Report an incident

Get 24/7 incident response assistance from our global team

All resources by Group-IB

Explore the world of
cybersecurity in one place

Our Resource Center brings together expert reports, real-world success stories, engaging webinars, insightful podcasts, hands-on videos, and up-to-date blog content to help you stay informed, empowered, and ready to tackle today’s digital threats

Reports
Success Stories
Webinars
Podcasts
Videos
Blogs
Investigations
Ransom Notes
Threat Actors
Reports
Success Stories
Webinars
Podcasts
Videos
Blogs
Investigations
Ransom Notes
Threat Actors
Browse Group-IB Resources

Enter your query in the search bar

From detonation to detection
Blog
From Detonation to Detection: The Sandbox Now Writes the Rules
Understanding what a malware sample does and being able to detect it are two different jobs, and the second one...
Go to
Beyond Compliance: Cyber and Operational Resilience Framework (CORF) Readiness For Kuwaiti Banks
Report
Beyond Compliance: Cyber and Operational Resilience Framework (CORF) Readiness For Kuwaiti Banks
The Central Bank of Kuwait's Cyber and Operational Resilience Framework (CORF v1.0) is a complete architectural replacement for the 2020...
Go to
Paid in Full: How card fraudsters in the GCC use government payment portals to cash out stolen cards
Report
Paid in Full: How card fraudsters in the GCC use government payment portals to cash out stolen cards
Go to
Blog
Anatomía de BraZetsu: Cómo los cibercriminales abastecen el ecosistema clandestino
Group-IB descubre BraZetsu, un nuevo malware para Windows basado en Python que funciona como un toolkit maestro para Initial Access...
Go to
Blog
Milk Dragon: Huge Discounts on Social Media? Think Twice Before You Buy
Milk Dragon, also known as NaiLong is an Adversary-in-the-Middle (AiTM) phishing kit active since October 2025. Unlike conventional phishing tactics...
Go to
S2_ Episode 07
Podcast
MuddyWater: Expanding an Espionage Operation
Successful espionage usually relies on patience. Nation-state actors quietly infiltrate targets, maintain access for years, and gather intelligence without attracting...
Go to
One Adversary, One Workflow
Report
One Adversary, One Workflow
Cyber-Fraud Fusion: a practical framework for unifying cybersecurity and anti-fraud defence. The evidence, the economics, and the maturity path.
Go to
motive-over-method podcast
Podcast
Motive Over Method: What Really Drives a Cyberattack?
In the first episode of Masked Actors: BelArabi_بالعربي , Mohammad Gamal and Mansour Alhmoud explore the motivations behind today’s cyber...
Go to
Blog
No One Gets Phished: The New Group-IB Browser Agent Applies Predictive Intelligence At The Click
One employee reaches a phishing page. The tab closes, the domain is blocked for every browser in the company, and...
Go to
Blog
RemControl: AI Built the Overlays. Victims Lose their PINs
Group-IB uncovers RemControl, a new Android banking trojan targeting European, Middle Eastern and Canadian banks, whose criminal infrastructure was unknowingly...
Go to
Blog
HEAVYGRAM: A Telegram-based Surveillance Backdoor Linked to Handala Hack
Group-IB Threat Intelligence analyzes HEAVYGRAM, a Telegram-based Windows backdoor attributed with moderate confidence to the Iran-linked threat actor Handala Hack....
Go to
Top fraud prevention platform
Blog
Top 5 Fraud Prevention Platforms for Banks and Fintechs in 2026
Most fraud platforms only see a threat once it becomes a transaction. This guide compares the top 5 fraud prevention...
Go to
A Two-View Framework for Fraud Exposure
Report
A Two-View Framework for Fraud Exposure
A Two-View Framework for Fraud Exposure puts reported losses next to detected fraud activity across the banks studied, over the...
Go to
Blog
The Adversary We Are Fighting Is Now a Full-Force Industry: Inside cybercrime’s new economy
Attacks now are cheap, fast, and outsourced. The recent research shows what it changes and how organizations should strategy defense.
Go to
Blog
Smish. Click. Drained: Inside the Smishing Triad’s Phishing Cockpit
A deep technical analysis of the Smishing Triad’s JWR phishing kit and Outsider operator cluster, revealing its real-time victim control,...
Go to
Podcast S2 E6
Podcast
Defenders: Two Front Lines – Fraud From the Case File and the Comments Section
Most people experience fraud as a single event. A suspicious text message, a fake investment opportunity, or a phone call...
