Research reports
1,224 reports from 387 publishers45 added in the past week
294 reports, newest added first
Added Thu 9 Jul
Amadey and StealC: Malware-as-a-Service Unavailable
On June 24, 2026, demonstrating the power of public-private collaboration, Europol and the Microsoft Digital Crimes Unit, alongside our team and other global partners, executed a coordinated disruption as part of Operation Endgame, impacting two of the most…
MalwareInfostealers
Threat Assessment: TeamPCP - CanisterWorm & Kubernetes Wiper Campaign
No excerpt available.
MalwareSupply chain
Added Fri 12 Jun
TA4922: The Suspected Chinese Crime Group is Going Global
TA4922 is a highly sophisticated threat actor demonstrating a rapid operational tempo and continually evolving malware arsenal. The group has been observed using multiple malware families including Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT…
Malware
Added Thu 11 Jun
StilachiRAT analysis: From system reconnaissance to cryptocurrency theft
In November 2024, Microsoft Incident Response researchers uncovered a novel remote access trojan (RAT) we named StilachiRAT that demonstrates sophisticated techniques to evade detection, persist in the target environment, and exfiltrate sensitive data.…
Malware
Added Wed 10 Jun
Blurring of Commodity and Targeted Attack Malware
As malware and its authors continue to evolve, deciphering the purpose of specific malware-driven attacks has become more challenging. While some malware still has a feature-specific design such as DDoS tools or spam bots, it is becoming increasingly common…
Malware
RemotePE: The Lazarus RAT that lives in memory
Last year, we published research1 about a North Korean Lazarus subgroup targeting financial and cryptocurrency organizations, encountered during multiple incident response engagements. This Lazarus subgroup overlaps with activity linked to AppleJeus2, Citrine…
State-sponsoredMalware
Under the Hood - LotusLite: Believe me I am MustangPanda
Under the Hood - The new series where We share stories from our daily life as a malware hunter 🔎 We’re kicking things off with a recent implant featuring “BelievemeIamMustang-Panda” and “Hi,Mustang_Panda” hardcoded in its .data section! A C2 over…
Malware
The Hades Campaign: Graph ML PyPI Packages Deploy Cross-Platform Memory Scrapers, AI Analyst Misdirection, and a Wiper Deterrent
On June 8, 2026, version 0.8.101 of the popular graph machine learning package ensmallen on PyPI was identified as containing a highly sophisticated supply chain compromise. Concurrently, a series of related packages in the computational biology,…
MalwareSupply chain
A rigged game: ScarCruft compromises gaming platform in a supply-chain attack
ESET researchers uncovered a multiplatform supply-chain attack by North Korea-aligned APT group ScarCruft, targeting the Yanbian region in China – home to ethnic Koreans and a crossing point for North Korean refugees and defectors. In the attack, probably…
MalwareSupply chainMobile
Added Thu 4 Jun
Behind the Clouds: Attackers Targeting Governments in Southeast Asia Implement Novel Covert C2 Communication
Since late 2024, Unit 42 researchers have been tracking a cluster of suspicious activity as CL-STA-1020, targeting governmental entities in Southeast Asia. The threat actors behind this cluster of activity have been collecting sensitive information from…
Malware
Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud
An MDR investigation correlated attacker infrastructure and endpoint telemetry to map the full operational model of Banana RAT, a banking trojan attributed to a threat activity cluster that TrendAI™ tracks as SHADOW-WATER-063. By correlating artifacts like…
Malware
DriveSurge Turns Trusted Websites Into ClickFix Malware Traps
A new DriveSurge campaign shows how a normal website visit can turn into a malware-installation prompt without the site owner or visitor realizing what happened. Silent Push researchers reported that the actor has compromised thousands of legitimate websites…
Malware
The HazyBeacon Protocol – How Malware Weaponizes Amazon Web Services (AWS) Lambda Function URLs
HazyBeacon (CL-STA-1020) targets Southeast Asian government networks by abusing AWS Lambda Function URLs configured with AuthType: NONE as stealth command-and-control relays. Attackers use stolen IAM credentials to deploy Lambda functions that proxy malware…
Malware
Added Wed 3 Jun
Detecting Nimbus Manticore and their sideloading infection chains
During a recent incident, we identified a sophisticated sideloading infection chain dropping a custom implant for data exfiltration. Further analysis allowed us to attribute the activity to the Iran-nexus APT group Nimbus Manticore, also tracked as UNC1549…
State-sponsoredMalware
Fast and Furious – Nimbus Manticore Operations During the Iranian Conflict
The Iranian, IRGC affiliated, threat actor Nimbus Manticore resurfaced during Operation Epic Fury, the US military campaign against Iran launched on February 28, 2026, demonstrating newly adopted techniques and enhanced capabilities. The campaign leveraged…
Malware
Added Thu 28 May
Analyzing Void Dokkaebi’s Cython-Compiled InvisibleFerret Malware
Void Dokkaebi, a North Korea-aligned intrusion set, has updated its information-stealing malware, InvisibleFerret, shifting its delivery format to evade script-based detections. Save to Folio Key takeaways Void Dokkaebi (aka Famous Chollima) has migrated…
Malware
Added Fri 22 May
Mustang Panda Strikes India and South Korea with Updated LOTUSLITE Backdoor in Espionage Campaign
China-linked Mustang Panda targets India banks & S.Korea policy via LOTUSLITE backdoor 22-Apr-2026 4 min read A China-linked threat group known as Mustang Panda has launched a dual‑faced espionage campaign targeting India’s banking sector and South Korea’s…
State-sponsoredMalware
LOTUSLITE: Targeted espionage leveraging geopolitical themes
Acronis Threat Research Unit (TRU) observed a targeted malware campaign against U.S. government entities leveraging a politically themed ZIP archive containing a loader executable and a malicious dynamic-link library (DLL). The executable is used to sideload…
State-sponsoredMalware
MustangPanda New Backdoor LotusLite
Chinese state-sponsored APT Mustang Panda has added a new undocumented C++ backdoor LotusLite to its arsenal targets the financial sectors in India , South Korea and U.S . The analyzed sample is a fully-featured Windows backdoor DLL disguised as a WPS Office…
State-sponsoredMalware
Red Shadows over Yangon: Analyzing TONESHELL Malware from Mustang Panda’s Campaign Against Myanmar
This report details a targeted malware campaign attributed to Mustang Panda, a Chinese APT group, leveraging a supposed compromised Myanmar embassy email to deliver malware against Myanmar’s entities. The campaign begins with a phishing email containing a…
State-sponsoredMalware
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.