Research reports
1,224 reports from 387 publishers45 added in the past week
Added Tue 20 Oct
Blog
KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize Group-IB researchers analyze KGB RAT, a Windows Remote Access Trojan advertised on underground forums as being fully undetectable, featuring a built-in crypter, HVNC, credential…
Malware
Added Thu 7 May
The footprints of Raccoon
In the summer of 2020, Group-IB specialists discovered a malware distribution campaign exploiting Telegram’s legitimate features. Analysis showed that the attackers used the technique to distribute Raccoon stealer, i.e. malware spread through the…
MalwareInfostealers
Added Tue 5 May
We see you, Gozi
The ISFB Trojan also known as Gozi ISFB first appeared in 2014. It is based on Gozi, which was released in 2006 and developed by Russian threat actors. Gozi was designed to collect network traffic and steal credentials from browsers and email clients. It has…
Malware
Craxs Rat, the master tool behind fake app scams and banking fraud
Since April 2023, a series of scams involving fake Android apps have targeted Singapore. These fake apps are banking trojans used to harvest victims’ banking credentials and personal information, as well as to take control of their devices. In this specific…
MalwareMobile
IcedID: new malware version
What did malware analysts think when they first heard the words IcedID and BokBot? Undoubtedly things like: web injects, proxy servers, quick version updates… The updates were sometimes so fast that while analysts were studying the current version, a new one…
Malware
Group-IB uncovers Android Trojan named «Gustuff» capable of targeting more than 100 global banking apps, cryptocurrency and marketplace applications
Group-IB, an international company that specializes in preventing cyberattacks, has detected activity of Gustuff a mobile Android Trojan, which includes potential targets of customers in leading international banks, users of cryptocurrency services, popular…
MalwareMobile
Godfather Trojan - mobile banking malware that is impossible to refuse
The Android banking Trojan Godfather is currently being utilized by cybercriminals to attack users of popular financial services across the globe. Godfather is designed to allow threat actors to harvest login credentials for banking applications and other…
MalwareMobile
Added Fri 1 May
Gustuff: Weapon of Mass Infection
“Serious product for individuals with skills and experience,” — that’s how Gustuff was advertised by its seller nicknamed Bestoffer on an underground forum in December 2018. Although the Trojan was developed by a Russian-speaking cybercriminal, Gustuff…
Malware
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.