Site Map · 126 pages
Research, Reports and Whitepapers
Brandefense analysts publish threat research reports, malware analyses, whitepapers and weekly security archives. This page lists all of them, plus the PDF versions of our threat actor reports. Each entry has a short summary, so you can see what a report covers before you open it.
Whitepapers 7
- CISO Decision Guide: Don’t Wait for the Next Vulnerability to Get a Name Free CISO guide: turn PHP2Shell and Node2Shell into a 90-day readiness program, with a regulatory map, four response clocks and eight editable tools.
- RDP (Remote Desktop Protocol) Attacks Explained What RDP attacks are, how attackers abuse the Remote Desktop Protocol, and the defenses CISA recommends. Get the Brandefense report on RDP attacks.
- Compromising Email Accounts with Credential Phishing Credential phishing whitepaper: how attackers steal email logins, how to spot the signs, and how firms can respond and protect their accounts and assets.
- How to Uproot Rootkit Threats? Learn what a rootkit is, how rootkits hide malware and what the report covers on detection, response and rootkit removal for security teams.
- Introduction to Black Hat SEO Explainer on Black Hat SEO tactics used by cybercriminals — poisoned search results, SEO spam, and how threat actors abuse search engines for malware
- How Cybercriminals Use Phishing Kits? Learn how cybercriminals use phishing kits, how these ready-made fake pages work, and which detection and mitigation steps help companies defend.
- Detection of Steganography Attacks About the Steganography Attack Detection report: technical details, working methods, detections, YARA rules and IoCs for steganography attacks.
Threat Research Reports 52
- Ransomware Trends Report | Q3 2026 Download the Brandefense Ransomware Trends Report Q3 2026: ransomware activity, top threat groups, industry trends, MITRE ATT&CK analysis, and Q4 predictions.
- Ransomware Trends Report | Q2 2026 Ransomware Trends Report Q2 2026: 2,509 confirmed incidents, 91 active groups, top targeted industries, MITRE ATT&CK techniques and Q3 predictions.
- Ransomware in U.S. Healthcare: Threat Landscape, Impact, and Mitigation Strategies What this report covers This report looks at ransomware against the U.S. healthcare sector, where attacks have caused large financial losses, service disruption and…
- Ransomware Trends Report | Q1 2026 Ransomware trends report for Q1 2026: threat actor activity, sector targeting, RaaS, double extortion and ESXi attacks, plus what to expect in Q2 2026.
- Fog Ransomware Technical Analysis Fog ransomware technical analysis report: how it is believed to gain access, how it disrupts systems, plus detections, IoCs and response advice.
- Securing Election Processes Against Cyber Threats Analysis of cyber threats targeting electoral processes — influence operations, voter data exposure, infrastructure attacks, and threat intelligence strategies
- Breaking the Angel’s Wing: Angel Drainer Angel Drainer steals digital assets with phishing pages and rents its panel to other criminals. See what this report covers: methods, detections and IoCs.
- Hunters International Ransomware Technical Analysis Technical analysis of Hunters International ransomware: a Rust-based RaaS sample that uses AES and RSA encryption, adds .locked and leaves a ransom note.
- Strela Stealer Technical Analysis Strela stealer is Windows malware that steals Outlook and Thunderbird logins. See what the technical report covers: methods, detections and IoCs.
- Grandoreiro Trojan Technical Analysis Grandoreiro is a Delphi banking trojan seen since 2016 and aimed at banking users in Latin America and Iberia. See what this technical report covers.
- BugSleep Backdoor Technical Analysis Technical analysis of the BugSleep backdoor attributed to MuddyWater: file transfer, reverse shell commands, scheduled task persistence and detections.
- Ransomware Trends Report | Q3 2025 Ransomware Trends Report Q3 2025: 1,422 incidents across 74 active groups and 20 industries, and how ransomware operations shifted in the quarter.
- United Kingdom Cybersecurity Threat Landscape & Strategic Insights What the 2025 report states about the United Kingdom cybersecurity threat landscape: ransomware, fraud, dark web activity and exploited flaws.
- Oyster Backdoor Technical Analysis Read how the Oyster backdoor infiltrates systems through fake Microsoft Teams installers, gathers system data and talks to command and control servers.