Go to
AUNZ Threat Landscape Report, August 2026
Report
AUNZ Threat Landscape Report, August 2026
Go to
Turn tabletop exercises into a service that scales
Webinar
Turn tabletop exercises into a service that scales
Introducing the Group-IB Cyber Readiness Platform - a new product that turns tabletop exercises into a scalable, repeatable, high-margin practice...
Go to
Intelligence Insights Report, August 2026
Report
Intelligence Insights Report, August 2026
Explore the most notable cybersecurity events in the region and the best practices
Go to
Blog
Vwork: Weaponized Open-source Software as an Addon for Gigabud
How the Gigabud Android banking trojan abuses Shelter, an open-source app cloner, and what that means for banks, users, and...
Go to
APAC Threat Landscape Report, August 2026
Report
APAC Threat Landscape Report, August 2026
Go to
Ransomware
Blog
Ransomware in 2026: What the Data Demands From You
Group-IB's 2026 data shows ransomware accelerating across APAC. See where response plans fail, and the 5-pillar framework built to hold...
Go to
Blog
One Adversary: The 90-Day Fusion Playbook
Fusion is a capability you mature into, not a team you hire. Here is the honest maturity path, the metrics...
Go to
Blog
The Outsider Phishing Kit: A Resilient Threat in the Face of Law Enforcement Action
This blog provides a deep-dive into the phishing kit created by Chenlun known as the Outsider Phishing Kit. It is...
Go to
Blog
Anatomy of BraZetsu: How Cybercriminals Fuel the Underground Ecosystem
Group-IB uncovers BraZetsu, a new Python-based Windows malware that serves as a master toolkit for Initial Access Brokers and powers...
Go to
Blog
One Adversary, Two Outcomes: The 0.027% Proof
One malware campaign, 11,000 compromised devices, two banks with very different outcomes. At the bank with fused defence, fraud succeeded...
Go to
S2_ Episode 04
Podcast
GoldFactory: Rethinking Digital Identity in the Age of Biometric Theft
For years, stronger authentication was seen as the answer to online fraud. As passwords became easier to steal, organisations turned...
Go to
Blog
Tortoiseshell: New Toolset and Operational Infrastructure Exposed
Group-IB Threat Intelligence performed enrichment and APT hunting based on recent public data about the Tortoiseshell APT group, leading to...
Go to
Blog
Balonx Sistema: El Rostro Detrás del PhaaS que Impacta la Banca Mexicana
Group-IB expone una operación mexicana de PhaaS dirigida a más de 20 instituciones financieras, con capacidades de phishing en tiempo...
Go to
CISD 2026: Ghana’s Financial Institutions Face A Wider, Tiered Compliance Bar
Report
CISD 2026: Ghana’s Financial Institutions Face A Wider, Tiered Compliance Bar
Bank of Ghana's Cyber and Information Security Directive was issued in March 2026. Learn what changed, where the compliance work...
Go to
Blog
One Adversary: Fraud Is a Network, Not a Payment
Payment was authorised. The transaction was, technically, legitimate. It was also part of a $187 million criminal network, and the...
Go to
Blog
Balonx Sistema: The Face Behind the PhaaS Affecting Mexican Banking
Group-IB exposes a Mexican PhaaS operation targeting over 20 financial institutions with live phishing, AI vishing, and mobile RAT capabilities.
Go to
GROUP-IB x KICB
Success Story
GROUP-IB x KICB
Как ведущий банк Кыргызстана усилил защиту клиентов от онлайн-мошенничества
Go to
Blog
One Adversary: The Fifteen-Minute Problem
More than a quarter of stolen funds are gone within fifteen minutes of the fraudulent transfer. That number ends the...
Go to
thumbnail
Blog
Gone with the WindRelay: A New Malware Combo Behind a Growing Fraud Scheme
A new NFC relay malware designated as WindRelay, paired with SpyNote RAT enables live-call fraud, combining social engineering with dual...
Go to
Mobile Malware Remote Fraud Threats
Webinar
Mobile Malware Remote Fraud Threats
Join our expert-led live webinar to learn how these threats work and get actionable steps to bulletproof your mobile device...
Go to
GROUP-IB x KICB
Success Story
GROUP-IB x KICB
How KICB strengthens customer protection against online fraud
Go to
ANZ Threat Landscape Report, July 2026
Report
ANZ Threat Landscape Report, July 2026
44 threat reports across Australia and New Zealand. A worm-like npm supply-chain attack with a 2-billion-download blast radius. The Origin...
