2023-02-18 Ember Bear (aka UAC-0056,Saint Bear, UNC2589, Lorec53, TA471, Nodaria, Nascent Ursa, LorecBear, Bleeding Bear, and DEV-0586) is...

2020-12-13 Fireeye  Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor ...

KPOT Stealer is a “stealer” malware that focuses on stealing account information and other data from various software applications and se...

2019-10-31 Calypso APT: new group attacking state institutions Attackers exploit Windows SMB vulnerability  CVE-2017-0143 or use stole...

2019-09-25 Juniper. Masad Stealer: Exfiltrating using Telegram  “Masad Clipper and Stealer” steals browser information, computer files,...

Amnesia / Radiation botnet samples  Remote Code Execution in CCTV DVR (kerneronsec.com - 2016) 2017-04-06 Palo Alto Unit 42. New I...

Malware Must Die:   MMD-0064-2019 - Linux/AirDropBot Mirai variant targeting  Linksys E-series - Remote Code Execution tmU...

Intezer  HiddenWasp Malware Stings Targeted Linux Systems   Download. Email me if you need the password (see in my profile)   Malware Inve...

Pokémon-themed Umbreon Linux Rootkit Hits x86, ARM Systems Research: Trend Micro There are two packages one is 'found in the wild&...

Here are a few samples related to the recent DDE Command execution DDE Macro-less Command Execution Vulnerability  Download. Email me if ...

This is the second part of Russian APT series. "APT29 - The Dukes Cozy Bear: APT29 is threat group that has been attributed to the R...

 We posted our take on the Trump's server story. If you have any feedback or corrections, send me an email (see my blog profile on Con...

 This post is for all of you, Russian malware lovers/haters. Analyze it all to your heart's content. Prove or disprove Russian h...

Research: SentinelOne, Tim Strazzere  Hiding in plain sight? Sample credit: Tim Strazzere List of files 9f7ead4a7e9412225be540c30e0...

Bitcoin mining malware for Linux servers - samples Research: Dr. Web. Linux.Lady Sample Credit:  Tim Strazzere MD5 list: 0DE8BCA75...

Research:  New OS X Ransomware KeRanger Infected Transmission BitTorrent Client Installer by Claud Xiao Sample credit: Claud Xiao Fi...

After 7 years of Contagio existence, Google Safe Browsing services notified Mediafire (hoster of Contagio and Contagiominidump files...

http://www.welivesecurity.com/2015/07/30/operation-potao-express/ http://www.welivesecurity.com/wp-content/uploads/2015/07/Operation-Pota...

Update May 12, 2015 Added  CVE-2015-0359 and updates for CVE-2015-0336   Exploit kit table 2014- 2015 (Sortable HTML table) ...

I get emails from readers asking for specific malware samples and thought I would make a mini post about it. Yes, I often obtain sam...

Update: Feb 19. 2015 We have been adding pcaps to the collection so remember to check out  the folder (  Pcap collection ) for the rece...

Just some links for your enjoyment List of security conferences in 2014 Video archives:

AlienSpy Java based cross platform RAT is another reincarnation of ever popular Unrecom/Adwind and Frutas RATs that have been circulating...

Research:  F-Secure: OnionDuke: APT Attacks Via the Tor Network Download Download. Email me if you need the passw...

PART II Wirelurker for Windows (WinLurker) Research:  Palo Alto Claud Xiao: Wirelurker for Windows Sample credit: Claud Xiao PAR...

Someone kindly shared their sample of the shellshock malware described by the Malware Must die group - you can read their analysis here...

Here are all samples (+ more) mentioned in this post by Fireeye : T he Little Signature That Could: The Curious Case of CZ Solution &qu...

'Tis the season. Here is a nice collection of ~100 Mac OS malware and Word document exploits carrying MacOS payload (all are CVE-...