Blog | ReversingLabs | Threat Research (2)

October 1, 2024

When hackers get hacked: Sam Curry on his career — and his latest research

In this latest ConversingLabs podcast, the independent security researcher shares insights into his intriguing journey — and his latest research.

September 10, 2024

Fake recruiter coding tests target devs with malicious Python packages

RL found the VMConnect campaign continuing with malicious actors posing as recruiters, using packages and the names of financial firms to lure developers.

July 11, 2024

Malicious NuGet campaign uses homoglyphs and IL weaving to fool devs

Malware authors upped their game, using homoglyphs to impersonate a protected NuGet prefix and IL weaving to inject malicious code, RL researchers found.

June 26, 2024

Malicious npm package targets AWS users

The package's history is a lesson in why tracking open source threats is such a challenge — and highlights the value of RL's new Spectra Assure Community.

June 5, 2024

Python downloader highlights noise problem in open source threat detection

RL discovered what appeared to be a malicious downloader on PyPI. It turned out to be red teaming — but highlights a growing problem for threat detection.

April 11, 2024

XZ Trojan highlights software supply chain risk posed by 'sock puppets'

There is no fool-proof method to identify phony developer accounts — but there are telltale signs. Threat researchers share three key indicators.

April 3, 2024

Malicious helpers: VS Code Extensions observed stealing sensitive information

Two newly discovered extensions on the VS Code Marketplace are designed to steal sensitive information, showing that open source attacks are expanding.

March 26, 2024

Suspicious NuGet package grabs data from industrial systems

Espionage has long been a driver for malicious cyber campaigns. Here's what the RL research team knows about the suspicious SqzrFramework480 campaign.

March 12, 2024

BIPClip: Malicious PyPI packages target crypto wallet recovery passwords

RL has discovered a campaign using malicious PyPI packages posing as open-source libraries to steal BIP39 mnemonic phrases used for crypto wallet recovery.

March 3, 2024

Level up your YARA game

Learn how to apply YARA rules for threat detection, searching, hunting and more.

February 20, 2024

Attackers leverage PyPI to sideload malicious DLLs

RL discovered two malicious PyPI packages and a larger subsequent campaign of packages — highlighting that DLL sideloading is an emerging method for software supply chain attacks.

January 23, 2024

GitGot: GitHub leveraged by cybercriminals to store stolen data

ReversingLabs researchers found two suspicious npm packages that demonstrate how GitHub is increasingly being used to easily deploy malware in novel ways.

Software Supply Chain Security

File Security

Security Operations

Products

Technology

Industry

Partners

Alliances

Resources

Company

Events

Press

Threat Research (2)

When hackers get hacked: Sam Curry on his career — and his latest research

Fake recruiter coding tests target devs with malicious Python packages

Malicious NuGet campaign uses homoglyphs and IL weaving to fool devs

Malicious npm package targets AWS users

Python downloader highlights noise problem in open source threat detection

XZ Trojan highlights software supply chain risk posed by 'sock puppets'

Malicious helpers: VS Code Extensions observed stealing sensitive information

Suspicious NuGet package grabs data from industrial systems

BIPClip: Malicious PyPI packages target crypto wallet recovery passwords

Level up your YARA game

Attackers leverage PyPI to sideload malicious DLLs

GitGot: GitHub leveraged by cybercriminals to store stolen data

Topics

Special Reports

The 2025 Software Supply Chain Security Report

Upcoming Webinars

ConversingLabs

Threat Research (2)

Topics

Follow us

Subscribe

Special Reports