Go to
Intelligence Insights Report — July 2026
Report
Intelligence Insights Report — July 2026
Explore the most notable cybersecurity events in the region and the best practices
Go to
Blog
Building Scalable Bridges Between Systems Using The Latest Release of Our Ciaops Library
ciaops is Group-IB's open-source Python library for integrating Threat Intelligence, Digital Risk Protection, and Attack Surface Management APIs. Zero event...
Go to
Blog
One Adversary: The Moment Nobody Sees
Map any fraud campaign against your org chart and one stage of the attack has no owner. The adversary knows...
Go to
Before Fraud Transacts: Prevention Before the Transaction
Report
Before Fraud Transacts: Prevention Before the Transaction
Fraud is now a campaign that starts weeks before the payment. See how Cyber Fraud Fusion converges fraud, cyber, and...
Go to
Blog
MSSPs: Your SOC Already Detects Fraud. Missed Opportunity Is Selling It As a Service.
Managed cyber-fraud protection is the most overlooked growth line in the MSSP playbook, and most of the capability is already...
Go to
Blog
XMRig Covert Ops: The Cryptomining Campaign That Abuses Trusted Access and Deploys Forensic Smokescreens
Dive into a covert Linux XMRig campaign exploiting trusted access, weaponizing PAM to create forensic smokescreens, and deploying self-unlinking payloads.
Go to
Intelligence Insights Report, Q2 2026
Report
Intelligence Insights Report, Q2 2026
Explore the most notable cybersecurity events in the region and the best practices
Go to
Blog
No Room For Compromise: How Business Email Protection Predicts BEC Before It Starts
Most business email compromise (BEC) attacks start with stolen credentials, not a malicious email. Group-IB uses threat intelligence to detect...
Go to
APAC Intelligence Insights Report, April 2026
Report
APAC Intelligence Insights Report, April 2026
Compromised accounts surged 143% in a single month. Ransomware fell, but hit Australia harder than anywhere in the region. Group-IB's...
Go to
APAC Intelligence Insights Report, May 2026
Report
APAC Intelligence Insights Report, May 2026
Every major threat category climbed in May 2026. DDoS activity nearly doubled, compromised accounts topped 6.7 million, and Australia was...
Go to
Blog
Ransomware in 2026: Same Business, New Rules
The ransomware economy has been rewired. Meet the eight ransomware groups driving the shift, from affiliate breakaways to AI-assisted attacks...
Go to
Staying Ahead of the Adversary
Webinar
Staying Ahead of the Adversary
A live deep dive into Group-IB's ANZ Quarterly Threat Evolution Report. See the actors, tactics, and fraud trends shaping risk...
Go to
Blog
JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake
An open directory and a SEA of victims reaching as far as LATAM all lead to TriBack Loader.
Go to
Blog
Risks, Vulnerabilities And Response: Threat Intelligence is Quietly Becoming The Connected Layer in Security
Cyberthreat Intelligence is not a feed bolted on the side, it is the operational impetus behind strengthened security. And that...
Go to
KuppingerCole Buyer’s Compass — FRIP Finance 2026
Report
KuppingerCole Buyer’s Compass — FRIP Finance 2026
Your independent guide to evaluating fraud prevention platforms — featuring Group-IB Fraud Protection
Go to
S2_ Episode 04_938 × 520_site
Podcast
TX-NFC: Ghost Tap — Can Your Bank Catch Fraud From a Card That Never Left Your Pocket?
Contactless payments have become such a routine part of everyday life that we rarely think twice about how they are...
Go to
Blog
HOLLOWGRAPH: Turning Microsoft 365 Calendars into Covert Command-and-Control Channels
Group-IB uncovers HOLLOWGRAPH, a Windows malware that abuses Microsoft Graph API to exfiltrate files and receive commands from the attacker...
Go to
AUNZ Intelligence Insights Report, Q2 2026
Report
AUNZ Intelligence Insights Report, Q2 2026
92 active ransomware groups. Billions of credential attempts against edge devices. A new wave of mobile banking trojans built to...
Go to
Closing the CBN Gap: Nigerian Banks Clear Path To Meet The Mandate
Report
Closing the CBN Gap: Nigerian Banks Clear Path To Meet The Mandate
The July 2026 CBN deadline is rapidly approaching. Learn how Nigerian financial institutions can align with new cybersecurity and instant...
Go to
Inbox Intelligence: Five Email Threats Bypassing Company Email Security
Report
Inbox Intelligence: Five Email Threats Bypassing Company Email Security
Discover the five email threats defining 2026 and learn how a multi-signal detection model stops what authentication alone cannot.
