Research reports

Lessons from the iSOON Leaks

A Chinese Ministry of Public Security (MPS) contractor called iSOON (also known as Anxun Information) that specializes in network penetration research and related services has had its data leaked to GitHub. Based on the level of detail, leaked chat logs,…

I-Soon Leak: Kela’s Insights

On February 16, 2024, a repository titled “I-S00N” was uploaded to Github, allegedly intended to expose insider information about I-Soon (Anxun Information Technology Co., 安洵信息技术有限公司,i-soon[.]net), a Chinese technology company in the cybersecurity field. The…

IBM X-Force Discovers New Sheriff Backdoor used to target Ukraine

IBM X-Force discovered a set of previously unknown malware (Sheriff backdoor) used in a cyber espionage attack against an entity within Ukraine’s defense sector in the first half of 2024. The threat actor used a popular news portal in Ukraine, ukr.net, to…

State-sponsoredMalware

GitHub - yankywilson/jdy-botnet-threat-analysis: Defensive CTI analysis of the JDY reconnaissance botnet (China-nexus, Volt Typhoon / KV lineage, MITRE G1017): MIPS64 implant reverse engineering, infrastructure enumeration, tiered intelligence reporting, Sigma/YARA detections, and a tasking decryptor. TLP:CLEAR.

A complete defensive analysis of the JDY botnet: reverse engineering of the implant, enumeration of its control infrastructure, three-tier intelligence reporting, deployable detections, and a working tasking decryptor. JDY is a China-nexus reconnaissance…

State-sponsoredMalwareBotnets and DDoS

From Campus to C2: Tracking a Persistent Chinese Operation Against Vietnamese Universities

This personal research is based solely on open-source intelligence (OSINT) and technical analysis of available data. The attribution of activity to suspected Chinese threat actors is made on the basis of observed infrastructure, malware, and tactics,…

XenoRAT-Malware-Analysis/Reports/XenoRAT_EN.md at main · Yavuzhanzgen/XenoRAT-Malware-Analysis

This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. XenoRAT Technical Analysis Report Static Analysis • Dynamic Analysis •…

Malware

From Registry-Stored PowerShell to In-Memory Cryptocurrency Mining: A Multi-Stage Infection Chain

We had an opportunity to analyse a system with frequent detection-alerts over powershell execution. Our analysis revealed a multi-stage infection that relied heavily on obfuscation, Registry-based payload storage, covert data delivery, persistence mechanisms,…

Technical Analysis of 2CLoader

Important strings in 2CLoader are decrypted at runtime using an inlined bitwise XOR operation applied to global values. The key in the analyzed sample is 0x37 . Indirect system calls For the Nt* APIs listed below, 2CLoader prefers indirect system calls to…

Malware

Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack

Acknowledgments: Special thanks to Dray Agha for his extensive contributions to this investigation. Background In September, the Huntress agent was deployed on an organization that had been targeted in an Akira ransomware attack. As we've written about…

Ransomware

$100k in Crypto Drained by the Underground Operation

Netskope Threat Labs analyzed a crypto-stealing operation that drains victims’ cryptocurrency exchange accounts. An Aotera/Tedy loader injects a Vidar-class stealer into a Windows process, which then launches Chrome or Edge and injects its scripts into the…

MalwareInfostealers

FLEXRAT – ChilloutVR Lures, Shared Secrets, and an OPSEC Hangover

Hexastrike uncovered an undocumented commodity stealer and remote access toolset, which we track as FLEXRAT, distributed through counterfeit game-modification websites. The most prominent lure infrastructure impersonates the ecosystem surrounding ChilloutVR,…

Introducing DOUBLECUP, a ClickFix Loader Delivering CountLoader and DeviceManager RATs

The DOUBLECUP panel provides multiple utilities to load an operator’s final payload. The first stage drops a steganographic PNG image into the browser’s cache, retrieves its hidden content, and executes the second stage. This second stage decrypts the final…

Malware

threat-research/ancient-botnet at main · ksi-digital/threat-research

We captured a botnet family that calls itself "ancient" in our SSH/Telnet honeypot. Between 2026-10-04 and 2026-10-05 we observed its delivery chain, three iterations of its dropper, and its C2 behaviour. We confirmed its C2 server live. We have not found a…

MalwareBotnets and DDoS

ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft

As an update to the June 2026 post, ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit, Mandiant and Google Threat Intelligence Group (GTIG) have identified renewed mass exploitation of CVE-2026-35273 by UNC6240 (ShinyHunters), along with…

State-sponsoredVulnerabilities

Hallucinating Credibility: China-Aligned TA419 Impersonates its Way into US AI Policy Circles

In July 2026, a China-aligned threat actor Proofpoint tracks as TA419 conducted multiple credential phishing campaigns impersonating prominent economists and artificial intelligence (AI) policymakers to target AI experts working for US think tanks,…

JADEPUFFER evolves: The agentic threat actor deploys ransomware built to destroy AI models

Falco Feeds extends the power of Falco by giving open source-focused companies access to expert-written rules that are continuously updated as new threats are discovered. learn more Ransomware operators make a bet that their victims don’t keep backups. In a…

RansomwareAI

Resecurity | Blacklock Ransomware: A Late Holiday Gift with Intrusion into the Threat Actor's Infrastructure

Dubbed “BlackLock” (aka "El Dorado" or "Eldorado"), the ransomware-as-a-service (RaaS) outfit has existed since March 2024. In Q4 of last year, it increased its number of data leak posts by a staggering 1,425% quarter-on-quarter. According to independent…

Ransomware

Inside a Zawoo Team Intrusion

Redaction: hostnames, domains and internal addresses are replaced with <domain> , <HOST> , 10.x.x.x , and the encryptor’s file extension with <EXT> . Details that would identify the victim organisation or its sector have been removed. TL;DR Who: Zawoo Team,…

JADEPUFFER: Agentic ransomware for automated database extortion

Falco Feeds extends the power of Falco by giving open source-focused companies access to expert-written rules that are continuously updated as new threats are discovered. learn more Ransomware has had a human at the keyboard, or at least a human writing its…

Ransomware

Warlock Ransomware Attackers Hit Water and Telecom Operators

Warlock first came to prominence via the exploitation of a Microsoft SharePoint “ToolShell” exploit chain. Warlock is developed by a China-nexus threat actor Symantec calls Longlegs (aka Storm-2603). Symantec has previously tied this group to older activity…

RansomwareVulnerabilities