Search Post related with “Threat Research”
*Total Collection : 4851 Threat Research (auto update every day)
Last 100 Threat Research
- APT Silver Fox Utilizing Stock Investment Decoy and Undocumented Windows API to Evade Detection
- Hidden Malware Strikes Again: Mu-Plugins Under Attack
- Unveiling APT28’s Advanced Obfuscated Loader and HTA Trojan: A Deep Dive with x32dbg Debugging
- Major Cyber Attacks Targeting Transportation & Logistics Industry
- MAR-25993211-r1.v1 Ivanti Connect Secure (RESURGE)
- Analysis of Konni RAT: Stealth, Persistence, and Anti-Analysis Techniques
- Apache Tomcat: CVE-2025-24813
- Lotus Blossom: New Sagerunex Backdoor Variants Are Targeting APAC Governments
- A Deep Dive into Water Gamayun’s Arsenal and Infrastructure
- TsarBot: A New Android Banking Trojan Targeting Over 750 Banking, Finance, and Cryptocurrency Applications
- How an Exposed Jenkins Instance Led to a Full-Scale Infrastructure Compromise
- I Am Not A Robot
- StreamElements Confirms Third-Party Data Breach from an Infostealer Infection
- PJobRAT makes a comeback, takes another crack at chat apps
- How SVigil Prevented a Massive Supply Chain Breach in Banking Infrastructure?
- XWorm Unmasked: Weaponizing Script Obfuscation and Modern Evasion Techniques
- Weaver Ant: Tracking a China-Nexus Cyber Espionage Operation
- Shifting the sands of RansomHub’s EDRKillShifter
- CoffeeLoader: A Brew of Stealthy Techniques
- Unsecured Loans: How Hidden Flaws in Digital Lending Platforms Could Cripple Your Fintech Business
- New Phishing Campaign Uses Browser-in-the-Browser Attacks to Target Video Gamers/Counter-Strike 2 Players
- Malware found on npm infecting local package with reverse shell
- Consequences of INPS-themed Smishing: Stolen Documents for Sale Online
- Arkana Ransomware Group Hacks WideOpenWest Using Data from an Infostealer Infection
- Beyond the Scanner: How Phishers Outsmart Traditional Detection Mechanisms
- SnakeKeylogger: A Multistage Info Stealer Malware Campaign
- Inside Kimsuky’s Latest Cyberattack: Analyzing Malicious Scripts and Payloads
- Detecting and Mitigating IngressNightmare – CVE-2025-1974
- Operation ForumTroll: APT attack with Google Chrome zero-day exploit chain
- New Malicious Wave via PEC: MintsLoader Now Distributes AsyncRat
- YouTube Creators Under Siege Again: Clickflix Technique Fuels Malware Attacks
- The Curious Case of PlayBoy Locker
- Raspberry Robin: Copy Shop USB Worm Evolves to Initial Access Broker Enabling Other Threat Actor Attacks
- CVE-2025-26633: How Water Gamayun Weaponizes MUIPath using MSC EvilTwin
- GorillaBot: Technical Analysis and Code Similarities with Mirai
- New Android Malware Campaigns Evading Detection Using Cross-Platform Framework .NET MAUI | McAfee Blog
- Active Lumma Stealer Campaign Impacting U.S. SLTTs
- RaaS Evolved: LockBit 3.0 vs LockBit 4.0
- Tempted to Classifying APT Actors: Practical Challenges of Attribution in the Case of Lazarus’s Subgroup
- FizzBuzz to FogDoor: Targeted Malware Campaign Exploits Job-Seeking Developers
- Warning Against Phishing Emails Distributing GuLoader Malware by Impersonating a Famous International Shipping Company
- Shedding Light on the ABYSSWORKER Driver – Elastic Security Labs
- Threat Intelligence Report Mar 18th,– Mar 24th, 2025
- Part 2: Validating the Breach Oracle Cloud Denied – CloudSEK’s Follow-Up Analysis
- How a Fake Meta Email Leads to Password Plunder
- Detailed Analysis of DocSwap Malware Disguised as Security Document Viewer
- Technical Advisory: Mass Exploitation of CVE-2024-4577
- The New Face of PowerShell: Ransomware Powered by PowerShell-Based Attacks
- VanHelsing, new RaaS in Town
- South Korean Organizations Targeted by Cobalt Strike Cat Delivered by a Rust Beacon
- New Ransomware Operator Exploits Fortinet Vulnerability Duo
- Malicious Ads Targeting Advertisers in the DNS Spotlight
- Rapid7 MDR Supports AWS GuardDuty’s New Attack Sequence Alerts
- The Biggest Supply Chain Hack Of 2025: 6M Records For Sale Exfiltrated from Oracle Cloud Affecting over 140k Tenants
- Operation FishMedley
- Not Lost in Translation: Rosetta 2 Artifacts in macOS Intrusions
- GoStringUngarbler: Deobfuscating Strings in Garbled Binaries
- Albabat Ransomware Group Potentially Expands Targets to Multiple OS, Uses GitHub to Streamline Operations
- RansomHub: Attackers Leverage New Custom Backdoor
- Squid Werewolf Cyber Spies Masquerade as Recruiters
- VanHelsing Ransomware
- Dark Web Profile: FSociety (Flocker) Ransomware
- Black Basta’s Dependency Confusion Ambitions and Ransomware in Open Source Ecosystems
- SideWinder Threat Group: Maritime and Nuclear Sectors at Risk with Updated Toolset
- The Art of Evasion: How Attackers Use VBScript and PowerShell in the Obfuscation Game
- North Korea Kimsuky Malicious Backdoor VBS Script-vbs.html (2025.3.16)
- Resurgence of a Fake Captcha Malware Campaign
- A Deep Dive into Strela Stealer and How It Targets European Countries
