Research reports

megasecurity.org · PDF · Added 25 Aug

An Overview of Unix Rootkits

app.box.com · Web page · Added 1 Aug

Operation ShadowCat: Targeting Indian Political Observers via a Stealthy RAT

Cyble Research and Intelligence Labs (CRIL) came across an intriguing shortcut (.LNK) file masquerading as a legitimate Office document. When the user executes the LNK file, it triggers the infection process, which runs a PowerShell command to drop and…

GitHub · PDF · Added 26 Jul

APT41 Has Arisen From the DUST

Written by: Mike Stokkel, Pierre Gerlings, Renato Fontana, Luis Rocha, Jared Wilson, Stephen Eckels, Jonathan Lepore Executive Summary In collaboration with Google’s Threat Analysis Group (TAG), Mandiant has observed a sustained campaign by the advanced…

GitHub · PDF · Added 26 Jul

MoonWalk | ThreatLabz

GitHub · PDF · Added 26 Jul

DodgeBox | ThreatLabz

GitHub · PDF · Added 26 Jul

Arid Viper poisons Android apps with AridSpy

ESET researchers discovered Arid Viper espionage campaigns spreading trojanized apps to Android users in Egypt and Palestine Lukas Stefanko 13 Jun 2024 • 25 min. read ESET researchers have identified five campaigns targeting Android users with trojanized…

GitHub · PDF · Added 26 Jul

New BugSleep Backdoor Deployed in Recent MuddyWater Campaigns - Check Point Research

MuddyWater, an Iranian threat group affiliated with the Ministry of Intelligence and Security (MOIS), has significantly increased its activities in Israel since the beginning of the Israel-Hamas war in October 2023. This parallels with activities against…

macnica.co.jp · PDF · Added 25 Jul

cyberespionage_report_2023.pdf

JPCERT/CC · PDF · Added 25 Jul

JSAC2024_2_7_hara_shoji_higashi_vickie-su_nick-dai_en.pdf

JPCERT/CC · PDF · Added 25 Jul

JSAC2023_1_6_minakawa-saika-kubokawa_en.pdf

Overview 4 n Campaign using LODEINFO malware p Continuously observed for about 3 years since Dec. 2019 p Chinese state-backed APT group is behind (APT10?) n What we talk about to

Spamhaus · PDF · Added 23 Jul

Jan-Jun 2024 Botnet Threat Update.pdf

This report provides an overview of the number of botnet C&Cs associated with these elements, along with a quarterly comparison. We discuss the trends we are observing and highlight service providers struggling to control the number of botnet operators…

Recorded Future · PDF · Added 23 Jul

TAG-100 Uses Open-Source Tools in Suspected Global Espionage Campaign, Compromising Two Asia-Pacific Intergovernmental Bodies

The group employs open-source remote access capabilities and exploits a wide range of internet-facing appliances for initial access, including enterprise VPN, firewall, and email appliances. TAG-100 compromised two major Asia-Pacific intergovernmental…

ESET · PDF · Added 20 Jul

Hesperbot_Whitepaper.pdf

A new and effective banking trojan has been discovered targeting online banking users in Turkey, the Czech Republic, Portugal and the United Kingdom. It uses very credible-looking phishing-like campaigns, related to trustworthy organizations, to lure victims…

ANSSI (CERT-FR) · PDF · Added 20 Jul

CERTFR-2024-CTI-006.pdf

ANSSI considers that the Nobelium intrusion set, also calledMidnight Blizzard 1, has been active since at least Octo-ber 2020. It is actively used against high-value targets, most likely for espionage purposes. Phishing campaigns conducted by Nobelium…

files.speakerdeck.com · PDF · Added 11 Jul

hodur_recon2024.pdf

WHO AM I? • Takahiro Haruyama (@cci_forensics) • Principal Security Researcher at Binarly • Previously Staff Threat Researcher at Carbon Black TAU • Past Research • Scalable RE automation (e.g., hunting vulnerable drivers) • Anti-Forensics (e.g., firmware…

GitHub · PDF · Added 28 Jun

i-soon-data-leaks-en

On Feb. 16, 2024, someone uploaded data to GitHub that included possible internal company communications, sales-related materials and product manuals belonging to the Chinese IT security services company i-Soon, also known as Anxun Information Technology. The…

GitHub · PDF · Added 28 Jun

Pawn Storm Uses Brute Force and Stealth Against High-Value Targets

Pawn Storm Uses Brute Force and Stealth Against High-Value Targets | Trend Micro (US) APT & Targeted Attacks Pawn Storm Uses Brute Force and Stealth Against High-Value Targets To help defenders learn more about Pawn Storm's activities and adjust their…

GitHub · PDF · Added 28 Jun

Earth Lusca Uses Geopolitical Lure to Target Taiwan Before Elections

Earth Lusca Uses Geopolitical Lure to Target Taiwan Before Elections | Trend Micro (US) APT & Targeted Attacks Earth Lusca Uses Geopolitical Lure to Target Taiwan Before Elections During our monitoring of Earth Lusca, we noticed a new campaign that used…

GitHub · PDF · Added 28 Jun

i-soon-data-leaks-jp

2024 年 2 月 16 日、中国の IT セキュリティ サービス会社 i-Soon (別名 Anxun Information Technology) に属する可能性のある社内通信、セールス関連資料、製品マニュアルを含むデータが何者かによって GitHub にアップロードされました。漏えいした資料は、ある営利団体が、中国とつながりのある脅威アクターを支援するサイバー スパイ ツールをどのように開発・サポートしたかを示すもののようです。漏えいデータの初期調査の一環として、Unit 42…

GitHub · PDF · Added 27 Jun

chinese-apts-target-asean-entities-en

The first APT group, Stately Taurus, created two malware packages we believe targeted entities in Myanmar, the Philippines, Japan and Singapore. The timing of these campaigns coincided with the ASEAN-Australia Special Summit, held March 4-6, 2024. The second…