Research reports
1,224 reports from 387 publishers45 added in the past week
6 reports, newest added first
Added Wed 23 Sep
The Latest Addition to Turla’s Intelligence Gathering Apparatus
Google Threat Intelligence Group (GTIG) has conducted an in-depth analysis of a .NET backdoor, tracked as STOCKSTAY, that has been continually developed and deployed by the Russia-linked threat actor Turla (aka SUMMIT, Secret Blizzard, VENOMOUS BEAR,…
State-sponsoredMalware
Added Fri 1 May
How UNC6692 Employed Social Engineering to Deploy a Custom Malware Suite
Google Threat Intelligence Group (GTIG) identified a multistage intrusion campaign by a newly tracked threat group, UNC6692, that leveraged persistent social engineering, a custom modular malware suite, and deft pivoting inside the victim’s environment to…
State-sponsoredMalware
Added Mon 6 Apr
A Totally Tubular Treatise on TRITON and TriStation
In December 2017, FireEye's Mandiant discussed an incident response involving the TRITON framework. The TRITON attack and many of the publicly discussed ICS intrusions involved routine techniques where the threat actors used only what is necessary to succeed…
Malware
Added Wed 23 Apr 2025
apt37-reaper-the-overlooked-north-korean-actor.pdf
On Feb. 2, 2018, we published a blog detailing the use of an Adobe Flash zero-day vulnerability (CVE-2018-4878) by a suspected North Korean cyber espionage group that we now track as APT37 (Reaper). Recent examination of this group’s activities by FireEye…
State-sponsoredMalwareVulnerabilities
Added Fri 1 Nov 2024
M-Trends Report - 2020
Monetizing Ransomware 35 Crimeware as a Service 36 Threats From Within 40 4 SPECIAL REPORT M-TRE
Malware
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.