Click here to download all references as Bib-File.•

Enter keywords to filter the library entries below or Propose new Entry
2026-03-23 ⋅ Netomize ⋅ Mohamad Mokbel
Detect SnappyClient C&C Traffic Using PacketSmith + Yara-X Detection Module
SnappyClient
2026-03-20 ⋅ Nextron Systems ⋅ Pezier Pierre-Henri
RegPhantom Backdoor Threat Analysis
RegPhantom
2026-03-06 ⋅ Palo Alto Networks Unit 42 ⋅ Tom Fakterman
An Investigation Into Years of Undetected Operations Targeting High-Value Sectors
Godzilla Webshell CL-UNK-1068
2026-02-19 ⋅ Elastic ⋅ Elastic Security Labs, Salim Bitam
MIMICRAT: ClickFix Campaign Delivers Custom RAT via Compromised Legitimate Websites
AstarionRAT
2026-02-17 ⋅ Google ⋅ Daniel Sislo, Fernando Tomlinson, John Scarbrough, Jr., Nick Harbour, PETER UKHANOV, Rich Reece
From BRICKSTORM to GRIMBOLT: UNC6201 Exploiting a Dell RecoverPoint for Virtual Machines Zero-Day
BRICKSTORM GRIMBOLT SLAYSTYLE UNC6201
2026-02-04 ⋅ safebreach ⋅ Tomer Bar
Prince of Persia, Part II: Covering Tracks, Striking Back & a Revealing Link to the Iranian Regime Amid the Country’s Internet Blackout
Infy StormKittyRAT
2026-01-28 ⋅ Accenture ⋅ Accenture Cyber Threat Intelligence
Analysis of RustyRocket – A Custom WorldLeaks Exfiltration Tool
RustyRocket
2026-01-27 ⋅ Medium mk7912 ⋅ Manoj Kshirsagar
From XLoader to Phantom Stealer: A DHL-Themed multi-stage Infection Chain
Xloader Phantom Stealer
2025-12-18 ⋅ safebreach ⋅ Tomer Bar
Prince of Persia: A decade of Iranian Nation State APT Campaign Activity
Infy Tonnerre
2025-12-08 ⋅ Trend Micro ⋅ Aliakbar Zahravi
AI-Automated Threat Hunting Brings GhostPenguin Out of the Shadows
GhostPenguin
2025-11-19 ⋅ Spamhaus ⋅ Jonas Arnold
The anatomy of bulletproof hosting – past, present, future
2025-11-04 ⋅ LevelBlue ⋅ Serhii Melnyk
Scattered LAPSUS$ Hunters: Anatomy of a Federated Cybercriminal Brand
Scattered Lapsus Hunters
2025-10-22 ⋅ SentinelOne ⋅ Tom Hegel
PhantomCaptcha | Multi-Stage WebSocket RAT Targets Ukraine in Single-Day Spearphishing Operation
Princess
2025-10-15 ⋅ Palo Alto Networks Unit 42 ⋅ paloalto Networks: Unit42
PhantomVAI Loader Delivers a Range of Infostealers
Katz Stealer PhantomVAI
2025-10-13 ⋅ Proofpoint ⋅ Kyle Cucci, Proofpoint Threat Research Team, Selena Larson, Tommy Madjar
When the monster bytes: tracking TA585 and its arsenal
MonsterV2
2025-10-09 ⋅ Red Canary ⋅ Chris Brook, Tony Lambert
A taxonomy of Mac stealers: Distinguishing Atomic, Odyssey, and Poseidon
AMOS Odyssey Stealer Poseidon Stealer
2025-09-30 ⋅ Palo Alto Networks Unit 42 ⋅ Lior Rochberger
Phantom Taurus: A New Chinese Nexus APT and the Discovery of the NET-STAR Malware Suite
NET-STAR CL-STA-0043
2025-09-23 ⋅ ⋅ F6 ⋅ F6
Bearlyfy: the evolution of the new group of ransomware and its connection with PhantomCore
LockBit LockBit PhantomCore Bearlyfy
2025-09-19 ⋅ BlackPoint ⋅ Caden Toellner, Nevan Beal, Sam Decker
KeyZero: A Custom PowerShell RAT
2025-09-16 ⋅ Sekoia ⋅ Amaury G., Charles M., Sekoia TDR
APT28 Operation Phantom Net Voxel
BEARDSHELL GRUNT SLIMAGENT