Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,233 reports388 publishers50 added in the past week

141–160 of 353 reports · page 8 of 18 · Clear filters

Added Wed 3 Jun

nextron-systems.com · Web page · Published 2 Jun
Detecting Nimbus Manticore and their sideloading infection chains
During a recent incident, we identified a sophisticated sideloading infection chain dropping a custom implant for data exfiltration. Further analysis allowed us to attribute the activity to the Iran-nexus APT group Nimbus Manticore, also tracked as UNC1549…
State-sponsored Malware Original (new tab)
Check Point · Web page · Published 22 May
Fast and Furious – Nimbus Manticore Operations During the Iranian Conflict
The Iranian, IRGC affiliated, threat actor Nimbus Manticore resurfaced during Operation Epic Fury, the US military campaign against Iran launched on February 28, 2026, demonstrating newly adopted techniques and enhanced capabilities. The campaign leveraged…
Malware Original (new tab)

Added Thu 28 May

Trend Micro · Web page · Published 22 May
Analyzing Void Dokkaebi’s Cython-Compiled InvisibleFerret Malware
Void Dokkaebi, a North Korea-aligned intrusion set, has updated its information-stealing malware, InvisibleFerret, shifting its delivery format to evade script-based detections. Save to Folio Key takeaways Void Dokkaebi (aka Famous Chollima) has migrated…
Malware Original (new tab)

Added Fri 22 May

secureblink.com · Web page · Added 22 May
Mustang Panda Strikes India and South Korea with Updated LOTUSLITE Backdoor in Espionage Campaign
China-linked Mustang Panda targets India banks & S.Korea policy via LOTUSLITE backdoor 22-Apr-2026 4 min read A China-linked threat group known as Mustang Panda has launched a dual‑faced espionage campaign targeting India’s banking sector and South Korea’s…
State-sponsored Malware Original (new tab)
acronis.com · Web page · Added 22 May
LOTUSLITE: Targeted espionage leveraging geopolitical themes
Acronis Threat Research Unit (TRU) observed a targeted malware campaign against U.S. government entities leveraging a politically themed ZIP archive containing a loader executable and a malicious dynamic-link library (DLL). The executable is used to sideload…
State-sponsored Malware Original (new tab)
0x3obad.github.io · Web page · Published 13 May
MustangPanda New Backdoor LotusLite
Chinese state-sponsored APT Mustang Panda has added a new undocumented C++ backdoor LotusLite to its arsenal targets the financial sectors in India , South Korea and U.S . The analyzed sample is a fully-featured Windows backdoor DLL disguised as a WPS Office…
State-sponsored Malware Original (new tab)
pyaeheinnkyaw.com · Web page · Published 7 Sep
Red Shadows over Yangon: Analyzing TONESHELL Malware from Mustang Panda’s Campaign Against Myanmar
This report details a targeted malware campaign attributed to Mustang Panda, a Chinese APT group, leveraging a supposed compromised Myanmar embassy email to deliver malware against Myanmar’s entities. The campaign begins with a phishing email containing a…
State-sponsored Malware Original (new tab)
ANY.RUN · Web page · Published 17 Feb
LATAM Businesses Hit by XWorm via Fake Financial Receipts: Full Campaign Analysis
Editor’s note: The current article is authored by Moises Cerqueira, malware researcher and threat hunter. You can find Moises on LinkedIn. Malware campaigns targeting Latin America (LATAM) are evolving. While the final payloads, often commodity RATs like…
Malware Original (new tab)

Added Thu 21 May

BlueVoyant · Web page · Added 21 May
Lorem Ipsum Malware: Trojanized MS Teams Installers Deliver…
Lorem Ipsum Malware: Trojanized MS Teams Installers Deliver Multi-Stage Loader and Backdoor May 4, 2026 | 18 min read What Happened? BlueVoyant Security Operations Center (SOC) and Threat Fusion Cell (TFC) security researchers have been tracking an emerging,…
Malware Original (new tab)
Elastic Security Labs · Web page · Published 7 May
TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook
Elastic Security Labs identified a new Brazilian banking trojan that we are tracking as TCLBANKER, a malware family we assess is a major update of the MAVERICK/SORVEPOTEL family. The campaign, tracked as REF3076, features a loader with robust anti-analysis…
Malware Original (new tab)