Go to
Blog
ClickLock Stealer: Paste Once, Lose Everything
Analyzing a new threat targeting macOS users in Europe, North America and MEA
Go to
Blog
The Scam Will Go On: Beware of Fake Offers for Celine Dion Concert Tickets
Group-IB discovers a sophisticated multi-layered scam scheme targeting fans with fake ticket sales on two fronts: social network platforms and...
Go to
Blog
Inside the Matching Engine: How Distributed Tokenization Identifies Compromised Cards Without Exposing Them
Discover how Distributed Tokenization identifies compromised cards at pre-authorization without exposing raw card data — a technical deep-dive for fraud...
Go to
Anastasia Tikhonova
Podcast
Defenders: The Life of a Threat Researcher
Threat researchers work deep in the digital underground, mapping adversaries, exposing tactics, and turning fragments of intelligence into protection that...
Go to
Digital threats to Turkey’s financial sector
Report
Digital threats to Turkey’s financial sector
Phishing, fake loan ads, unlicensed gambling, and money mule networks are exploiting Turkish financial brands at industrial scale. Read the...
Go to
LATAM Intelligence Insights Report, Q2 2026 (Portuguese)
Report
LATAM Intelligence Insights Report, Q2 2026 (Portuguese)
Mantenha-se à frente sobre o cenário de ameaças cibernéticas e descubra como os cibercriminosos estão aprimorando suas táticas na América...
Go to
LATAM Intelligence Insights Report, Q2 2026
Report
LATAM Intelligence Insights Report, Q2 2026
Actionable threat intelligence on the most significant cyber threats shaping the Latin America region — curated by Group-IB's Threat Intelligence...
Go to
LATAM Intelligence Insights Report, Q2 2026 (English)
Report
LATAM Intelligence Insights Report, Q2 2026 (English)
Stay ahead of the evolving cyber threat landscape and discover how cybercriminals are adapting their tactics across Latin America.
Go to
LATAM Intelligence Insights Report, Q2 2026 (Spanish)
Report
LATAM Intelligence Insights Report, Q2 2026 (Spanish)
Manténgase a la vanguardia frente al cambiante panorama de amenazas cibernéticas y descubra cómo los ciberdelincuentes están evolucionando sus tácticas...
Go to
Blog
RedHook Returns with a Dangerous Upgrade
Group-IB analysts examine this resurfaced Android Remote Access Trojan, demonstrating new, sophisticated and malicious functionalities including autonomous privilege abuse, expanded...
Go to
Blog
Connecting Scattered Spider: Defining A Cybercrime Collective Through Shared TTPs
This blog covers Group-IB’s overview of Scattered Spider, backed by Group-IB’s proprietary intelligence, providing additional information to what has already...
Go to
Proactive Fraud Prevention for EU Finance in the Age of AI
Report
Proactive Fraud Prevention for EU Finance in the Age of AI
Proactive fraud prevention is not an aspiration but the norm for EU financial institutions in a hyper-evolving threat landscape. This...
Go to
Inside Prevyn AI: the cognitive core in action across the Unified Risk Platform
Webinar
Inside Prevyn AI: the cognitive core in action across the Unified Risk Platform
Most AI in security helps analysts type faster. Prevyn AI does the work.
Go to
Blog
Phishing in the Balkans: Fake Traffic Fines, Real Losses
This blog documents Group-IB’s research into an SMS phishing campaign targeting Serbian road users through the impersonation of Serbia's state...
Go to
Podcast
Scattered Spider: Could One Phone Call Bring Down Your Whole Organization?
Can you recognise every employee in your organisation? Most companies cannot — and attackers know it. A routine IT request...
Go to
Blog
Millenium: A RAT Rewritten, A Threat Multiplied
Group-IB analyzes Millenium RAT version 4.*, a remote access trojan that has undergone an architectural shift from .NET to native...
Go to
Podcast
Defenders: What Does It Take To Orchestrate International Takedowns Across Borders?
Cybercrime operates at a scale most people never see. A single incident can cost hundreds of millions of pounds, disrupt...
Go to
Blog
Brace Before The Impact: 7 Signals Your Organization Needs A Cybersecurity Services Retainer
Incident response plans aren't enough if the response can't activate when it matters. Discover seven signs your organization may need...
Go to
Cybersecurity Priorities for E-Commerce
Blog
10 Cybersecurity Priorities for E-Commerce Teams This Year
E-commerce is the second most targeted sector for cyberattacks in 2026. Get the 10 priorities every security team must act...
