Research reports

1,224 reports from 387 publishers45 added in the past week

8 reports

8 reports, newest added first

Added Sun 23 Feb 2025

RedMike (Salt Typhoon) Exploits Vulnerable Cisco Devices of Global Telecommunications Providers
Insikt group observed RedMike exploiting privilege escalation vulnerabilities CVE-2023-20198 and CVE-2023-20273 to compromise unpatched Cisco network devices running Cisco IOS XE software. RedMike compromised devices of a US-based affiliate of a UK…
State-sponsoredVulnerabilities

Recorded FuturePDF

Chinese State-Sponsored RedDelta Targeted Taiwan, Mongolia, and Southeast Asia with Adapted PlugX Infection Chain
The group has used LNK files and MSC files as the first-stage components and ultimately loaded PlugX via search order hijacking. The group consistently used Cloudflare's CDN to proxy C2 traffic to threat actor-controlled C2 servers. This enables RedDelta to…
State-sponsored

Recorded FuturePDF

Rusia-Aligned TAG-110 Targets Asia and Europe with HATVIBE and CHERRYSPY
Since July 2024, 62 victims of custom malware HATVIBE and CHERRYSPY have been found across eleven countries, mostly in Central Asia, targeting government, human rights, and education sectors. Similar to other recent Russian APT campaigns, the group likely…
State-sponsored

Recorded FuturePDF

China-Nexus TAG-112 Compromises Tibetan Websites to Distribute Cobalt Strike
This campaign’s malicious infrastructure used Cloudflare for name servers, hiding the threat actor’s IP and complicating attribution — a technique increasingly observed among APT groups. TAG-112 overlaps with TAG-102 (Evasive Panda), a Chinese APT group…
State-sponsored

Recorded FuturePDF

Chinese State-Sponsored RedJuliett Intensifies Taiwanese Government, Academic, and Technology Sector Cyber Espionage via Network Perimeter Exploitation
States, Rwanda, Kenya, and Djibouti. Internet-facing devices such as firewalls, load balancers, and enterprise VPNs were targeted for initial access. SQL injection and directory traversal was attempted against web and SQL applications. RedJuliett likely…
State-sponsoredVulnerabilities

Recorded FuturePDF

TAG-100 Uses Open-Source Tools in Suspected Global Espionage Campaign, Compromising Two Asia-Pacific Intergovernmental Bodies
The group employs open-source remote access capabilities and exploits a wide range of internet-facing appliances for initial access, including enterprise VPN, firewall, and email appliances. TAG-100 compromised two major Asia-Pacific intergovernmental…
State-sponsored

Recorded FuturePDF

GRU's BlueDelta Targets Key Networks in Europe with Multi-Phase Espionage Campaigns
Azerbaijani think tank. Operational infrastructure was continuously evolved to deploy Headlace malware through three distinct phases, abusing legitimate services such as GitHub, Mocky, and InfinityFree. Credential harvesting campaigns targeted webmail service…
State-sponsored

Recorded FuturePDF

Attributing i-SOON: Private Contractor Linked to Multiple Chinese State-sponsored Groups
On February 18, 2024, an anonymous GitHub user posted a trove of leaked documents and material from Anxun Information Technology Co., Ltd. (安洵信息技术有限公司; also known as i-SOON), a China-based cybersecurity and information technology company that almost certainly…
State-sponsored

Recorded FuturePDF

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.