Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,233 reports388 publishers50 added in the past week

161–180 of 353 reports · page 9 of 18 · Clear filters

Added Thu 14 May

panther.com · Web page · Published 3 Apr
jsonspack: Multi-Tenant Node.js RAT — DPRK Supply Chain Campaign
Note — jsonspack vs legitimate jsonpack : jsonpack is a legitimate npm JSON compression library published by sapienlab in 2013, maintained through 2022, with 1.1.5 as the final version.P2 (Footnote prefixes: E = evidence, P = prior art, R = references, A =…
Malware Supply chain Original (new tab)
LevelBlue · Web page · Published 19 Nov
SpiderLabs IDs New Banking Trojan Distributed Through WhatsApp
November 19, 2025 10 Minute Read by Nathaniel Morales, John Basmayor, and Nikita Kazymirskyi LevelBlue SpiderLabs researchers have recently identified a banking Trojan we dubbed Eternidade Stealer, which is distributed through WhatsApp hijacking and social…
Malware Original (new tab)
QiAnXin · Web page · Published 11 May
Threat Actor Mr_Rot13 Actively Exploits CVE-2026-41940 for Backdoor Deployment
CVE-2026-41940 is a high-severity unauthenticated authentication bypass vulnerability affecting cPanel & WHM. This product is widely used in Linux server operations and virtual hosting management. The vulnerability has a CVSS score as high as 9.8 (Critical).…
Malware Vulnerabilities Original (new tab)
IBM X-Force · Web page · Published 12 Mar
A Slopoly start to AI-enhanced ransomware attacks
In early 2026, IBM X-Force discovered a likely AI-generated novel malware which we are dubbing “Slopoly,” used during a ransomware attack. The operators are part of a group tracked as Hive0163, whose main objective is extortion through large-scale data…
Ransomware Malware AI Original (new tab)
Trend Micro · Web page · Published 30 Apr
Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia
Table 1. Legitimate executables vulnerable to DLL sideloading abused by SHADOW‑EARTH‑053 SHADOW-EARTH-053 uses a legitimate Toshiba Bluetooth Stack executable, renamed to CIATosBtKbd.exe, to sideload a malicious DLL (TosBtKbd.dll). This loader employs a…
Malware Original (new tab)

Added Tue 12 May

LevelBlue · Web page · Published 19 Jun
LevelBlue Labs Discovers Highly Evasive, New Loader Targeting Chinese Organizations
LevelBlue Labs recently discovered a new highly evasive loader that is being delivered to specific targets through phishing attachments. A loader is a type of malware used to load second-stage payload malware onto a victim’s system. Due to the lack of…
Malware Original (new tab)
Trend Micro · Web page · Published 5 Mar
New BoryptGrab Stealer Targets Windows Users via Deceptive GitHub Pages
The BoryptGrab campaign uses fake SEO‑optimized GitHub repositories and deceptive download pages to distribute a data‑stealing malware family that delivers multiple payloads, including a reverse SSH backdoor, to Windows users. Save to Folio Key Takeaways…
Malware Infostealers Original (new tab)
Cisco Talos · Web page · Published 26 Feb
New Dohdoor malware campaign targets education and health care
Cisco Talos discovered an ongoing malicious campaign since at least as early as December 2025 by a threat actor we track as “UAT-10027,” delivering a previously undisclosed backdoor dubbed “Dohdoor.” Dohdoor utilizes the DNS-over-HTTPS (DoH) technique for…
Malware Original (new tab)

