Research reports
1,224 reports from 387 publishers45 added in the past week
Added Mon 26 Oct
Stray Cat, Open Doors: How k0t Wanders Through the Network Edge
Group-IB Threat Intelligence, together with NyxLab, collaborated on a joint investigation on a campaign involving widespread exploitation of network edge devices. This joint-investigation effort has managed to uncover indications that this may be connected to…
Vulnerabilities
Added Tue 20 Oct
Blog
KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize Group-IB researchers analyze KGB RAT, a Windows Remote Access Trojan advertised on underground forums as being fully undetectable, featuring a built-in crypter, HVNC, credential…
Malware
Added Thu 3 Sep
Anatomy of BraZetsu: How Cybercriminals Fuel the Underground Ecosystem
The Group-IB Threat Intelligence team has identified BraZetsu, a sophisticated Python-based Windows malware framework that we attribute, with high confidence, to the Brazilian threat actor known as Exilware. Unlike the standard infostealer model, BraZetsu is…
Added Sat 25 Jul
JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake
In mid-April 2026, an exposed directory on an operator-owned Alibaba Cloud server gave us a complete view into an active China-nexus operation. The server with bash history, toolkits, webshell paths against victims, and staged phishing packages were all…
Phishing
Added Thu 4 Jun
The GHOST STADIUM Score: Billions At Stake At The World’s Largest Football Tournament
The 2026 FIFA World Cup is set to be the largest sporting event in history. Hosted across three nations — the United States, Canada, and Mexico — the tournament will take place from June 11 to July 19, 2026, featuring 104 matches played in 16 cities. The…
Added Thu 7 May
report-redcurl-awakening-en
2. The report provides information on the tactics, tools, and infrastructure of the cybercriminal group RedCurl. The report’s goal is to minimize the risk of the group committing further illegal acts, suppress any such activity in a timely manner, and raise…
The footprints of Raccoon
In the summer of 2020, Group-IB specialists discovered a malware distribution campaign exploiting Telegram’s legitimate features. Analysis showed that the attackers used the technique to distribute Raccoon stealer, i.e. malware spread through the…
MalwareInfostealers
Added Tue 5 May
The Darker Things
Today, on November 3, BlackMatter gang announced it was shutting its Ransomware-as-a-Service program due to the “pressure from the authorities”. However, it doesn’t mean that BlackMatter’s affiliates will stop malicious activity. They will most likely join…
Ransomware
We see you, Gozi
The ISFB Trojan also known as Gozi ISFB first appeared in 2014. It is based on Gozi, which was released in 2006 and developed by Russian threat actors. Gozi was designed to collect network traffic and steal credentials from browsers and email clients. It has…
Malware
Craxs Rat, the master tool behind fake app scams and banking fraud
Since April 2023, a series of scams involving fake Android apps have targeted Singapore. These fake apps are banking trojans used to harvest victims’ banking credentials and personal information, as well as to take control of their devices. In this specific…
MalwareMobile
Cat’s out of the bag: Lynx Ransomware-as-a-Service
Ransomware remains one of the most profitable cyberthreats, with new variants and business models evolving faster than many organizations can respond. Fueled by the expansion of Ransomware-as-a-Service (RaaS), the proliferation of stolen data on Dedicated…
Ransomware
IcedID: new malware version
What did malware analysts think when they first heard the words IcedID and BokBot? Undoubtedly things like: web injects, proxy servers, quick version updates… The updates were sometimes so fast that while analysts were studying the current version, a new one…
Malware
Group-IB uncovers Android Trojan named «Gustuff» capable of targeting more than 100 global banking apps, cryptocurrency and marketplace applications
Group-IB, an international company that specializes in preventing cyberattacks, has detected activity of Gustuff a mobile Android Trojan, which includes potential targets of customers in leading international banks, users of cryptocurrency services, popular…
MalwareMobile
ATT&CKing ProLock Ransomware
The success of enterprise ransomware attacks has motivated more and more threat actors to join the game. One of these new players is ProLock ransomware. The locker emerged in March 2020 as the successor of PwndLocker, which began operating in late 2019 and…
Ransomware
Inside the Hive
In the first 11 months of 2021, over 60% of all incidents investigated by Group-IB involved ransomware. Ransomware has finally established itself as cyber threat number one. In July 2021, international media reported that REvil ransomware operators demanded a…
Ransomware
Cybercriminal greeners from Iran attack companies worldwide for financial gain
Group-IB, a global threat hunting and intelligence company headquartered in Singapore, has detected financially motivated attacks carried out by Iranian newbie threat actors in June. The attackers used Dharma ransomware and a mix of publicly available tools…
RansomwareState-sponsored
Godfather Trojan - mobile banking malware that is impossible to refuse
The Android banking Trojan Godfather is currently being utilized by cybercriminals to attack users of popular financial services across the globe. Godfather is designed to allow threat actors to harvest login credentials for banking applications and other…
MalwareMobile
Added Fri 1 May
Cobalt Renaissance
On March 26, 2018, Europol reported the arrest of the Cobalt gang leader in Alicante, Spain. The Bank of Russia named Cobalt as the main threat to banks. The scale of its activities is fascinating: according to Europol, the group has been linked to thefts of…
Takedowns and arrests
Ransomware gang Conti published data of 850 companies
Group-IB, one of the global leaders in cybersecurity and headquartered in Singapore, has today presented its findings about ARMattack, one of the shortest yet most successful campaigns by the Russian-speaking ransomware gang Conti. In slightly more than a…
Ransomware
Group-IB’s new report on Silence: Damage from Silence APT operations increases fivefold
Group-IB, a Singapore-based cybersecurity company that specializes in preventing cyberattacks, has exposed the most recent campaigns carried out by Silence, a Russian-speaking APT group, in the new “Silence 2.0: Going Global” report. Group-IB experts…
State-sponsored
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.