- Ireland Cybersecurity Threat Landscape Ireland cybersecurity threat landscape report: dark web activity, stolen financial data, exposed credentials and ransomware risks for Irish organisations.
- Romania Cybersecurity Threat Landscape & Strategic Insights The Romania cybersecurity threat landscape in 2024 and 2025: ransomware, phishing, leaked emails, deepfake fraud and DDoS. Download the full report.
- Xehook Stealer Technical Analysis Technical analysis of Xehook Stealer — credential theft capabilities, targeted data categories, MaaS distribution model, anti-analysis techniques, and IOCs for
- Ransomware Trends Report | Q2 2025 Ransomware Trends Report Q2 2025: the most active ransomware groups, double extortion tactics, and shifts in victim geography and sector targeting.
- Germany Threat Landscape Report Germany cybersecurity threat landscape: phishing, infostealer malware and dark web data sales aimed at German financial institutions and their customers.
- Azerbaijan Threat Landscape Report Azerbaijan cybersecurity threat landscape report: key incidents, state-backed groups, hacktivists and cybercriminals targeting government and key sectors.
- Mint Stealer Technical Analysis Mint Stealer analysis: how this MaaS malware steals browser and wallet data, evades detection and uses C2 servers, plus IOCs for security teams.
- Ransomware Trends Report | Q1 2025 Brandefense Ransomware Trends Report for Q1 2025: 38 active threat groups tracked across 22 industry sub-sectors, with the sectors and attacks hit hardest.
- BlackBasta Ransomware Technical Analysis Learn what Black Basta ransomware is, how it works and what our technical analysis report covers: tactics, detections, IoCs and response advice.
- UNC1549 MINIBUS Backdoor Technical Analysis Download the technical report on the UNC1549 MINIBUS backdoor: how it works, detections and IoCs for the suspected Iranian threat actor UNC1549.
- Ransomware Trends Report | Q4 2025 Ransomware Trends Report Q4 2025: Qilin led the quarter with 481 attacks, plus full-year 2025 shares by group, sector, country and region.
- Ransomware Trends Report | Q3 2024 What this report covers This edition covers the third quarter of 2024 and describes a fragmented landscape: smaller actors made up 44.1% of attacks,…
- Sandworm’s New Arsenal: Kapeka Backdoor Technical Analysis Kapeka backdoor explained: a C++ backdoor used in Eastern Europe since mid-2022 and linked by researchers to Sandworm. See what the report covers.
- Indonesia Cybersecurity Threat Landscape and Strategic Insights: Mid-Year 2024 Brandefense mid-year 2024 study of threats to Indonesian government, defense, finance, energy, telecom and aviation: dark web, ransomware, hacktivism.
- Technical Analysis of Cylance Ransomware Technical breakdown of Cylance ransomware — encryption behavior, targeted file types, ransom note characteristics, indicators of compromise, and YARA-based
- Ransomware Trends Report | Q2 2024 What this report covers This edition covers the second quarter of 2024. Its news section covers Europol's Operation Endgame, which shut down over 100…
- Invicta Stealer Technical Analysis Technical analysis of Invicta Stealer — credential harvesting methods, targeted applications, obfuscation techniques, C2 communication, and IOCs for SOC
- Private Loader as a RisePro Stealer Dropper Technical Analysis What this report covers PrivateLoader is a malware dropper sold through a Pay-Per-Install service. In that model a malware operator supplies a payload, the…
- Technical Analysis of Mystic Stealer Technical analysis of Mystic Stealer — MaaS delivery model, credential and crypto theft capabilities, anti-analysis mechanisms, C2 protocol, and detection IOCs
- Technical Analysis of Snatch Ransomware Technical analysis of Snatch ransomware — safe mode reboot exploitation, pre-encryption data exfiltration, RaaS mechanics, and detection indicators for
- Ransomware Trends Report | Q1 2024 What this report covers This edition covers the first quarter of 2024. The main news was Operation Cronos, in which international law enforcement dismantled…
- Godfather Android Banking Trojan Technical Analysis Godfather is an Android banking trojan that abuses accessibility services. See what the Brandefense technical report covers, from IoCs to mitigation.
