Research reports
1,224 reports from 387 publishers45 added in the past week
18 reports, newest added first
Added Sun 25 Oct
Lorem Ipsum Revisited: ClickFix Pivot & Rapid Brigantine
What Happened? BlueVoyant Security Operations Center (SOC) and Threat Fusion Cell (TFC) researchers have been tracking an active ClickFix campaign that manipulates users into believing their web browser requires a security update. If the user complies, the…
Malware
From PostCSS Masquerading to Windows RAT
The package name is not random. The legitimate postcss-selector-parser package is widely used across the JavaScript build ecosystem, with npm reporting more than 150M weekly downloads. postcss-minify-selector-parser is not a classic one-character typo.…
MalwareSupply chain
Showboat Malware: Emerging Threats Targeting Telecom Providers
Black Lotus Labs®, the threat research team at Lumen, has uncovered a previously unreported Linux malware family called Showboat, used in a campaign targeting telecommunications organizations across multiple regions. In this post, we break down how the…
Malware
International law enforcement initiate hunt on malware group SocGholish
In Operation Endgame, a major operation this week disrupted a key infection chain used by cybercriminals. Within an international cooperation, 14.971 websites infected with SocGholish malware were remediated. This malware is used by a criminal group that…
MalwareTakedowns and arrests
FishMonger’s arsenal upgraded: SprySOCKS for Windows
ESET researchers have discovered two as-yet undocumented Windows variants of SprySOCKS, a previously Linux-only backdoor reportedly used by FishMonger, the group believed to be operated by a Chinese contractor named I‑SOON. While we initially discovered the…
Malware
The #c3284d# Malware Network - Stats.php
08. this .seed = test + this .M; 10. return ( this .seed * this .oneOverM); 12. function RandomNumberGenerator(unix){ 13. var d = new Date(unix * 1000); 14. var s = Math.ceil(d.getHours() / 3); 15. this .seed = 2345678901 + (d.getMonth() * 0xF
Malware
StealC Is Back, and This Time It's a RAT
In June, Europol tore down StealC, a prominent infostealer, as part of Operation Endgame. International authorities seized 326 servers and 142 domains, recovered more than 25 million stolen credentials from 385,000 infected machines, and pulled the plug on…
MalwareInfostealersTakedowns and arrests
Tracking BokBot (IcedID) Infrastructure
BokBot (also known as IcedID) started life as a banking trojan using man-in-the-browser attacks to steal credentials from online banking sessions and initiate fraudulent transactions. Over time, the operator(s) of BokBot have also developed its use as a…
Malware
Silent Push Identifies More Than 10,000 Infected IPs as Part of SystemBC Botnet Malware Family
Using a custom-built SystemBC tracker, Silent Push Preemptive Cyber Defense Analysts identified more than 10,000 unique infected IP addresses as part of this botnet. While we don’t have immediate visibility on any follow-on malware payloads deployed via this…
MalwareBotnets and DDoS
Trust the Tunnel, Get the Trojan: Silver Fox Delivers Atlas RAT via Weaponized VPN Installers
Overview of the Silver Fox AtlasCross campaign kill chain, from typosquatted lure domains through the triple-nested Setup Factory installer to fileless AtlasCross RAT deployment. Executive Summary A multi-stage remote access trojan campaign is actively…
MalwareSupply chain
Gozi: The Malware with a Thousand Faces
Most of the time, the relationship between cybercrime campaigns and malware strains is simple. Some malware strains, like the gone-but-not-forgotten GandCrab, are intimately tied to a single actor, who is using the malware directly or distributing it via an…
Malware
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool Retefe (Android) Tool: Retefe (Android) Names Retefe (Android) Category Malware Type Banking trojan, Backdoor, Info stealer, Credential stealer, Botnet (GovCERT.ch) Recently, some anti-virus…
MalwareInfostealersMobile
Added Sat 24 Oct
Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic
A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini,…
MalwareSupply chain
Auditing the auditor: Unmasking Apex Accelerator
Elastic Security Labs identified a malicious npm package, @apexacc/cli , which led us to an operation posing as a Web3 accelerator. That operation had spent months building a public presence, targeting cryptocurrency start-ups and founders with offers of free…
Malware
Added Tue 20 Oct
Blog
KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize Group-IB researchers analyze KGB RAT, a Windows Remote Access Trojan advertised on underground forums as being fully undetectable, featuring a built-in crypter, HVNC, credential…
Malware
BiBi-Linux: A New Wiper Dropped By Pro-Hamas Hacktivist Group
Security Joes Incident Response team volunteered to assist Israeli companies during the times of war between the state of Israel and the terrorist organization Hamas. During the forensics investigation, we found what appears to be a new Linux Wiper malware we…
Malware
Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat
Downloaded payload is a variant of a cloud-based RAT known as RokRat which has been used by this group since 2017. This sample compilation date is 29 Oct 2019. This RAT is known to steal data from a victim’s machine and send them to cloud services (Pcloud,…
State-sponsoredMalware
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool Emissary Tool: Emissary Names Emissary Category Malware Type Backdoor (Palo Alto) This Trojan is related to the Elise backdoor described in the Operation Lotus Blossom report. Both Emissary…
Malware
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.