Added Sat 9 May

0x3obad.github.io · Web page · Published 27 Mar
PlugX : Mustang Panda APT
Mustang Panda is a China-linked advanced persistent threat (APT) group engaged in sustained cyber espionage operations, primarily targeting government entities, diplomatic organizations, and NGOs. The group relies on a consistent toolset that is regularly…
State-sponsored Malware Original (new tab)
Kaspersky · Web page · Published 29 Dec
The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor
In mid-2025, we identified a malicious driver file on computer systems in Asia. The driver file is signed with an old, stolen, or leaked digital certificate and registers as a mini-filter driver on infected machines. Its end-goal is to inject a backdoor…
State-sponsored Malware Original (new tab)
redpiranha.net · Web page · Added 9 May
Threat Intelligence Report April 21 to April 27, 2026
Atemu RAT is a windows-based Remote Access Trojan (RAT) that’s primarily spread through ClickFix based attacks impersonating CloudFlare captchas to trick the user into pasting a malicious payload into PowerShell or cmd. The initial ClickFix payload uses…
Malware Original (new tab)

Added Fri 8 May

zanezhub.github.io · Web page · Published 2 May
NotPetya Malware Analysis - Bye, boot partition. I’ll miss you
MD5 hash: 71b6a493388e7d0b40c83ce903bc6b04 humanhash: michigan-twenty-december-papa File name: iec56w4ibovnb4wc.onion_Library__Ransomeware__NotPetya.bin.malw I tried to look for a NotPetya diagram to see the workflow of the malware, but I could not find
Malware Original (new tab)

Added Thu 7 May

Kaspersky · Web page · Published 16 Apr
Securelist | Kaspersky’s threat research and reports
Kaspersky researchers uncovered malicious wheel packages in PyPI that targeted both Windows and Linux and contained a dropper delivering malware dubbed ZiChatBot. We attribute this activity to OceanLotus APT. Threats Webinars Register to Access All Kaspersky…
Malware Original (new tab)
rootshell.be · Web page · Published 14 Jul
Simple DGA Spotted in a Malicious PowerShell
DGA (“Domain Generation Algorithm“) is a technique implemented in some malware families to defeat defenders and to make the generation of IOC’s (and their usage – example to implement black lists) more difficult. When a piece of malware has to contact a C2…
Malware Original (new tab)
Check Point · Web page · Published 1 Jun
“Troldesh” – New Ransomware from Russia
“Troldesh”, aka Encoder.858 or Shade, is a Trojan and a crypto-ransomware variant created in Russia and spread all over the world. Troldesh is based on so-called encryptors that encrypt all of the user’s personal data and extort money to decrypt the files.…
Ransomware Malware Original (new tab)
US Department of Justice · Web page · Published 28 Jan
Emotet Botnet Disrupted in International Cyber Operation
The Justice Department today announced its participation in a multinational operation involving actions in the United States, Canada, France, Germany, the Netherlands, and the United Kingdom to disrupt and take down the infrastructure of the malware and…
Malware Botnets and DDoS Original (new tab)
opensourcemalware.com · Web page · Published 6 May
Lazarus Group Uses Git Hooks To Hide Malware
The OpenSourceMalware team has spotted a fresh twist in the DPRK's Contagious Interview / TaskJacker playbook: the operators have pivoted away from stuffing their stage-2 loader into .vscode/tasks.json , package.json postinstall scripts, or fake .woff2 font…
State-sponsored Malware Original (new tab)
Check Point · Web page · Published 12 Dec
Pulling the Curtains on Azov Ransomware: Not a Skidsware but Polymorphic Wiper
Check Point Research (CPR) provides under-the-hood details of its analysis of the infamous Azov Ransomware Investigation shows that Azov is capable of modifying certain 64-bit executables to execute its own code Azov is designed to inflict impeccable damage…
Ransomware Malware Original (new tab)
Group-IB · Web page · Added 7 May
The footprints of Raccoon
In the summer of 2020, Group-IB specialists discovered a malware distribution campaign exploiting Telegram’s legitimate features. Analysis showed that the attackers used the technique to distribute Raccoon stealer, i.e. malware spread through the…
Malware Infostealers Original (new tab)
Kaspersky · Web page · Published 30 Apr
Silver Fox uses the new ABCDoor backdoor to target organizations in Russia and India
In December 2025, we detected a wave of malicious emails designed to look like official correspondence from the Indian tax service. A few weeks later, in January 2026, a similar campaign began targeting Russian organizations. We have attributed this activity…
Malware Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.