Research reports
1,224 reports from 387 publishers45 added in the past week
15 reports, newest added first
Added Tue 20 Oct
Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat
Downloaded payload is a variant of a cloud-based RAT known as RokRat which has been used by this group since 2017. This sample compilation date is 29 Oct 2019. This RAT is known to steal data from a victim’s machine and send them to cloud services (Pcloud,…
State-sponsoredMalware
Added Sun 18 Oct
Kazuar (Malware Family)
There is no description at this point. References 2026-06-25 ⋅ Google ⋅ Google Threat Intelligence Group The Latest Addition to Turla’s Intelligence Gathering Apparatus Kazuar 2026-05-14 ⋅ Microsoft ⋅ Microsoft Threat Intelligence Kazuar: Anatomy of a…
State-sponsoredMalware
Chinese Nation-State Hackers Target U.S in Operation TradeSecret, Report Claims
The National Foreign Trade Council (NFTC) website was allegedly infiltrated by Chinese nation-state threat actors, according to a new report from Fidelis Cybersecurity. The attack against the NFTC site has been dubbed ‘Operation TradeSecret’ by Fidelis and is…
State-sponsored
Taiwan High-Tech Ecosystem Targeted by Foreign APT Group:
2019 was an excellent year for the Taiwan superconductor industry; however, beneath this economic upturn, a digital chimera was slowly eating at it from within. Throughout 2019, multiple companies in the Taiwan high-tech ecosystem were victims of an advanced…
State-sponsored
Animal Farm APT and the Shadow of French Intelligence
Almost every government is working to improve its cyber-capabilities. The majority of them already have in their arsenal powerful espionage malware and hacking platforms. We read about the techniques and tactics implemented by a number of APT groups from…
State-sponsoredMalware
Added Fri 16 Oct
Why Are You Texting Me? UNC3944 Leverages SMS Phishing Campaigns for SIM Swapping, Ransomware, Extortion, and Notoriety
UNC3944 is a financially motivated threat cluster that has persistently used phone-based social engineering and SMS phishing campaigns (smishing) to obtain credentials to gain and escalate access to victim organizations. At least some UNC3944 threat actors…
RansomwareState-sponsoredPhishing
Added Wed 14 Oct
APT37 Ruby Jumper: Air-Gap Attack via Removable Media
ThreatLabz details the Ruby Jumper campaign in the following sections, focusing on the specific malware employed, the deployment methods, and how the final payload is delivered to achieve the ultimate objective. Attack flow The figure below illustrates the…
State-sponsored
Same Sea, New Phish: Russian Government-Linked Social Engineering Targets App-Specific Passwords
Keir Giles, a prominent expert on Russian information operations, was targeted with a sophisticated and personalized novel social engineering attack. The attacker took extensive measures to avoid raising Mr. Giles’ suspicions, and deceived him into creating…
State-sponsoredPhishing
Added Sat 10 Oct
JSAC2026_1_3_joseph_chen_en.pdf
The “I-S00N” Leak • A massive leak of internal documents and data from a Chinese campany “i-Soon” (Anxun) found on a Github repository on Feburary 2024 • Leaks of the company including Conducted widespread cyber espionage campaigns Government Operated as a…
State-sponsored
Darktrace Malware Analysis: Unpacking SnappyBee
The aim of this blog is to be an educational resource, documenting how an analyst can perform malware analysis techniques such as unpacking. This blog will demonstrate the malware analysis process against well-known malware, in this case SnappyBee. SnappyBee…
State-sponsoredMalware
Star Blizzard refines phishing and malware delivery with the RedFlick technique
Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a novel malware delivery technique that…
State-sponsoredMalwarePhishing
Data From Chinese Security Services Company i-Soon Linked to Previous Chinese APT Campaigns
On Feb. 16, 2024, someone uploaded data to GitHub that included possible internal company communications, sales-related materials and product manuals belonging to the Chinese IT security services company i-Soon, also known as Anxun Information Technology. The…
State-sponsored
IBM X-Force Discovers New Sheriff Backdoor used to target Ukraine
IBM X-Force discovered a set of previously unknown malware (Sheriff backdoor) used in a cyber espionage attack against an entity within Ukraine’s defense sector in the first half of 2024. The threat actor used a popular news portal in Ukraine, ukr.net, to…
State-sponsoredMalware
GitHub - yankywilson/jdy-botnet-threat-analysis: Defensive CTI analysis of the JDY reconnaissance botnet (China-nexus, Volt Typhoon / KV lineage, MITRE G1017): MIPS64 implant reverse engineering, infrastructure enumeration, tiered intelligence reporting, Sigma/YARA detections, and a tasking decryptor. TLP:CLEAR.
A complete defensive analysis of the JDY botnet: reverse engineering of the implant, enumeration of its control infrastructure, three-tier intelligence reporting, deployable detections, and a working tasking decryptor. JDY is a China-nexus reconnaissance…
State-sponsoredMalwareBotnets and DDoS
Added Wed 7 Oct
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
As an update to the June 2026 post, ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit, Mandiant and Google Threat Intelligence Group (GTIG) have identified renewed mass exploitation of CVE-2026-35273 by UNC6240 (ShinyHunters), along with…
State-sponsoredVulnerabilities
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.