Research reports

Resources - SecurityScorecard

PHP2Shell Customer Advisory: CVE-2026-109618 and CVE-2026-109619 Remediation Guide SecurityScorecard’s PHP2Shell advisory covers CVE-2026-109618 and CVE-2026-109619: SecurityScorecard patched its affected PHP site on release day and found no exploitation. See…

Vulnerabilities

Resources - SecurityScorecard

The Denmark Central Population Register (CPR) breach exposed 8.8 million records through approved vendor access. See how continuous third-party risk monitoring and risk tiering reduce third-party exposure. The Simple Test That Separates Real AI Transformation…

A Deep Dive into Medusa Ransomware

Medusa ransomware appeared in June 2021, and it became more active this year by launching the “Medusa Blog” containing data leaked from victims that didn’t pay the ransom. The malware stops a list of services and processes decrypted at runtime and deletes the…

RansomwareMalware

How to Analyze Java Malware – A Case Study of STRRAT

STRRAT is a Java-based malware that executes multiple commands transmitted by the C2 server. The JAR file was obfuscated using the Allatori obfuscator. It establishes persistence on the host by copying to the Startup folder and creating a scheduled task and a…

Malware

LapDogs-STRIKE-Report-June-2025.pdf

SecurityScorecard’s STRIKE research team has identified a new suspected China-Nexus network of Operational Relay Boxes (ORB) called “LapDogs” targeting primarily Linux-based Small Office/Home Office (SOHO) devices around the globe. The LapDogs network has a…

Report_011325_Strike_Operation99.pdf

The SecurityScorecard STRIKE team has uncovered an ongoing cyberattack targeting software developers, orchestrated by the Lazarus Group, a North Korean state-sponsored hacking unit. Identified on January 9th and named Operation 99, this campaign builds on…

State-sponsored

Operation-Phantom-Circuit-Report_012725_03.pdf

SecurityScorecard.com info@securityscorecard.com Background During STRIKE’s investigation of Operation 99, our team identified multiple command-and-control (C2) servers active since September 2024. These servers, despite variations in payload structure and…

Operation-Marstech-Mayhem-Report_021025_03.pdf

SecurityScorecard.com info@securityscorecard.com Background In the wake of Operation99 and Operation Phantom Circuit, STRIKE uncovered that the Lazarus Group had engineered an advanced implant, codenamed "marstech1." This state-of-the-art tool marks a…

State-sponsoredMalware

Report-A-Detailed-Analysis-Of-The-Gafgyt-Malware-Targeting-IoT-Devices.pdf

SecurityScorecard.com info@securityscorecard.com Tower 49 12 E 49th Street Suite 15-001 New York, NY 10017 1.800.682.1707 A Detailed Analysis of the Gafgyt Malware Targeting IoT Devices Prepared by: Vlad Pasca, Senior Malware & Threat Analyst…

Malware