Research reports
1,224 reports from 387 publishers45 added in the past week
166 reports, newest added first
Added Tue 18 Mar 2025
Added Tue 4 Mar 2025
2023 State of The Threat – A Year in Review
The Business of Cybercrime—Is Boomtime Back? Innovations in TTPs Occur When Infection Chains Are Forced to Evolve State-Sponsored Threat Activity Threat Actor Use of Artificial Intelligence Conclusion Appendix 03 04 07 36 43 66 69 70 The war in Ukraine…
State-sponsored
Added Sun 23 Feb 2025
Report_011325_Strike_Operation99.pdf
The SecurityScorecard STRIKE team has uncovered an ongoing cyberattack targeting software developers, orchestrated by the Lazarus Group, a North Korean state-sponsored hacking unit. Identified on January 9th and named Operation 99, this campaign builds on…
State-sponsored
RedMike (Salt Typhoon) Exploits Vulnerable Cisco Devices of Global Telecommunications Providers
Insikt group observed RedMike exploiting privilege escalation vulnerabilities CVE-2023-20198 and CVE-2023-20273 to compromise unpatched Cisco network devices running Cisco IOS XE software. RedMike compromised devices of a US-based affiliate of a UK…
State-sponsoredVulnerabilities
DOC-408945A1.pdf
Proposes Swift Steps to Strengthen U.S. Communications from Future Cyberattacks WASHINGTON, January 16, 2025—Following recent reports involving an intrusion by foreign actors into U.S. communications networks, FCC Chairwoman Jessica Rosenworcel today…
State-sponsored
Operation-Marstech-Mayhem-Report_021025_03.pdf
SecurityScorecard.com info@securityscorecard.com Background In the wake of Operation99 and Operation Phantom Circuit, STRIKE uncovered that the Lazarus Group had engineered an advanced implant, codenamed "marstech1." This state-of-the-art tool marks a…
State-sponsoredMalware
Added Mon 27 Jan 2025
Added Thu 16 Jan 2025
Chinese State-Sponsored RedDelta Targeted Taiwan, Mongolia, and Southeast Asia with Adapted PlugX Infection Chain
The group has used LNK files and MSC files as the first-stage components and ultimately loaded PlugX via search order hijacking. The group consistently used Cloudflare's CDN to proxy C2 traffic to threat actor-controlled C2 servers. This enables RedDelta to…
State-sponsored
Added Sat 28 Dec 2024
Rusia-Aligned TAG-110 Targets Asia and Europe with HATVIBE and CHERRYSPY
Since July 2024, 62 victims of custom malware HATVIBE and CHERRYSPY have been found across eleven countries, mostly in Central Asia, targeting government, human rights, and education sectors. Similar to other recent Russian APT campaigns, the group likely…
State-sponsored
Added Sat 14 Dec 2024
Let's go door with KCP
In 2022 we observed the use of new APT malware by an unknown China-based APT actor across several incidents in Japan. The malware uses KCP protocol for backdoor communication and was coded in Golang on multiple platform operating systems – we named it…
State-sponsoredMalware
Added Mon 25 Nov 2024
Advisory: Russian FSB cyber actor Star Blizzard continues worldwide spear-phishing campaigns
Updated and new research, updated vulnerabilities, security updates and revised actors. 1 Russian FSB cyber actor Star Blizzard continues worldwide spear-phishing campaigns The Russia-based actor is targeting organisations and individuals in the UK and other…
State-sponsoredPhishing
Added Mon 18 Nov 2024
China-Nexus TAG-112 Compromises Tibetan Websites to Distribute Cobalt Strike
This campaign’s malicious infrastructure used Cloudflare for name servers, hiding the threat actor’s IP and complicating attribution — a technique increasingly observed among APT groups. TAG-112 overlaps with TAG-102 (Evasive Panda), a Chinese APT group…
State-sponsored
01-chinese-espionage-article-m-trends-2024.pdf
Endpoint detection and response (EDR) platforms have become commonplace among companies seeking to expand the visibility into endpoint activity necessary to provide a baseline of security monitoring. This increase in visibility has forced attackers to evolve…
State-sponsored
Added Wed 13 Nov 2024
ESET APT Activity Report Q2 2024-Q3 2024
PLATFORMS IN THE PURSUIT OF NEW PREY April 2024 – September 2024 Report ESET APT ACTIVITY REPORT APRIL 2024 - SEPTEMBER 2024 | 2 Contents Executive summary� 3 Attackers and targets� 5 China-aligned groups � 6 SoftEther VPN: A tool of choice for China-aligned…
State-sponsored
Added Fri 1 Nov 2024
apt43-report-en.pdf
2M A N D I A N T APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations APT43 Executive Summary • APT43 is a prolific cyber operator that supports the interests of the North Korean regime. The group combines moderately-sophisticated technical…
State-sponsored
rpt-apt38-2018-web_v5-1.pdf
APT38 is a financially motivated North Korean regime-backed group responsible for conducting destructive attacks against financial institutions, as well as some of the world's largest cyber heists. Based on widely publicized operations alone, the group has…
State-sponsored
Added Fri 25 Oct 2024
ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilities
IRAN-ALIGNED CYBERATTACKS: RISE IN DISRUPTIVE OPERATIONS October 2023 – March 2024 Report ESET APT ACTIVITY REPORT OCTOBER 2023 - MARCH 2024 | 2 Contents Executive summary� 3 Attackers and targets� 4 China-aligned groups � 5 Mustang Panda targets the cargo…
State-sponsoredVulnerabilities
Added Sat 12 Oct 2024
Sailing_the_Seven_SEAs_Deep_Dive_into_Polaris_Arsenal_and_Intelligence_Insights.pdf
◆ Interested in... ◆ Windows internals ◆ .NET ◆ Anything and everything! AGENDA whoami01 Arsenal Overview03 Malware Overview04 Introduction02 Changes05 Summary / Findings06 Introduction ◆Chinese-based APT group active since 2011 ◆Aliases ◆ Mustang Panda ◆…
State-sponsored
Added Tue 17 Sep 2024
Microsoft Word - tale_of_gamaredon_infection.docx
Gamaredon (Russian state sponsored) APT group has been active from 2013 and mostly known to target Ukrainian government and military officials with intention to gain access to information. Since the beginning of 2020 there are reports that APT group has taken…
State-sponsoredMalware
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.