Research reports
1,224 reports from 387 publishers45 added in the past week
11 reports, newest added first
Added Fri 16 Oct
Why Are You Texting Me? UNC3944 Leverages SMS Phishing Campaigns for SIM Swapping, Ransomware, Extortion, and Notoriety
UNC3944 is a financially motivated threat cluster that has persistently used phone-based social engineering and SMS phishing campaigns (smishing) to obtain credentials to gain and escalate access to victim organizations. At least some UNC3944 threat actors…
RansomwareState-sponsoredPhishing
Added Wed 7 Oct
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
As an update to the June 2026 post, ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit, Mandiant and Google Threat Intelligence Group (GTIG) have identified renewed mass exploitation of CVE-2026-35273 by UNC6240 (ShinyHunters), along with…
State-sponsoredVulnerabilities
Added Wed 23 Sep
The Latest Addition to Turla’s Intelligence Gathering Apparatus
Google Threat Intelligence Group (GTIG) has conducted an in-depth analysis of a .NET backdoor, tracked as STOCKSTAY, that has been continually developed and deployed by the Russia-linked threat actor Turla (aka SUMMIT, Secret Blizzard, VENOMOUS BEAR,…
State-sponsoredMalware
Added Fri 1 May
How UNC6692 Employed Social Engineering to Deploy a Custom Malware Suite
Google Threat Intelligence Group (GTIG) identified a multistage intrusion campaign by a newly tracked threat group, UNC6692, that leveraged persistent social engineering, a custom modular malware suite, and deft pivoting inside the victim’s environment to…
State-sponsoredMalware
Added Wed 23 Apr 2025
rpt-apt29-hammertoss-stealthy-tactics-define-en.pdf
Stage 1: The Communication Process Begins with Twitter 7 Figure 1: HAMMERTOSS calls out to a Twitter handle 7 Stage 2: Tweeting a URL, Minimum File Size of an Image, and Part of an Encryption Key 8 Figure 2: Learning the URL, image size, and encryption key 8…
State-sponsored
apt37-reaper-the-overlooked-north-korean-actor.pdf
On Feb. 2, 2018, we published a blog detailing the use of an Adobe Flash zero-day vulnerability (CVE-2018-4878) by a suspected North Korean cyber espionage group that we now track as APT37 (Reaper). Recent examination of this group’s activities by FireEye…
State-sponsoredMalwareVulnerabilities
Added Mon 18 Nov 2024
01-chinese-espionage-article-m-trends-2024.pdf
Endpoint detection and response (EDR) platforms have become commonplace among companies seeking to expand the visibility into endpoint activity necessary to provide a baseline of security monitoring. This increase in visibility has forced attackers to evolve…
State-sponsored
Added Fri 1 Nov 2024
apt43-report-en.pdf
2M A N D I A N T APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations APT43 Executive Summary • APT43 is a prolific cyber operator that supports the interests of the North Korean regime. The group combines moderately-sophisticated technical…
State-sponsored
rpt-apt38-2018-web_v5-1.pdf
APT38 is a financially motivated North Korean regime-backed group responsible for conducting destructive attacks against financial institutions, as well as some of the world's largest cyber heists. Based on widely publicized operations alone, the group has…
State-sponsored
Added Wed 24 Apr 2024
APT1: Exposing One of China’s Cyber Espionage Units
APT1: Exposing One of China’s Cyber Espionage Units | Mandiant | FireEye APT1 Exposing One of China’s Cyber Espionage Units Mandiant APT1 www.mandiant.com Contents Executive…
State-sponsored
Added Fri 19 Apr 2024
apt44-unearthing-sandworm.pdf
Gabby Roncone, Dan Black, John Wolfram, Tyler McLellan, Nick Simonian, Ryan Hall, Anton Prokopenkov, Dan Perez, Lexie Aytes, Alden Wahlstrom Acknowledgements Collaboration with companies and governments to track and mitigate threats is critical to our…
State-sponsored
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.