF · Added 2 Apr

TLP-CLEAR-From-espionage-to-PsyOps-Tracking-operations-and-infrastructure-of-UACs-in-2025-EN-1.pdf

Àààààààààààààààààààààooàoàoooàlp) tter.com/I ntrinsec nkedin.co m/compa ny/intrinse c w.intrinsec .com/blog / w.intrinsec .com/blog /

resource.redcanary.com · PDF · Added 22 Mar

2025ThreatDetectionReport_RedCanary.pdf

Featured technique: Cloud Service Hijacking 64 Featured threat: Scarlet Goldfinch 40 Featured threat: Amber Albatross 42 Featured threat: Lumma

ptsecurity.com · PDF · Added 18 Mar

APT-Attacks-eng.pdf

Mandiant (Google) · PDF · Added 7 Mar

threat_horizons_report_h1_2025.pdf

Database Security: Critical Cloud Protection 14 Threat Actor Spotlight: UNC2165 Ransomware 16 and Data Theft Extortion Disrupting Financially Motivated Threat Actors 21 Conducting Cloud Hijacking Campaigns Growing Threat from Data Leak Sites Enabling 24…

first.org · PDF · Added 6 Mar

FIRSTCON23-TLPCLEAR-Sood-Compromising-the-Keys-to-the-Kingdom.pdf

• Author of “Targeted Cyber Attacks” and “Empirical Cloud Security” Books • W: https://www.adityaksood.com • T: @adityaksood • LinkedIn: https://www.linkedin.com/adityaks Disclaimer Research presented in this talk is for sharing intelligence with secur

Secureworks · PDF · Added 4 Mar

Learning from Incident Response January – March 2022

SUMMARY Secureworks® Counter Threat Unit™ (CTU) researchers analyzed data from reactive Secureworks incident response (IR) engagements completed between January and March 2023. This data provided CTU™ researchers with insight into emerging threats and…

CrowdStrike · PDF · Added 4 Mar

CrowdStrikeGlobalThreatReport2025.pdf

Watch any nature program, and you’ll quickly discover what happens to animals that underestimate their adversaries. They become prey. The same principle applies in cybersecurity — the adversary is advancing so fast that you can’t afford to underestimate them.…

patechcon.com · PDF · Added 4 Mar

Wherever you work, work safer with Google and CrowdStrike

5 Adversary Evasion Techniques in Action 6 Make the Switch: Modern Threats Require Modern Endpoint Security 11 About CrowdStrike 12 3Why Legacy AV Is an Easy Target Where Legacy AV Went Wrong If you take away one thing from this eBook, make it this: Legacy…

Mandiant (Google) · PDF · Added 4 Mar

m_trends_2023_report.pdf

Information Operations Surrounding Russia’s Invasion of Ukraine 63 Takeaways 64 North Korea’s Financial Operations Continue to Evolve 65 NFTs, Bridges, Ransomware and More: North Korean Cybercrime in 2022 67 Not Just Money: Continued Intelligence Collection…

Mandiant (Google) · PDF · Added 4 Mar

m-trends-2024.pdf

Artificial Intelligence in Red (and Purple) Team Operations 81 Conclusion 83 Bibliography 85 SPECIAL REPORT: MANDIANT M-TRENDS 2023 3

Secureworks · PDF · Added 4 Mar

Learning from Incident Response: 2022 Year in Review

Between January and December 2022, Secureworks® assisted in the containment and remediation of over 500 security incidents. Visibility of these real-world incidents provided Secureworks Counter Threat Unit™ (CTU) researchers with insight i

Secureworks · PDF · Added 4 Mar

2023 State of The Threat – A Year in Review

The Business of Cybercrime—Is Boomtime Back? Innovations in TTPs Occur When Infection Chains Are Forced to Evolve State-Sponsored Threat Activity Threat Actor Use of Artificial Intelligence Conclusion Appendix 03 04 07 36 43 66 69 70 The war in Ukraine…

SecurityScorecard · PDF · Added 23 Feb

Report_011325_Strike_Operation99.pdf

The SecurityScorecard STRIKE team has uncovered an ongoing cyberattack targeting software developers, orchestrated by the Lazarus Group, a North Korean state-sponsored hacking unit. Identified on January 9th and named Operation 99, this campaign builds on…

SecurityScorecard · PDF · Added 23 Feb

Operation-Phantom-Circuit-Report_012725_03.pdf

SecurityScorecard.com info@securityscorecard.com Background During STRIKE’s investigation of Operation 99, our team identified multiple command-and-control (C2) servers active since September 2024. These servers, despite variations in payload structure and…

Recorded Future · PDF · Added 23 Feb

RedMike (Salt Typhoon) Exploits Vulnerable Cisco Devices of Global Telecommunications Providers

Insikt group observed RedMike exploiting privilege escalation vulnerabilities CVE-2023-20198 and CVE-2023-20273 to compromise unpatched Cisco network devices running Cisco IOS XE software. RedMike compromised devices of a US-based affiliate of a UK…

fcc.gov · PDF · Added 23 Feb

DOC-408945A1.pdf

Proposes Swift Steps to Strengthen U.S. Communications from Future Cyberattacks WASHINGTON, January 16, 2025—Following recent reports involving an intrusion by foreign actors into U.S. communications networks, FCC Chairwoman Jessica Rosenworcel today…

SecurityScorecard · PDF · Added 23 Feb

Operation-Marstech-Mayhem-Report_021025_03.pdf

SecurityScorecard.com info@securityscorecard.com Background In the wake of Operation99 and Operation Phantom Circuit, STRIKE uncovered that the Lazarus Group had engineered an advanced implant, codenamed "marstech1." This state-of-the-art tool marks a…

ClearSky · PDF · Added 4 Feb

Zero-day-cve-2024-4351-report.pdf

CISA · PDF · Added 2 Feb

Contec CMS8000 Contains a Backdoor

Introduction The Cybersecurity and Infrastructure Security Agency (CISA) analyzed three versions of firmware for the Contec CMS8000, a patient monitor used by the Healthcare and Public Health sector, and discove