Organization
8 Interestana reports mention Group-IB, newest first. Each is summarised from the original reporting and links back to its publisher.
The Gigabud banking trojan has evolved its evasion tactics by creating a secondary Android application that establishes a work profile on an infected device, subsequently installing a modified banking application within this isolated environment.
Cybersecurity researchers have uncovered new malware and expanded infrastructure linked to Nimbus Manticore, an Iranian state-sponsored hacking group identified as being affiliated with the Islamic Revolutionary Guard Corps (IRGC). Group-IB, in an analysis published on March 18, 2026, characterized Nimbus…
A novel Android malware strain, identified as Manic, has emerged, exhibiting a sophisticated method of data exfiltration that extends to offline devices. This threat operates by infecting nearby, potentially offline, Android phones and leveraging them to relay stolen data…
Security researchers at Group-IB have identified a novel Windows malware strain that weaponizes Microsoft 365 calendars, transforming them into covert command-and-control channels and data exfiltration tools. This sophisticated attack vector allows threat actors to remotely manage infected systems and steal…
A China-nexus cyber-espionage operation, identified by Group-IB as JadeProx, has been observed deploying a novel Windows loader named TriBack Loader. This previously undocumented malware was discovered on an exposed Alibaba Cloud server located in the Singapore region in mid-April 2026.
A novel espionage implant, identified as HollowGraph by cybersecurity firm Group-IB, has been discovered utilizing hijacked Microsoft 365 calendars to establish its command and control (C2) channel. This sophisticated malware embeds operator instructions and smuggles stolen files by attaching them…
Cybersecurity researchers have identified a new scam campaign, dubbed "Sniper Dz," that is targeting users in the Middle East and North Africa (MENA) region. The campaign utilizes a network of compromised Facebook accounts, which impersonate politicians, public figures, and well-known…
INTERPOL announced the disruption of the Sniper Dz phishing-as-a-service (PhaaS) platform last month, following a coordinated operation involving 13 countries in the Middle East and North Africa (MENA) region. The operation, codenamed Operation Ramz, which ran from October 2025…