- GrassCall Campaign: The Hackers Behind Job Recruitment Cyber Scams
- Fake Cloudflare Verification Results in LummaStealer Trojan Infections
- SQLi, XSS, and SSRF: Breaking Down Zimbra’s Latest Security Threats
- Emulating the Sophisticated Chinese Adversary Salt Typhoon
- The Things We Think and Do Not Say: The Future of Our Beacon Object Files (BOFs)
- The Information Heist: Cracking the Code on Infostealers (New Hudson Rock Interview)
- Securing XIoT in the Era of Convergence and Zero Trust
- ZDI-CAN-25373: Windows Shortcut Exploit Abused as Zero-Day in Widespread APT Campaigns
- Sneaking a Peek into the Inner DNS Workings of Sneaky 2FA
- Threat Assessment: GitHub Actions Supply Chain Attack: The Compromise of tj-actions/changed-files
- Targeted phishing campaign at UniPd: approximately 200 compromised credentials
- Securonix Threat Labs Monthly Intelligence Insights – February 2025
- Hundreds of Malicious Google Play-Hosted Apps Bypassed Android 13 Security With Ease
- ClearFake’s New Widespread Variant: Increased Web3 Exploitation for Malware Delivery
- Silk Typhoon Targeting IT Supply Chain
- Malvertising Campaign Leads to Info Stealers Hosted on GitHub
- Phishing campaign impersonates Booking dot com delivers a suite of credential stealing malware
- Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor
- Threat Spotlight: Credential Theft vs. Admin Control—Two Devastating Paths to VPN Exploitation
- Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers | Google Cloud Blog
- Unraveling Time: A Deep Dive into TTD Instruction Emulation Bugs
- BitM Up! Session Stealing in Seconds Using the Browser-in-the-Middle Technique
- Capture the Flag: A Cybersecurity Challenge with Cado
- Medusa Ransomware Hits Record Levels, FBI and CISA Provide Key Security Insights
- New XCSSET Malware Adds New Obfuscation and Persistence Techniques to Infect Xcode Projects | Microsoft Security Blog
- StilachiRAT analysis: From system reconnaissance to cryptocurrency theft | Microsoft Security Blog
- New GitHub Action supply chain attack: reviewdog/action-setup
- Unmasking Hidden Threats: How BeVigil Secures Apache ActiveMQ from Cyber Risks
- Major Cyber Attacks in Review: February 2025
- Downloader Malware Written in JPHP Interpreter
- Jaguar Land Rover Breached by HELLCAT Ransomware Group Using Its Infostealer Playbook—Then a Second Hacker Strikes
- What Is The New Steganographic Campaign Distributing Multiple Malware
>> Access All Threat Research
Reference for Threat Research
This Threat Research category section will FILTER and FETCH the POST (related with Analysis Report only) from the following sites:
- asec.ahnlab.com
- any.run/cybersecurity-blog/
- attackiq.com
- bitdefender.com/blog/labs/
- cadosecurity.com/blog/
- cisa.gov/news-events/cybersecurity-advisories/
- crowdstrike.com/blog/
- cybereason.com/blog/category/research/
- darktrace.com/blog/
- fortinet.com/blog/threat-research/
- harfanglab.io/en/insidethelab/
- malwarebytes.com/blog/threat-intelligence/
- mandiant.com/resources/blog/
- mcafee.com/blogs/other-blogs/mcafee-labs/
- proofpoint.com/us/blog
- securelist.com/tag/malware-descriptions/
- securityintelligence.com/category/x-force/threat-intelligence/
- blog.talosintelligence.com
- trendmicro.com/en_us/research/
- unit42.paloaltonetworks.com
- nextron-systems.com/blog/
- team-cymru.com/blog/categories/threat-research/
- zscaler.com/blogs/
- blog.sonicwall.com
- labs.k7computing.com/
- recordedfuture.com/blog
- blog.sekoia.io/category/research-threat-intelligence/
- embee-research.ghost.io
- netspi.com/blog/technical/
- huntress.com/blog
- other 100++ sources
For the sites below, automatic FETCH cannot be performed
(i need to monitor it manual, will be delay 3-7 days)
Bellow are other reference, but for some reason i’m not fetching it automatically
(i need to review the article manually, will be delay 3-5 days)
- cleafy.com/labs (update 1-2 months)
- guidepointsecurity.com/blog/ > category: threat advisory
- research.openanalysis.net
- blog.phylum.io/tag/research/
- shadowstackre.com/analysis/
- mssplab.github.io
- farghlymal.github.io
- asec.ahnlab.com/ko/
- blog.bushidotoken.net
- kroll.com/en/insights/publications/cyber
- Sentinelone.com
- blog.lumen.com
Update
- December, 2024: securonixblog – Fixed (xpath error)
- December, 2024: huntress – Fixed (xpath error)
- December, 2024: nccgroup – Failed (Incapsula)
- December, 2024: Mandiant – Removed (now part of Google Cloud)
- December, 2024: antiy.cn – Failed (curl or xpath error)
- December, 2024: sonicwall.com – Failed (curl error)
- January, 2025: team-cymru.com (RSS Feed Removed)
Update January, 2025
“Due to copyright reasons, starting January 2025, this site will no longer display the full content of sourced articles. Only Summaries, Key Points, MITRE Tactics for Threat Research, and selected IoCs will be provided. To read the full article, please click on the ‘source’ link to view it on the original website.”