Research reports
1,224 reports from 387 publishers45 added in the past week
45 reports, newest added first
Added Mon 26 Oct
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. "Artifacts from this investigation also indicate that…
Stray Cat, Open Doors: How k0t Wanders Through the Network Edge
Group-IB Threat Intelligence, together with NyxLab, collaborated on a joint investigation on a campaign involving widespread exploitation of network edge devices. This joint-investigation effort has managed to uncover indications that this may be connected to…
Vulnerabilities
Added Sun 25 Oct
Bablosoft; Lowering the Barrier of Entry for Malicious Actors
Free-to-use browser automation framework creates thriving criminal community Summary Evidence suggests an increasing number of threat actor groups are making use of a free-to-use browser automation framework. The framework contains numerous features which we…
Lorem Ipsum Revisited: ClickFix Pivot & Rapid Brigantine
What Happened? BlueVoyant Security Operations Center (SOC) and Threat Fusion Cell (TFC) researchers have been tracking an active ClickFix campaign that manipulates users into believing their web browser requires a security update. If the user complies, the…
Malware
From PostCSS Masquerading to Windows RAT
The package name is not random. The legitimate postcss-selector-parser package is widely used across the JavaScript build ecosystem, with npm reporting more than 150M weekly downloads. postcss-minify-selector-parser is not a classic one-character typo.…
MalwareSupply chain
Showboat Malware: Emerging Threats Targeting Telecom Providers
Black Lotus Labs®, the threat research team at Lumen, has uncovered a previously unreported Linux malware family called Showboat, used in a campaign targeting telecommunications organizations across multiple regions. In this post, we break down how the…
Malware
International law enforcement initiate hunt on malware group SocGholish
In Operation Endgame, a major operation this week disrupted a key infection chain used by cybercriminals. Within an international cooperation, 14.971 websites infected with SocGholish malware were remediated. This malware is used by a criminal group that…
MalwareTakedowns and arrests
Live Stream VOD: The Many Faces of CryptBot
If you are just getting started with reverse engineering this the place to start. In this tutorial we provide an overview the current setup that we currently run, this is also the same setup used in all of our live streams and tutorials. About FlareVM If you…
Восточный почерк: исследуем кибератаку азиатской группировки на российскую компанию
В этом блоге мы представили результаты исследования атаки на одну из российских производственных компаний, которую аналитики Центра кибербезопасности F6 обнаружили и локализовали в конце февраля 2026 года. Первоначальный доступ, полученный через…
Bitdefender Smart Home Cybersecurity
Bitdefender BOX is a complete cybersecurity ecosystem for your home network and family devices. NETGEAR Armor Available exclusively on NETGEAR Orbi mesh WiFi systems and Nighthawk routers. COMPLETE PROTECTION FOR YOUR NETWORK & DEVICES Control Your Home…
Taking Down Emotet
How Team Cymru Leveraged Visibility and Relationships to Coordinate Community Efforts On Tuesday, January 26, 2021, the number of available controllers talking like Emotet Tier 1 controllers dropped to zero. Team Cymru’s monitoring confirmed that they dropped…
Takedowns and arrests
PlugX: Bad guy disguises as an msi file
Use msitool to extract msidump -s -t mal.msi . In File.idt , we can see that there are 3 embed file. These files are extracted to %LOCALAPPDATA\kjnBsLsJo\ Upon running, the program opens an pdf file called Meeting Invitation.pdf 2. DLL Side-loading technique…
Webinject Panel Administration: A Vantage Point into Multiple Threat Actor Campaigns
The contents of this blog were shared with Team Cymru’s community partners in the first half of 2021 and were subsequently presented by our analysts at RISE Las Vegas (September 2021). Much has been written about the role of webinjects in the evolution of…
FishMonger’s arsenal upgraded: SprySOCKS for Windows
ESET researchers have discovered two as-yet undocumented Windows variants of SprySOCKS, a previously Linux-only backdoor reportedly used by FishMonger, the group believed to be operated by a Chinese contractor named I‑SOON. While we initially discovered the…
Malware
When Your Smart TV Stops Being Yours
In May 2026 the website of Arab Reporters for Investigative Journalism (ARIJ) was targeted by a large-scale scraping event on the site, receiving traffic from approximately 1.35 million unique IP addresses, spread across more than 7,300 autonomous systems and…
Resources - SecurityScorecard
PHP2Shell Customer Advisory: CVE-2026-109618 and CVE-2026-109619 Remediation Guide SecurityScorecard’s PHP2Shell advisory covers CVE-2026-109618 and CVE-2026-109619: SecurityScorecard patched its affected PHP site on release day and found no exploitation. See…
Vulnerabilities
Etude de cas : Comment Hunters International et ses affiliés ciblent
Hunters International est un groupe de Ransomware-as-a-Service (RaaS) apparu en octobre 2023, après avoir acquis le code source et l'infrastructure du groupe Hive, aujourd'hui démantelé. À ce jour, selon les statistiques publiées, Hunters International et ses…
Ransomware
The #c3284d# Malware Network - Stats.php
08. this .seed = test + this .M; 10. return ( this .seed * this .oneOverM); 12. function RandomNumberGenerator(unix){ 13. var d = new Date(unix * 1000); 14. var s = Math.ceil(d.getHours() / 3); 15. this .seed = 2345678901 + (d.getMonth() * 0xF
Malware
奇安信威胁情报中心
On December 23, 2025, the renowned document editor EmEditor officially released an announcement stating that between December 19th and 22nd, its official website installation packages were subjected to a supply chain attack. The MSI installation packages were…
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.