- Technical Analysis of Stop/Djvu Ransomware What this report covers Stop/Djvu is a family of Windows ransomware that encrypts files, marks them with changing extensions and leaves a ransom note…
- Technical Analysis of Stealc Malware Technical analysis of the Stealc stealer: how it infects systems, what it steals, detections, IoCs and mitigation tactics for security teams.
- Ransomware Trends Report | Q4 2023 What this report covers This edition closes 2023. As in earlier quarters, the USA, Canada and the UK were the most targeted countries, with…
- In-depth Analysis of AvosLocker Ransomware Technical analysis of AvosLocker ransomware — safe mode exploitation, encryption routine, network propagation, RaaS structure, and incident response guidance
- Pandora Ransomware Technical Analysis Report Technical analysis of Pandora ransomware — encryption routines, initial access techniques, lateral movement, ransom negotiation behavior, and detection rules
- LockBit 3.0 Technical Analysis Report What this report covers LockBit 3.0, also called LockBit Black, follows LockBit 2.0 as a ransomware-as-a-service variant. This report explains what changed: a Zcash…
- Zebrocy Malware Technical Analysis Report Analysis of Zebrocy malware attributed to APT28 — multi-language variants, initial access techniques, data collection behavior, and geopolitical targeting
- Ransomware Trends Report | Q3 2023 Q3 2023 ransomware report: 963+ incidents in 68 countries, LockBit and Cl0p most active, business services hit hardest, and a July peak of 382 attacks.
- SandWorm APT Group Cyber Intelligence Report Intelligence report on the Sandworm APT group — threat actor profile, historical campaigns, toolset analysis, geopolitical targeting patterns, and defensive
- Insurance Sector Targeted Malware Analysis Report on insurance sector malware: technical details, detections and IoCs from the analysis of a sample aimed at employees of insurers in Turkey.
- Ransomware Trends Report | Q2 2023 What this report covers This edition covers the second quarter of 2023. Analysts identified ransomware incidents across 27 industry sub-sectors, with the USA, UK…
- DarkSide Ransomware Technical Analysis Open Report Technical analysis of DarkSide ransomware: how the RaaS group operates, its double extortion model, how it infects systems, plus detections and IoCs.
- HermeticWiper Malware Technical Analysis Open Report Analysis of HermeticWiper destructive malware — wiper functionality, MBR corruption technique, deployment method chain, and forensic indicators from
- PetitPotam Vulnerability Analysis Open Report Learn what the PetitPotam vulnerability is, how the NTLM relay attack works, how CVE-2021-36942 is rated and how to mitigate it on AD CS systems.
- Ransomware Trends Report | Q1 2023 What this report covers This edition covers the first quarter of 2023. The report finds that the Play group's attacks rose 147% compared with…
- Ransomware Trends Report | Q3 & Q4 2022 What this report covers This edition covers the second half of 2022. It reports that ransomware attacks rose in the fourth quarter compared with…
PDF Reports 67
Downloadable PDF versions of our threat actor reports and press releases. Each PDF is also linked from its article.
- Brandefense Press Room (PDF) PDF edition of this Brandefense report.
- WIRTE: Covert Espionage Actor Targeting the Middle East and Beyond (PDF) PDF edition of this Brandefense report.
- GC01 (Golden Chickens): Inside the Arsenal of a Premier E-Crime MaaS Provider (PDF) PDF edition of this Brandefense report.
- BlackTech (PDF) PDF edition of this Brandefense report.
- UAC-0194: Inside a Rapidly Evolving NTLM-Exploiting Espionage Operation (PDF) PDF edition of this Brandefense report.
- UAC-0102: Inside a Covert Espionage Operation Targeting Ukraine and Beyond (PDF) PDF edition of this Brandefense report.
- Inside the Operations of Crazy Evil: The Rise of a Global Crypto-Focused Cybercrime Network (PDF) PDF edition of this Brandefense report.
- Konni (Vedalia / TA406 / Opal Sleet): North Korea’s Steady Hand in Espionage Operations (PDF) PDF edition of this Brandefense report.
- Warlock Group: The Rise of GOLD SALEM (Storm-2603) in the Ransomware Landscape (PDF) PDF edition of this Brandefense report.
- DarkHotel (APT-C-06 / ATK52 / DUBNIUM): The Global Espionage Network Behind Elite Cyber Intrusions (PDF) PDF edition of this Brandefense report.
