Research reports

Infrastructure Research and Hunting: Boiling the Domain Ocean

The Diamond Model of Intrusion Analysis identifies two main nodes as actor assets that may ultimately interact with a target / victim’s own assets — capabilities and infrastructure. But while “exploitation” is usually considered something the adversary does,…

Vulnerabilities

Attackers Target Agents via The Skill Supply Chain

An active malware campaign used typosquatted skills, trojanized packages, and remote loaders to target users of popular AI tools. TL;DR We disrupted an active malware campaign targeting agents through typosquatted skills. It targets users of popular AI tools…

MalwareSupply chainAI

Why can small file changes bypass the Antivirus detection? - MetaDefender Core

Was this page helpful? Next to read: On This Page Knowledge Base Knowledge Base Configuration and Settings Errors and Troubleshooting What can I do when MetaDefender Core (Windows) has an insufficient disk space error? Why is MetaDefender Core unable to…

Same Sea, New Phish: Russian Government-Linked Social Engineering Targets App-Specific Passwords

Keir Giles, a prominent expert on Russian information operations, was targeted with a sophisticated and personalized novel social engineering attack. The attacker took extensive measures to avoid raising Mr. Giles’ suspicions, and deceived him into creating…

State-sponsoredPhishing

Exfiltration Over Symmetric Encrypted Non-C2 Protocol (T1048.001)

Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.…

Cryptojacking Abusing AI Chatbot Recommendations — A New Delivery Vector Beyond Search Poisoning

Cryptojacking Abusing AI Chatbot Recommendations — A New Delivery Vector Beyond Search Poisoning LLM-recommended download links lead to malicious sites; a GPU-targeting mining, remote-access, and ransomware composite campaign Dennis Kim (김호광 / HoKwang Kim)…

Coordinated "cyberattack" on U.S. water utilities: What you need to know

A coordinated cyber attack disrupted water and wastewater systems in at least 12 U.S. states, including more than 30 Minnesota communities. Here is what defenders need to know about the attack so far. This FAQ also details recent cyberactivity targeting…

The Gentlemen ransomware: Dissecting a self-propagating Go encryptor

Ransomware that combines robust encryption with rapid lateral movement significantly increases the risk and impact of an attack. The Gentlemen ransomware is a ransomware-as-a-service (RaaS) threat that is distinguished by its ability to pair its strong…

Ransomware

Unmasking a Multi-Stage Loader: AutoIt Abuse Leading to Vidar Stealer Command-and-Control Communication

LevelBlue’s Security Services issues Threat Analysis reports to inform on impacting threats. The Threat Analysis reports investigate these threats and provide practical recommendations for protecting against them. In this Threat Analysis report, we…

MalwareInfostealers

Dead Drop Resolver – What It Is and How It Works

What is a Dead Drop Resolver? Dead Drop Resolver is a specialized program or technique that automatically detects and reads hidden data—so-called “dead drops.” These digital stashes can be scattered across hard-to-reach, unconventional places on the internet,…

Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation

In April 2026, Unit 42 researchers identified a financially motivated campaign delivering Vidar stealer and the XMRig cryptocurrency miner to consumer and small- and medium-sized business victims worldwide. Attackers lure victims via malvertising to pages for…

MalwareInfostealers

When 30 Water Utilities Get Hit in 48 Hours, the Lesson Isn’t “Better Malware” — It’s “No Front Door”

Originally published July 31, 2026. Last updated August 10, 2026 as reporting expanded beyond Minnesota and identified the controller families and configuration changes involved. Key Takeaway: In July 2026, a coordinated attack disrupted more than 30…

Malware

Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT

If you're interested in a deeper technical analysis of PHANTOMPULSE itself, covering its injection engines, persistence internals, and C2 protocol in greater detail, check out this follow-on analysis of the PHANTOMPULSE malware. Preamble Elastic Security Labs…

Malware

DarkSword/Coruna Open Directory Finding Report

Open directories on five hosts exposed the full DarkSword/Coruna iOS exploit-and-harvest platform, from the C2 delivery server to the per-wallet theft modules. The infrastructure was still in use at triage time. The platform runs a commercial…

Vulnerabilities

NeedyMantis: Unpacking a post-compromise malware family used in targeted operations

Microsoft Threat Intelligence has identified NeedyMantis, a modular post-compromise malware family observed in a limited number of targeted operations affecting telecommunications organizations, universities, medical nonprofits, intergovernmental…

Malware

JSAC2026_1_3_joseph_chen_en.pdf

The “I-S00N” Leak • A massive leak of internal documents and data from a Chinese campany “i-Soon” (Anxun) found on a Github repository on Feburary 2024 • Leaks of the company including Conducted widespread cyber espionage campaigns Government Operated as a…

State-sponsored

Darktrace Malware Analysis: Unpacking SnappyBee

The aim of this blog is to be an educational resource, documenting how an analyst can perform malware analysis techniques such as unpacking. This blog will demonstrate the malware analysis process against well-known malware, in this case SnappyBee. SnappyBee…

State-sponsoredMalware

JDY Botnet: How IoT and SOHO Devices Are Exploited

Expanded JDY IoT and SOHO botnet enables rapid vulnerability exploitation Published on Jun 10, 2026 | 11 minute read Black Lotus Labs® recently identified a significant resurgence of the JDY botnet, a covert reconnaissance network tied to China-nexus threat…

VulnerabilitiesBotnets and DDoS

Star Blizzard refines phishing and malware delivery with the RedFlick technique

Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a novel malware delivery technique that…

State-sponsoredMalwarePhishing

Data From Chinese Security Services Company i-Soon Linked to Previous Chinese APT Campaigns

On Feb. 16, 2024, someone uploaded data to GitHub that included possible internal company communications, sales-related materials and product manuals belonging to the Chinese IT security services company i-Soon, also known as Anxun Information Technology. The…

State-sponsored