Research reports

1,224 reports from 387 publishers45 added in the past week

11 reports

11 reports, newest added first

Added Sun 25 Oct

FishMonger’s arsenal upgraded: SprySOCKS for Windows
ESET researchers have discovered two as-yet undocumented Windows variants of SprySOCKS, a previously Linux-only backdoor reportedly used by FishMonger, the group believed to be operated by a Chinese contractor named I‑SOON. While we initially discovered the…
Malware

ESET

Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances
Cyberespionage has remained a constant feature of Russia’s war against Ukraine. ESET Research has long tracked Gamaredon, one of the most active Russia-aligned advanced persistent threat (APT) groups targeting Ukraine. The group, attributed by the Security…
State-sponsored

ESET
Killing me gently: Inside Gentlemen’s EDR killer framework
ESET researchers analyzed the robust EDR-killing toolset of the ransomware-as-a-service gang Gentlemen. Since the beginning of 2026, Gentlemen has emerged as one of the most active gangs in the ransomware ecosystem. The group distinguishes itself through a…
Ransomware

ESET
Beware the SparroWock: The backdoor that bites, the commands that catch
ESET Research’s ongoing monitoring of FamousSparrow has borne fruit once again. Our previous public report on FamousSparrow revealed that this China-aligned APT group had developed two new versions of its custom backdoor named SparrowDoor. This time, we…
Malware

ESET

eset-apt-activity-report-q4-2025-q1-2026.pdf
MONITORING OIL SHIPMENTS, TARGETING DRONE MAKERS October 2025 – March 2026 Report ESET APT ACTIVITY REPORT OCTOBER 2025 - MARCH 2026 | 2 Contents Executive summary3 Attackers and targets5 China7 SteppeDriver: From Mongolia to Syria8 PhiliKit, a new implant in…
State-sponsored

ESETPDF
eset-apt-activity-report-q2-2025-q3-2025.pdf
APT down – the North Korea files 17 Russia 18 RomCom uses WinRAR zero day 19 Gamaredon
State-sponsored

ESETPDF

A rigged game: ScarCruft compromises gaming platform in a supply-chain attack
ESET researchers uncovered a multiplatform supply-chain attack by North Korea-aligned APT group ScarCruft, targeting the Yanbian region in China – home to ethnic Koreans and a crossing point for North Korean refugees and defectors. In the attack, probably…
MalwareSupply chainMobile

ESET

FrostyNeighbor: Fresh mischief and digital shenanigans
This blogpost covers newly discovered activities attributed to FrostyNeighbor, targeting governmental organizations in Ukraine. FrostyNeighbor has been running continual cyberoperations, changing and updating its toolset regularly, updating its compromise…

ESET

MuddyWater: Snakes by the riverbank
ESET researchers have identified new MuddyWater activity primarily targeting organizations in Israel, with one confirmed target in Egypt. MuddyWater, also referred to as Mango Sandstorm or TA450, is an Iran-aligned cyberespionage group known for its…
State-sponsoredMalware

ESET

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.