Research reports

How-to-use-msfvenom

No excerpt available.

GitHub - FallenAstaroth/stink: the cutest python-native infostealer

No excerpt available.

Infostealers

GitHub - GhostPack/SafetyKatz: SafetyKatz is a combination of slightly modified version of @gentilkiwi's Mimikatz project and @subtee's .NET PE Loader

First, the MiniDumpWriteDump Win32 API call is used to create a minidump of LSASS to C:\Windows\Temp\debug.bin. Then @subtee's PELoader is used to load a customized version of Mimikatz that runs sekurlsa::logonpasswords and sekurlsa::ekeys on the minidump…

Malware

cti/runster/readme.md at main · cert-orangecyberdefense/cti

Update (2026-06-17): our related "Payload C" is likely tied to MetaStealer and was recently detailed by Huntress, which named it Potemkin loader. Another blog by Walmart on this new DGA is available here. Orange Cyberdefense CERT has been tracking a…

Malware

GitHub - yankywilson/jdy-botnet-threat-analysis: Defensive CTI analysis of the JDY reconnaissance botnet (China-nexus, Volt Typhoon / KV lineage, MITRE G1017): MIPS64 implant reverse engineering, infrastructure enumeration, tiered intelligence reporting, Sigma/YARA detections, and a tasking decryptor. TLP:CLEAR.

A complete defensive analysis of the JDY botnet: reverse engineering of the implant, enumeration of its control infrastructure, three-tier intelligence reporting, deployable detections, and a working tasking decryptor. JDY is a China-nexus reconnaissance…

State-sponsoredMalwareBotnets and DDoS

XenoRAT-Malware-Analysis/Reports/XenoRAT_EN.md at main · Yavuzhanzgen/XenoRAT-Malware-Analysis

This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. XenoRAT Technical Analysis Report Static Analysis • Dynamic Analysis •…

Malware

threat-research/ancient-botnet at main · ksi-digital/threat-research

We captured a botnet family that calls itself "ancient" in our SSH/Telnet honeypot. Between 2026-10-04 and 2026-10-05 we observed its delivery chain, three iterations of its dropper, and its C2 behaviour. We confirmed its C2 server live. We have not found a…

MalwareBotnets and DDoS

Amadey-Malware-Analysis/Reports/Amadey_EN.md at main · Yavuzhanzgen/Amadey-Malware-Analysis

This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. Amadey Technical Analysis Report Static Analysis • Dynamic Analysis •…

Malware

public-research/drifter/report.md at main · deepfield/public-research

What distinguishes Drifter is how it hides. Its C2 domains are named after IP camera brands ( cctv[.]su , nvms9000[.]su ), chosen to blend with the traffic of devices that

Botnets and DDoS

ValleyRAT-Malware-Analysis/Reports/ValleyRat-EN.md at main · Yavuzhanzgen/ValleyRAT-Malware-Analysis

This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. ValleyRAT Technical Analysis Report Static Analysis • Dynamic Analysis •…

Malware

KoiLoader-Malware-Analysis/Reports/KoiLoader-EN.md at main · Yavuzhanzgen/KoiLoader-Malware-Analysis

This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. KoiLoader Technical Analysis Report Static Analysis • Dynamic Analysis •…

Malware

public-research/potassium/report.md at main · deepfield/public-research

Content warning: This report quotes malware artifacts verbatim, including domain names, URL paths, campaign tags, and embedded strings chosen by the threat actor. Some contain crude or offensive language, including an antisemitic slur. These are reproduced…

Botnets and DDoS

XWorm-Malware-Analysis/Reports/XWorm_v3.1_Report_EN.md at main · Yavuzhanzgen/XWorm-Malware-Analysis

This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples have been analyzed in an isolated laboratory environment. XWorm V3.1 Malware T Static Analysis • Dynamic Analysis • Reverse…

Malware

XoriumStealer-Malware-Analysis/Reports/XoriumStealer-EN.md at main · Yavuzhanzgen/XoriumStealer-Malware-Analysis

This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. Xorium Stealer Malware T Static Analysis • Dynamic Analysis • Reverse…

Malware

public-research/datasurge/report.md at main · deepfield/public-research

Most Mirai forks spread first and ask questions later. They brute-force telnet, chain CVEs, scan port ranges, and race to claim as many devices as possible before the next reboot clears them from memory. Datasurge does not. It has no propagation scanner, no…

Vulnerabilities

StealC-Malware-Analysis/Reports/StealC-V2-EN.md at main · Yavuzhanzgen/StealC-Malware-Analysis

This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. StealC V2 Malware Technical Analysis Static Analysis • Dynamic Analysis •…

MalwareInfostealers

AsyncRAT-Malware-Analysis/Reports/AsyncRAT-EN.md at main · Yavuzhanzgen/AsyncRAT-Malware-Analysis

This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. -EN.md at main · -Malware-Analysis AsyncRAT Technical Analysis Report…

Malware

BabylonRAT-Malware-Analysis/Reports/BabylonRAT-EN.md at main · Yavuzhanzgen/BabylonRAT-Malware-Analysis

This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All analyses were conducted in an isolated laboratory environment. -EN.md at -Malware-Analysis BabylonRAT Technical Analysis Report Static…

Malware

public-research/cecbot/report.md at main · deepfield/public-research

No excerpt available.

Botnets and DDoSMobile

Trivy ecosystem supply chain temporarily compromised

On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in aquasecurity/setup-trivy On March 22, 2026, a threat actor used compromised credentials to publish a malicious…

Supply chain