Research reports

Unit 42 - Latest Cyber Security Research

Critical infrastructure is changing. Security must change with it. As industrial systems become more connected, converge with IT, and adopt AI and automation, cyber risk increasingly extends beyond data to affect physical operations. Understanding how these…

🇬🇧 Houken seeking a path by living on the edge with zero-days

Objet : 🇬🇧 Houken seeking a path by living on the edge with zero-days Gestion du document Référence CERTFR-2025-CTI-009 Titre 🇬🇧 Houken seeking a path by living on the edge with zero-days Date de la première version 01 juillet 2025 Date de la dernière…

Vulnerabilities

Fast Flux Networks Working and Detection, Part 2

With the assumption that readers have read Part 1 of this topic, this article will contain the other part of this article, i.e. what benefits an attacker gets from flux networks, why it is difficult to detect flux networks in your environments, and…

Rewterz Threat Alert – Leaked Conti Ransomware Used to Target Russia - Active IOCs

Conti ransomware was discovered in December 2019 and is delivered via TrickBot. It’s been utilized against large companies and government institutions across the world, especially in North America. Conti steals important files and information from targeted…

Ransomware

Metasploit Unleashed

The VNC Authentication None Scanner is an Auxiliary Module for Metasploit. This tool will search a range of IP addresses looking for targets that are running a VNC Server without a password configured. Pretty well every administrator worth his/her salt sets a…

Unit 42 - Latest Cyber Security Research

Critical infrastructure is changing. Security must change with it. As industrial systems become more connected, converge with IT, and adopt AI and automation, cyber risk increasingly extends beyond data to affect physical operations. Understanding how these…

Kudelski Security Research

Clifford (Kudelski Security), Coline C., Saee V. and the Sekoia TDR Team. This research was conducted in partnership between Kudelski Security and Sekoia, with contributions from Clifford (Kudelski Security), Coline C., Saee V. and the Sekoia TDR Team. Key…

Chinese Nation-State Hackers Target U.S in Operation TradeSecret, Report Claims

The National Foreign Trade Council (NFTC) website was allegedly infiltrated by Chinese nation-state threat actors, according to a new report from Fidelis Cybersecurity. The attack against the NFTC site has been dubbed ‘Operation TradeSecret’ by Fidelis and is…

State-sponsored

Unit 42 - Latest Cyber Security Research

Critical infrastructure is changing. Security must change with it. As industrial systems become more connected, converge with IT, and adopt AI and automation, cyber risk increasingly extends beyond data to affect physical operations. Understanding how these…

LARVA-208

(EncryptHub) is a threat actor that has come to the forefront with highly sophisticated spear-phishing attacks since 26 June 2024. In the attacks it has carried out, it exhibits a different operational strategy by carrying out all the processes necessary to…

Phishing

Hack Brief: Emergency-Number Hack Bypasses Android Lock Screens

If you protect your Android phone with a password rather than an unlock pattern or PIN, you may want to keep it in your sight a little more carefully than usual. A new, dead-simple attack could allow anyone who gets their hands on it to bypass that password…

Mobile

Unit 42 - Latest Cyber Security Research

Critical infrastructure is changing. Security must change with it. As industrial systems become more connected, converge with IT, and adopt AI and automation, cyber risk increasingly extends beyond data to affect physical operations. Understanding how these…

Linked Devices

You can link a Desktop, iPad, iPhone, or Android device (tablet or phone) to your primary Signal Device. All Signal communication on linked devices is private, just like your smartphone. Note: A device can only be linked a device during the registration flow,…

Mobile

Unit 42 - Latest Cyber Security Research

Critical infrastructure is changing. Security must change with it. As industrial systems become more connected, converge with IT, and adopt AI and automation, cyber risk increasingly extends beyond data to affect physical operations. Understanding how these…

Unit 42 - Latest Cyber Security Research

Critical infrastructure is changing. Security must change with it. As industrial systems become more connected, converge with IT, and adopt AI and automation, cyber risk increasingly extends beyond data to affect physical operations. Understanding how these…

Taiwan High-Tech Ecosystem Targeted by Foreign APT Group:

2019 was an excellent year for the Taiwan superconductor industry; however, beneath this economic upturn, a digital chimera was slowly eating at it from within. Throughout 2019, multiple companies in the Taiwan high-tech ecosystem were victims of an advanced…

State-sponsored

Animal Farm APT and the Shadow of French Intelligence

Almost every government is working to improve its cyber-capabilities. The majority of them already have in their arsenal powerful espionage malware and hacking platforms. We read about the techniques and tactics implemented by a number of APT groups from…

State-sponsoredMalware

ceranakeeper.pdf

No excerpt available.

cti/runster/readme.md at main · cert-orangecyberdefense/cti

Update (2026-06-17): our related "Payload C" is likely tied to MetaStealer and was recently detailed by Huntress, which named it Potemkin loader. Another blog by Walmart on this new DGA is available here. Orange Cyberdefense CERT has been tracking a…

Malware

Why Are You Texting Me? UNC3944 Leverages SMS Phishing Campaigns for SIM Swapping, Ransomware, Extortion, and Notoriety

UNC3944 is a financially motivated threat cluster that has persistently used phone-based social engineering and SMS phishing campaigns (smishing) to obtain credentials to gain and escalate access to victim organizations. At least some UNC3944 threat actors…

RansomwareState-sponsoredPhishing