Research reports
1,224 reports from 387 publishers45 added in the past week
111 reports, newest added first
Added Mon 6 Apr
Software Discovery: Security Software Discovery, Sub-technique T1518.001 - Enterprise
ABK has the ability to identify the installed anti-virus product on the compromised host.[1] S1028 Action RAT Action RAT can identify AV products on an infected host using the following command: cmd.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2…
State-sponsoredMalware
Threat Group Cards: A Threat Actor Encyclopedia
Download this tool card in JSON format All groups using tool Jumpall Changed Name Country Observed APT groups APT 17, Deputy Dog, Elderwood, Sneaky Panda 2009-Jun 2024 APT 41 2012-Jul 2025 2 groups liste
State-sponsoredMalware
Modify Registry, Technique T1112 - Enterprise
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe , which in-turn launches the malware and communicates with C2 servers over the Internet. [11]. S0677…
State-sponsored
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool Gamaredon Tool: Gamaredon Names Gamaredon Category Malware Type Reconnaissance, Backdoor, Info stealer, Downloader Description (Palo Alto) The custom-developed malware is fully featured an…
State-sponsoredMalware
APT19, Codoso, C0d0so0, Codoso Team, Sunshop Group, Group G0073
APT19 used HTTP for C2 communications. APT19 also used an HTTP malware variant to communicate over HTTP for C2.[1][4] Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder An APT19 HTTP malware variant establishes…
State-sponsoredMalware
Havex
Havex malware, also known as Backdoor.Oldrea, is a Remote Access Trojan (RAT) employed by the Russian attributed APT group "Energetic Bear" or "Dragonfly".[1][2] Havex was discovered in 2013 and is one of five known ICS tailored malware developed in the past…
State-sponsoredMalwareMobile
Threat Group Cards: A Threat Actor Encyclopedia
(ESET) Rare is the APT group that goes largely undetected for nine years, but XDSpy is just that; a previously undocumented espionage group that has been active since 2011. It has attracted very little public attention, with the exception of an advisory from…
State-sponsored
Added Sun 5 Apr
Inside The Lab
Identifier: TRR250601. Summary This report examines recent activities we attribute to the XDSpy threat actor, focusing on an ongoing campaign targeting Eastern European and Russian governmental entities using the XDigo malware, dating back to March 2025. Our…
State-sponsoredMalware
Added Thu 29 Jan
Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdf
2 VIRUS BULLETIN CONFERENCE OCTOBER 2024 ABSTRACT In this paper we provide an in-depth analysis of UNC3569, a prolific and sophisticated threat actor operating within the Chinese cybercriminal and cyber contractor-for-hire ecosystem, mostly operating out of…
State-sponsoredVulnerabilities
Added Thu 22 Jan
Full report: Disrupting the first reported AI-orchestrated cyber espionage campaign
● Updated language in the Executive Summary (p.3) to clarify our high confidence in our attribution of the espionage operation. 2 Executive summary We have developed sophisticated safety and security measures to prevent the misuse of our AI models. While…
State-sponsored
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.