Research reports

Google-Calendar-as-C2-infrastructure-a-China-nexus-campaign-with-stealthy-tactics.pdf

GOOGLE CALENDAR AS C2 INFRASTRUCTURE: A CHINA-NEXUS CAMPAIGN... CHEN & HSU 2 VIRUS BULLETIN CONFERENCE SEPTEMBER 2025 ABSTRACT In recent years, China-nexus threat groups have increasingly adopted tactics to obscure their malware footprint, particularly…

Malware

Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdf

2 VIRUS BULLETIN CONFERENCE OCTOBER 2024 ABSTRACT In this paper we provide an in-depth analysis of UNC3569, a prolific and sophisticated threat actor operating within the Chinese cybercriminal and cyber contractor-for-hire ecosystem, mostly operating out of…

State-sponsoredVulnerabilities

DeceptiveDevelopment-and-North-Korean-IT-workers-from-primitive-crypto-theft-to-sophisticated-AI-based-deception.pdf

DECEPTIVEDEVELOPMENT: FROM PRIMITIVE CRYPTO THEFT TO... HAVRÁNEK & KÁLNAI 2 VIRUS BULLETIN CONFERENCE SEPTEMBER 2025 ABSTRACT DeceptiveDevelopment, also known as Contagious Interview, is a North Korea-aligned group whose activities have increased in…

Sugarcoating-KANDYKORN-a-sweet-dive-into-a-sophisticated-MacOS-backdoor.pdf

No excerpt available.

Malware

The-Mask-has-been-unmasked-again.pdf

The Mask (also known as Careto) is an advanced threat actor that has been operating since at least 2007. In the past, it was observed to conduct cyber espionage campaigns that mainly targeted high-profile organizations. This actor’s attacks have always been…

Vulnerabilities

Let's go door with KCP

In 2022 we observed the use of new APT malware by an unknown China-based APT actor across several incidents in Japan. The malware uses KCP protocol for backdoor communication and was coded in Golang on multiple platform operating systems – we named it…

State-sponsoredMalware

CrackedCantil-a-malware-symphony-delivered-by-cracked-software-performed-by-loaders-infostealers-ransomware-et-al.pdf

The digital landscape teems with diverse malware families, each engineered with distinct capabilities – ranging from data theft, deployment of additional malicious payloads, to destruction of data and more. Yet, beneath their varied functionalities, these…

RansomwareMalwareInfostealers

Uncovering a broad criminal ecosystem powered by one of the largest botnets, Glupteba

Botnets continue to represent a serious threat for companies and individuals worldwide. However, little is known about exactly how botnets are monetized and how revenues flow to criminal actors. Our research uncovers a whole criminal network of organizations…

Botnets and DDoS

Glupteba - Virus Bulletin

Threat Analysis Group twitter: @luca_nagy_ Sept, 2022 UNCOVERING A BROAD CRIMINAL ECOSYSTEM POWERED BY ONE OF THE LARGEST BOTNETS, GLUPTEBA LUCA NAGY Threat Analysis Group twitter: @luca_nagy_ Security Engineer @ Google Threat Analysis Group (TAG) CRIME Luca…

Possible supply chain attack targeting South Asian government delivers Shadowpad

2 VIRUS BULLETIN CONFERENCE OCTOBER 2023 ABSTRACT Shadowpad is a malware family that has been involved in multiple advanced campaigns, starting in 2017 with a supply chain attack against NetSarang software, and an ASUS compromise in 2018, all attributed to…

MalwareSupply chain

Slides-Possible-supply-chain-attack-targeting-South-Asian-government-delivers-Shadowpad.pdf

Introduction • In March 2023, we noticed a detection hit from September 2022 for mscoree.dll in an uncommon directory − Mscoree.dll is a commonly used name for loaders of Shadowpad • This malicious DLL was embedded in a CAB file, itself embedded in an MSI…

Supply chain