TOPIC ARCHIVE

Reverse engineering

Selected Reverse engineering developments from public primary sources.

Unit 42 Threat Research2026-07-23T14:10:53Z

Russian Global Webmail Espionage

Unit 42 details a Russian cyberespionage campaign targeting Zimbra webmail servers using JavaScript injection to steal credentials. The post Russian Global Webmail Espionage appeared first on Unit 42 .

Unit 42 Threat Research2026-07-15T23:00:33Z

The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15)

Unit 42 analyzes npm supply chain evolution post-Shai Hulud. Discover wormable malware, CI/CD persistence, multi-stage attacks and more. The post The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15) appeared first on…

SentinelLabs2026-07-09T12:55:00Z

One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement

China and India ran separate espionage operations against the same Pakistani police force, each drawn by different stakes in Pakistan's internal security.

Unit 42 Threat Research2026-07-10T22:00:39Z

No Manners Here: The Ruthless Rise of The Gentlemen Ransomware

Unit 42 explores The Gentlemen ransomware operations, revealing the affiliate model driving its rapid growth. Learn more here. The post No Manners Here: The Ruthless Rise of The Gentlemen Ransomware appeared first on Unit 42 .

Unit 42 Threat Research2026-07-17T10:00:24Z

Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy

A technical analysis of three chained zero-day vulnerabilities in Siemens ROX II OT switches that allow privilege escalation and persistent root access. The post Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy appeared first…

Unit 42 Threat Research2026-07-07T22:00:21Z

Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation

A cybercrime campaign combined a loader-as-a-service framework and DLL sideloading via a Go-compiled fake MpClient.dll, a novel evasion layer combination. The post Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation a…

Unit 42 Threat Research2026-06-25T22:00:52Z

CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure

Government entities and critical infrastructure were targeted for espionage in SE Asia by attackers using a hybrid toolkit, including custom TinyRCT backdoor. The post CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastruc…