Research reports
1,224 reports from 387 publishers45 added in the past week
7 reports, newest added first
Added Tue 8 Sep
Lx(Base) RAT: A Technical Deep Dive
During a recent malware analysis, I encountered an interesting sample ( 256 : 5a26fd462a809c89b0448318591cb98a77a7b96fca658815dc0f547a51958bed an embedded PowerShell script and Base64-encoded payload that ultimately deploys the sophisticated LxBase .NET RAT.…
Malware
Added Tue 1 Sep
Reverse Engineering the Auto-Color Linux Backdoor
Static and dynamic analysis of Auto-Color’s execution flow, C2 communication, and LD_PRELOAD rootkit. Auto-Color in a Nutshell Auto-Color is an emerging Linux backdoor first documented by Palo Alto Networks Unit 42 in February 2025. The earliest known samples…
Malware
Added Tue 4 Aug
1337_GTWK Linux Malware Analysis
This is the second part of a two-part series about a new Linux malware sample that I analysed (Click here for Part 1). In Part 1, we examined its website and the malware’ itself. The malware consists of two stages, with the second stage comprising two…
Malware
Added Fri 31 Jul
MetaStealer traffic, new DGAs and analyzing the “tracker” backdoor DGA with AI
In this blog we simply want to highlight a few new additions to what appears to be related to MetaStealer, one is a new wordlist based DGA used by MetaStealer. We also want to highlight that MetaStealer’s proxies or ‘gates’ don’t actually care what domain…
Malware
Added Wed 22 Jul
Operation Turb00 — Part 3: Unmasking the SnappyClient RAT
The orchestrator behind the first chain, WizardDa42.exe (the legitimate Radmin VPN process), also launches this second one. Beyond that shared parent process, the two have nothing in common, as
Malware
Added Sun 3 May
Winnti: More than just Windows and Gates
The Winnti malware family was first reported in 2013 by Kaspersky Lab¹. Since then, threat actors leveraging Winnti malware have victimized a diverse set of targets for varied motivations. While the name ‘Winnti’ in public reporting was previously used to…
Malware
Added Fri 1 May
Kimsuky disguised as a Korean company signed with a valid certificate to distribute Troll Stealer…
S2W threat research and intelligence center Talon has hunted for and analyzed a sample of what is believed to be a new malware from the Kimsuky group on VirusTotal. — The malware was found to be distributed from a page that redirects users to a specific site…
State-sponsoredMalwareInfostealers
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.