Added Wed 20 May

Netskope · Web page · Published 7 May
OpenClaw’s Hologram: Fake Installer Ships Rust Infostealer
Netskope Threat Labs has found a fake OpenClaw installer delivering red-team-grade capabilities—all pointed at stealing credentials from over 250 crypto wallet and password manager extensions. The dropper’s manifest doesn’t hide the intent: “Hologram – Decoy…
Malware Infostealers Original (new tab)
zynap.com · Web page · Published 15 May
Zynap’s Next-Gen Sandbox Redefines Automatic Malware Analysis
In simple terms, a hook is like placing a “sensor” on certain operating system functions: every time the malware calls that function, the sensor records the action. This allows us to observe what the malware does without having to perform a manual…
Malware Original (new tab)

Added Tue 19 May

cocomelonc.github.io · Web page · Published 27 Apr
MacOS malware persistence 11: osascript LOLBin. Simple C example
Hello, cybersecurity enthusiasts and white hackers! Continuing the macOS malware persistence series. Today we look at another Apple-signed LOLBin: osascript - the command-line interpreter for AppleScript and JavaScript for Automation (JXA). Used in the wild…
Malware Original (new tab)
artik.blue · Web page · Published 12 Jul
Malware analysis with IDA/Radare2 - Multiple unpacking (Ramnit worm)
Today we are following our previous post on these series unpacking a sample (Ramnit) that looks a bit more complex as it performs multiple unpacking, combining own methods with an open source packer. As this piece of malware is relatively old, I’ll be using a…
Malware Original (new tab)
Microsoft · Web page · Published 14 May
Kazuar: Anatomy of a nation-state botnet
Kazuar, a sophisticated malware family attributed to the Russian state actor Secret Blizzard, has been under constant development for years and continues to evolve in support of espionage-focused operations. Over time, Kazuar has expanded from a relatively…
State-sponsored Malware Botnets and DDoS Original (new tab)
ANY.RUN · Web page · Published 14 May
LATAM Under Siege: Agent Tesla’s 18-Month Credential Theft Campaign Against Chilean Enterprises
Editor’s note: The analysis is authored by Moises Cerqueira, malware researcher & threat hunter. You can find Moises on LinkedIn and X. Credential theft malware rarely announces itself with ransomware-level noise. Instead, it operates like a silent siphon…
Malware Original (new tab)
ThreatFabric · Web page · Published 1 Oct
New TrickMo Variant: Device Take Over malware targeting Banking, Fintech, Wallet & Auth apps
Modern Android banking malware increasingly evolves through architectural redesigns intended to improve stealth, resilience, and operational flexibility rather than through entirely new user-facing capabilities. As platform protections and detection measures…
Malware Mobile Original (new tab)
artik.blue · Web page · Published 9 Jul
Malware analysis with IDA/Radare2 - Basic Unpacking (Dridex first stage)
Greetings again dear malware analysts! In this part of the series we are leaving the initial topics behind to start focusing on unpacking/decrypting malware by applying our reverse engineering skills to those binaries. We will start by unpacking the initial…
Malware Original (new tab)
zanezhub.github.io · Web page · Published 17 May
Analysis on Malware that attacks Israel’s Water treatment facilities
I go after the entry point of the malware and right away we can see that there’s only three main functions. This makes it easier for us to analyze the malware. I’m not sure why the author did not add a layer of obfuscation to the binary to make it hearder to…
Malware Original (new tab)

Added Thu 14 May

Kaspersky · Web page · Published 17 Feb
Kaspersky discovers Keenadu – a multifaceted Android malware that can come preinstalled on new devices
Kaspersky has detected a new malware for Android devices that it dubbed Keenadu. This malware is distributed in multiple forms – it can be preinstalled directly into devices’ firmware, embedded within system apps, or even downloaded from official app stores…
Malware Mobile Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.