- Kasablanka: The Emerging North African Cyber Threat Actor (PDF) PDF edition of this Brandefense report.
- Turla APT: Russia’s Longstanding Cyber Espionage Powerhouse (PDF) PDF edition of this Brandefense report.
- APT19 (DEEP PANDA): A Persistent China-Aligned Espionage and Credential Theft Actor (PDF) PDF edition of this Brandefense report.
- HAFNIUM APT Group (Silk Typhoon): Exploiting the Global Attack Surface for Strategic Espionage (PDF) PDF edition of this Brandefense report.
- Tick APT Group (BRONZE BUTLER): A Long-Running East Asian Cyber Espionage Actor (PDF) PDF edition of this Brandefense report.
- FishMonger APT Group: A Persistent China-Aligned Cyber Espionage Actor (PDF) PDF edition of this Brandefense report.
- Dark Caracal APT Group (G0070): Mobile-Centric Espionage and Regional Surveillance (PDF) PDF edition of this Brandefense report.
- LIMINAL PANDA: China’s Emerging Espionage Threat in the Semiconductor and Technology Sectors (PDF) PDF edition of this Brandefense report.
- Winter Vivern (TAG-70 / UAC-0114 / TA473): A Persistent Eastern European Cyber-Espionage Threat Targeting NATO and EU Governments (PDF) PDF edition of this Brandefense report.
- APT-C-36: Latin America’s Persistent Cyber-Espionage Force (PDF) PDF edition of this Brandefense report.
- Inside the Operations of Inception Framework: A Decade of Stealth, Espionage, and Global Targeting (PDF) PDF edition of this Brandefense report.
- APT27 (PDF) PDF edition of this Brandefense report.
- APT3 (BORON): A Pioneering China-Aligned Cyber Espionage Group (PDF) PDF edition of this Brandefense report.
- FIN11 Threat Group Profile (PDF) PDF edition of this Brandefense report.
- APT35: Iran’s Persistent Cyber Espionage Force (PDF) PDF edition of this Brandefense report.
- APT15 (Ke3Chang / Nylon Typhoon): China-Aligned Cyber Espionage APT (PDF) PDF edition of this Brandefense report.
- TA577 (Hive0118): The Evolving Phishing Specialist Behind Modern Malware Campaigns (PDF) PDF edition of this Brandefense report.
- VanHelsing: Inside the Rise of a Multi‑Platform RaaS Threat Actor (PDF) PDF edition of this Brandefense report.
- WIZARD SPIDER: The Financial Empire Behind Global Ransomware Operations (PDF) PDF edition of this Brandefense report.
- APT40 (PDF) PDF edition of this Brandefense report.
- RomCom APT (PDF) PDF edition of this Brandefense report.
- Inside the Operations of Cactus: The Rise of a Stealth-Focused Ransomware Threat (PDF) PDF edition of this Brandefense report.
- PlushDaemon APT: An In-Depth Analysis of a Stealthy China-Aligned Cyber Espionage Group (PDF) PDF edition of this Brandefense report.
- Smishing Triad: A Global Cybercrime Syndicate Targeting Postal and Financial Networks (PDF) PDF edition of this Brandefense report.
- Silent Chollima: North Korea’s Dual-Track Cyber Weapon (PDF) PDF edition of this Brandefense report.
- OldGremlin: A Stealthy Russian-Speaking Ransomware and Espionage Threat Group Evolving Into a Precision Striking APT (PDF) PDF edition of this Brandefense report.
- OilRig: Iran’s Persistent Espionage Arm in Cyberspace (PDF) PDF edition of this Brandefense report.
- Callisto APT: Russia’s Persistent Espionage Operator (PDF) PDF edition of this Brandefense report.
- Crafty Camel APT: Iran’s Expanding Espionage Footprint in the Modern Cyber Battlespace (PDF) PDF edition of this Brandefense report.
- Angry Likho: Inside a Rapidly Growing Espionage Threat Targeting Eastern Europe (PDF) PDF edition of this Brandefense report.
- TraderTraitor: North Korea’s Crypto Heist Machine (PDF) PDF edition of this Brandefense report.
- Handala: The Rise of a Decentralized Pro-Palestinian Hacktivist Collective (PDF) PDF edition of this Brandefense report.
