Research reports
1,224 reports from 387 publishers45 added in the past week
294 reports, newest added first
Added Tue 12 May
New Dohdoor malware campaign targets education and health care
Cisco Talos discovered an ongoing malicious campaign since at least as early as December 2025 by a threat actor we track as “UAT-10027,” delivering a previously undisclosed backdoor dubbed “Dohdoor.” Dohdoor utilizes the DNS-over-HTTPS (DoH) technique for…
Malware
Added Sat 9 May
PlugX : Mustang Panda APT
Mustang Panda is a China-linked advanced persistent threat (APT) group engaged in sustained cyber espionage operations, primarily targeting government entities, diplomatic organizations, and NGOs. The group relies on a consistent toolset that is regularly…
State-sponsoredMalware
The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor
In mid-2025, we identified a malicious driver file on computer systems in Asia. The driver file is signed with an old, stolen, or leaked digital certificate and registers as a mini-filter driver on infected machines. Its end-goal is to inject a backdoor…
State-sponsoredMalware
Threat Intelligence Report April 21 to April 27, 2026
Atemu RAT is a windows-based Remote Access Trojan (RAT) that’s primarily spread through ClickFix based attacks impersonating CloudFlare captchas to trick the user into pasting a malicious payload into PowerShell or cmd. The initial ClickFix payload uses…
Malware
Added Fri 8 May
NotPetya Malware Analysis - Bye, boot partition. I’ll miss you
MD5 hash: 71b6a493388e7d0b40c83ce903bc6b04 humanhash: michigan-twenty-december-papa File name: iec56w4ibovnb4wc.onion_Library__Ransomeware__NotPetya.bin.malw I tried to look for a NotPetya diagram to see the workflow of the malware, but I could not find
Malware
Added Thu 7 May
Securelist | Kaspersky’s threat research and reports
Kaspersky researchers uncovered malicious wheel packages in PyPI that targeted both Windows and Linux and contained a dropper delivering malware dubbed ZiChatBot. We attribute this activity to OceanLotus APT. Threats Webinars Register to Access All Kaspersky…
Malware
Simple DGA Spotted in a Malicious PowerShell
DGA (“Domain Generation Algorithm“) is a technique implemented in some malware families to defeat defenders and to make the generation of IOC’s (and their usage – example to implement black lists) more difficult. When a piece of malware has to contact a C2…
Malware
“Troldesh” – New Ransomware from Russia
“Troldesh”, aka Encoder.858 or Shade, is a Trojan and a crypto-ransomware variant created in Russia and spread all over the world. Troldesh is based on so-called encryptors that encrypt all of the user’s personal data and extort money to decrypt the files.…
RansomwareMalware
Emotet Botnet Disrupted in International Cyber Operation
The Justice Department today announced its participation in a multinational operation involving actions in the United States, Canada, France, Germany, the Netherlands, and the United Kingdom to disrupt and take down the infrastructure of the malware and…
MalwareBotnets and DDoS
Lazarus Group Uses Git Hooks To Hide Malware
The OpenSourceMalware team has spotted a fresh twist in the DPRK's Contagious Interview / TaskJacker playbook: the operators have pivoted away from stuffing their stage-2 loader into .vscode/tasks.json , package.json postinstall scripts, or fake .woff2 font…
State-sponsoredMalware
Pulling the Curtains on Azov Ransomware: Not a Skidsware but Polymorphic Wiper
Check Point Research (CPR) provides under-the-hood details of its analysis of the infamous Azov Ransomware Investigation shows that Azov is capable of modifying certain 64-bit executables to execute its own code Azov is designed to inflict impeccable damage…
RansomwareMalware
The footprints of Raccoon
In the summer of 2020, Group-IB specialists discovered a malware distribution campaign exploiting Telegram’s legitimate features. Analysis showed that the attackers used the technique to distribute Raccoon stealer, i.e. malware spread through the…
MalwareInfostealers
Silver Fox uses the new ABCDoor backdoor to target organizations in Russia and India
In December 2025, we detected a wave of malicious emails designed to look like official correspondence from the Indian tax service. A few weeks later, in January 2026, a similar campaign began targeting Russian organizations. We have attributed this activity…
Malware
Malware Spotlight – Into the Trash: Analyzing LitterDrifter
Gamaredon, also known as Primitive Bear, ACTINIUM, and Shuckworm, is a unique player in the Russian espionage ecosystem that targets a wide variety of almost exclusively Ukrainian entities. While researchers often struggle to uncover evidence of Russian…
State-sponsoredMalware
UAT-8302 and its box full of malware
Cisco Talos is disclosing UAT-8302, a sophisticated, China-nexus advanced persistent threat (APT) group targeting government entities in South America since at least late 2024 and government agencies in southeastern Europe in 2025. After successful…
State-sponsoredMalware
Added Wed 6 May
Inside ZionSiphon: Darktrace’s Analysis of OT Malware Targeting Israeli Water Systems
What is ZionSiphon? Darktrace recently analyzed a malware sample, which identifies itself as ZionSiphon. This sample combines several familiar host-based capabilities, including privilege escalation, persistence, and removable-media propagation, with…
Malware
HijackLoader: Free Games, Costly Consequences, and Loads of Malware
PiviGames, a popular Spanish gaming platform is well-known in the gaming community for providing download links to pirated PC games. Such a platform offers attractive content and it has built a reputation within the gaming community over the years. However,…
Malware
Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories
Void Dokkaebi (aka Famous Chollima) has evolved beyond single-target social engineering into a self-propagating supply chain threat. A compromised developer’s repository becomes an infection vector for the next wave of victims, creating a worm-like…
Malware
We Dumped a Live Kimsuky C2 and Recovered Every Stage of the Kill Chain: CHM Dropper, VBScript Stager, PowerSh
#Infrastructure: 79 Domains Across 5 IPs ##The DAOU Staging Server (27.102.137.38 — 37 domains) ##The Fast-Flux Farm (118.194.249.109 — 40 domains) ##The Naver Phishing Farm (27.102.137.150 — 12+ domains, LIVE) #Related Kimsuky Sample #Detection Guidance…
State-sponsoredMalware
Cloned, Loaded, and Stolen: How 109 Fake GitHub Repositories Delivered SmartLoader and StealC
We identified 109 malicious GitHub repositories across 103 accounts that impersonate legitimate projects and redirect users to embedded ZIP files containing a LuaJIT-based SmartLoader stage. The campaign appears to be operated by a single threat actor or…
MalwareInfostealers
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.