Research reports
1,224 reports from 387 publishers45 added in the past week
166 reports, newest added first
Added Mon 6 Apr
Software Discovery: Security Software Discovery, Sub-technique T1518.001 - Enterprise
ABK has the ability to identify the installed anti-virus product on the compromised host.[1] S1028 Action RAT Action RAT can identify AV products on an infected host using the following command: cmd.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2…
State-sponsoredMalware
Threat Group Cards: A Threat Actor Encyclopedia
Download this tool card in JSON format All groups using tool Jumpall Changed Name Country Observed APT groups APT 17, Deputy Dog, Elderwood, Sneaky Panda 2009-Jun 2024 APT 41 2012-Jul 2025 2 groups liste
State-sponsoredMalware
Modify Registry, Technique T1112 - Enterprise
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe , which in-turn launches the malware and communicates with C2 servers over the Internet. [11]. S0677…
State-sponsored
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool Gamaredon Tool: Gamaredon Names Gamaredon Category Malware Type Reconnaissance, Backdoor, Info stealer, Downloader Description (Palo Alto) The custom-developed malware is fully featured an…
State-sponsoredMalware
APT19, Codoso, C0d0so0, Codoso Team, Sunshop Group, Group G0073
APT19 used HTTP for C2 communications. APT19 also used an HTTP malware variant to communicate over HTTP for C2.[1][4] Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder An APT19 HTTP malware variant establishes…
State-sponsoredMalware
Havex
Havex malware, also known as Backdoor.Oldrea, is a Remote Access Trojan (RAT) employed by the Russian attributed APT group "Energetic Bear" or "Dragonfly".[1][2] Havex was discovered in 2013 and is one of five known ICS tailored malware developed in the past…
State-sponsoredMalwareMobile
Threat Group Cards: A Threat Actor Encyclopedia
(ESET) Rare is the APT group that goes largely undetected for nine years, but XDSpy is just that; a previously undocumented espionage group that has been active since 2011. It has attracted very little public attention, with the exception of an advisory from…
State-sponsored
Added Sun 5 Apr
Inside The Lab
Identifier: TRR250601. Summary This report examines recent activities we attribute to the XDSpy threat actor, focusing on an ongoing campaign targeting Eastern European and Russian governmental entities using the XDigo malware, dating back to March 2025. Our…
State-sponsoredMalware
Added Thu 29 Jan
Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdf
2 VIRUS BULLETIN CONFERENCE OCTOBER 2024 ABSTRACT In this paper we provide an in-depth analysis of UNC3569, a prolific and sophisticated threat actor operating within the Chinese cybercriminal and cyber contractor-for-hire ecosystem, mostly operating out of…
State-sponsoredVulnerabilities
Added Thu 22 Jan
Full report: Disrupting the first reported AI-orchestrated cyber espionage campaign
● Updated language in the Executive Summary (p.3) to clarify our high confidence in our attribution of the espionage operation. 2 Executive summary We have developed sophisticated safety and security measures to prevent the misuse of our AI models. While…
State-sponsored
Added Thu 16 Oct 2025
Botconf2022-19-FaouCoteCyr.pdf
Operation Cache Panda: Zero-Day in Financial Software Exploited by China-Linked Threat Group Valentine’s Day this year saw the end of a truly toxic relationship — a prolonged supply chain attack targeting the Taiwan financial and securities trading sector…
State-sponsoredMalwareVulnerabilities
Added Sun 17 Aug 2025
How-North-Korea-Backed-Lazarus-Group-is-Weaponizing-Open-Source-Whitepaper.pdf
How North Korea-Backed Lazarus Group Is Weaponizing Open Source to Target Developers 1 How North Korea-Backed Lazarus Group Is Weaponizing Open Source to Target Developers Sonatype Security Research How North Korea-Backed Lazarus Group Is Weaponizing Open…
State-sponsoredMalware
Added Sat 16 Aug 2025
Kimsuky Threat Research Report-2
From Reconnaissance to Control APT The Operational Blueprint of Kimsuky for Cyber Espionage Varadharajan Krishnasamy and Aditya K Sood www.aryaka.com From Reconnaissance to Control: The Operational Blueprint of Kimsuky APT for Cyber Espionage - Report 2 Ta bl…
State-sponsored
Added Wed 21 May 2025
ESET APT Activity Report Q4 2024-Q1 2025
WIPERS, PHISHING, AND UNPATCHED VULNERABILITIES October 2024 – March 2025 Report ESET APT ACTIVITY REPORT OCTOBER 2024 - MARCH 2025 | 2 Contents Executive summary� 3 Attackers and targets� 5 China-aligned groups � 6 China-aligned threat landscape in Europe� 7…
State-sponsoredPhishing
Added Sat 3 May 2025
CERTFR-2025-CTI-007.pdf
ANSSI, alongside its partners at the Cyber Crisis Coordination Centre (C4), has observed the targeting and compromise of French entities by the APT28 intrusion set. Since 2021, this intrusion set has been used to gather strategic intelligence from entities…
State-sponsored
Added Wed 23 Apr 2025
rpt-apt29-hammertoss-stealthy-tactics-define-en.pdf
Stage 1: The Communication Process Begins with Twitter 7 Figure 1: HAMMERTOSS calls out to a Twitter handle 7 Stage 2: Tweeting a URL, Minimum File Size of an Image, and Part of an Encryption Key 8 Figure 2: Learning the URL, image size, and encryption key 8…
State-sponsored
apt37-reaper-the-overlooked-north-korean-actor.pdf
On Feb. 2, 2018, we published a blog detailing the use of an Adobe Flash zero-day vulnerability (CVE-2018-4878) by a suspected North Korean cyber espionage group that we now track as APT37 (Reaper). Recent examination of this group’s activities by FireEye…
State-sponsoredMalwareVulnerabilities
Added Tue 22 Apr 2025
NVISO-BRICKSTORM-Report.pdf
China-nexus cluster UNC5221. NVISO investigates newly identified Windows-based BRICKSTORM variants, expanding on its previous presence in Linux environments. These backdoor samples, linked to long-term espionage campaigns, target European industries in key…
State-sponsoredMalware
Added Wed 2 Apr 2025
TLP-CLEAR-From-espionage-to-PsyOps-Tracking-operations-and-infrastructure-of-UACs-in-2025-EN-1.pdf
Àààààààààààààààààààààooàoàoooàlp) tter.com/I ntrinsec nkedin.co m/compa ny/intrinse c w.intrinsec .com/blog / w.intrinsec .com/blog /
State-sponsored
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.