- Moonlight Tiger (APT-C-09, Patchwork, Dropping Elephant): India’s Silent Espionage Arm in the Digital Battlefield (PDF) PDF edition of this Brandefense report.
- Inside WageMole: North Korea’s Fusion of Cybercrime and Espionage (PDF) PDF edition of this Brandefense report.
- Inside Void Manticore: Iran’s Hybrid Hacktivist for Information Warfare (PDF) PDF edition of this Brandefense report.
- Sandworm (APT44): Russia’s Most Destructive Cyber Weapon (PDF) PDF edition of this Brandefense report.
- APT37: North Korea’s Active Cyberespionage Group (PDF) PDF edition of this Brandefense report.
- APT42: Iran’s Shadow Operative in Global Cyberspace (PDF) PDF edition of this Brandefense report.
- MuddyWater: Iran-Linked Espionage Group Expanding Global Reach (PDF) PDF edition of this Brandefense report.
- APT41: China’s Dual-Purpose Cyber Powerhouse (PDF) PDF edition of this Brandefense report.
- Operation C-Major (APT36): A Persistent Pakistan-Linked Cyber Espionage Threat (PDF) PDF edition of this Brandefense report.
- APT28: Russia’s Persistent Cyber Espionage Arm (PDF) PDF edition of this Brandefense report.
- Scattered Spider: An Emerging Cybercriminal Collective (PDF) PDF edition of this Brandefense report.
- APT33 (Elfin / Refined Kitten): Iran’s Longstanding Cyber-Espionage Arm (PDF) PDF edition of this Brandefense report.
- Hazy Tiger: An Emerging Espionage Threat in South Asia (PDF) PDF edition of this Brandefense report.
- RAZOR TIGER: The Persistent South Asian Espionage Threat (PDF) PDF edition of this Brandefense report.
- UNC4841 / SLIME57: China-Linked Espionage Threat Expanding Global Operations (PDF) PDF edition of this Brandefense report.
- Ghostwriter: Hybrid Influence and Espionage Operations in Eastern Europe (PDF) PDF edition of this Brandefense report.
- GhostEmperor: Advanced China-Linked Espionage Campaigns (PDF) PDF edition of this Brandefense report.
- Earth Estries – Threat Actor Sheet (PDF) PDF edition of this Brandefense report.
- The Lazarus Group: Espionage, Sabotage, and Cybercrime Under One Umbrella (PDF) PDF edition of this Brandefense report.
- Larva208: A Hybrid Threat Actor to Watch (PDF) PDF edition of this Brandefense report.
- Silent Lynx: Up-and-Coming Espionage Threat From Central Asia (PDF) PDF edition of this Brandefense report.
- SilverFox APT: Profile, TTPs and Defense (PDF) PDF edition of this Brandefense report.
- Gamaredon Group: A Persistent Russian Espionage Threat (PDF) PDF edition of this Brandefense report.
- Mustang Panda: Persistent Threat of a China aligned Espionage Group (PDF) PDF edition of this Brandefense report.
- DragonForce Ransomware: From Hacktivism to High-Street Extortion (PDF) PDF edition of this Brandefense report.
Browse by Category 7
The category pages below collect related articles, newest first.
- Threat Intelligence Researches Brandefense threat intelligence research on threat actors, malware, vulnerabilities and campaigns, with analysis to set defense priorities.
- Whitepapers Brandefense whitepapers: in-depth papers on cyber threat intelligence, digital risk protection and external attack surface management for security leaders.
- Reports Brandefense research reports: ransomware trends, malware analysis and country threat landscapes, built from our cyber threat intelligence work.
- Reports: Country Reports Country threat landscape reports from Brandefense: the main cyber threats, active actors and sector risks affecting organizations in each country.
- Reports: Ransomware Trends Reports Brandefense ransomware trends reports: active groups, victim patterns, leak-site activity and shifts in tactics, with what to prioritize next.
- Reports: Malware Analysis Reports Technical malware analysis reports from Brandefense: how each sample works, its infrastructure and indicators of compromise, how to detect it.
- E-Book Free Brandefense e-books on cyber threat intelligence, digital risk protection and attack surface management. Download practical guides for security teams.