Go to
Blog
8 Questions to Ask Before Choosing an Incident Response Retainer
Before you sign an incident response retainer, ask about SLA definitions, scope, hidden costs, threat profile fit, and post-incident support....
Go to
Tycoon 2FA
Threat Actor
Tycoon 2FA
Go to
Teste PHP
Threat Actor
Teste PHP
Go to
ShadowSilk
Threat Actor
ShadowSilk
Go to
scattered spider
Threat Actor
Scattered Spider
Go to
DarkBlinders
Threat Actor
DarkBlinders
Go to
Bloody Wolf
Threat Actor
Bloody Wolf
Go to
TX-NFC
Threat Actor
TX-NFC
Go to
Blog
GitBait: Phishing dirigido al sector financiero mexicano
Se ha descubierto una infraestructura de phishing modular dirigida a múltiples bancos mexicanos, que abusa de GitHub Pages, emplea scripts...
Go to
Blog
GitBait: Phishing the Mexican Financial Sector
A modular phishing infrastructure targeting multiple Mexican banks has been uncovered, abusing GitHub-hosted Pages, employing obfuscated scripts, and featuring a...
Go to
Intelligence Insights Report, May 2026
Report
Intelligence Insights Report, May 2026
Explore the most notable cybersecurity events in the region and the best practices
Go to
ANZ Threat Landscape — May 2026
Report
ANZ Threat Landscape — May 2026
Actionable threat intelligence and sharp insights into the threats, attack trends and adversaries shaping the Australia & New Zealand cybersecurity...
Go to
Blog
Sniper’s Nest: From Brand Impersonation to Browser Hijacking and CPA Fraud
This blog provides a deep-dive into SniperDz, a centralised PhaaS platform with more than 80 ready-made phishing templates impersonating over...
Go to
Dismantling SniperDz
Investigation
Dismantling SniperDz
Group-IB's investigation into fake political accounts uncovered a decade-long phishing-as-a-service (PhaaS) platform. Intelligence shared with INTERPOL and the Algerian National...
Go to
Blog
SilabRAT, What’s Your Power?
SilabRAT (aka SnappyClient) is an advanced Remote Access Trojan (RAT) sold as a Malware-as-a-Service (MaaS) on Darkweb forums. Developed by...
Go to
Saudi Arabia’s cybersecurity compliance landscape is one of the most advanced in the world. Is it an obligation or an opportunity for your organization?
Report
Saudi Arabia’s cybersecurity compliance landscape is one of the most advanced in the world. Is it an obligation or an opportunity for your organization?
18 regulatory frameworks. Four critical industries. One research guide that maps every requirement to the controls and capabilities to help...
Go to
Blog
Error 524 Decoy: Desenmascarando una Operación Global de Smishing Oculta Tras Páginas de Error
Los investigadores de Group-IB exponen una operación de smishing y phishing a gran escala que suplanta más de 260 marcas...
Go to
Blog
Error 524 Decoy: Unmasking a Global Smishing Operation Hiding Behind Error Pages
Group-IB researchers expose a large-scale smishing and phishing operation impersonating 260+ brands across 72 countries, using fake Cloudflare error pages,...
Go to
Intelligence Insights Report, April 2026
Report
Intelligence Insights Report, April 2026
Explore the most notable cybersecurity events in the region and the best practices
Go to
AUNZ Intelligence Insights Report, April 2026
Report
AUNZ Intelligence Insights Report, April 2026
This summary provides an overview of the cybersecurity landscape in the Asia-Pacific (APAC) region for April 2026, based on intelligence...
Go to
Cryptocurrency Scams
Blog
Cryptocurrency Scams: The 10 Most Common Types and How They Work
Learn the most common crypto scam types and how they work in practice. Understand how financial institutions can detect fraud...
Go to
Blog
The $48 Billion Blind Spot: Why Merchants Pay for Card Breaches They Can’t See
Merchants face $53B in card fraud losses but lack access to compromised card data. Discover the three barriers keeping merchants...
Go to
Blog
The GHOST STADIUM Score: Billions At Stake At The World’s Largest Football Tournament
With the 2026 FIFA World Cup just weeks away, Group-IB researchers have uncovered six distinct fraud schemes, four independent threat...
Go to
Blog
Online Payment Fraud Prevention: Best Practices for Organizations
Learn what payment fraud is, how it unfolds, and the practical controls that organizations can use at every step of...
Go to
Blog
Volume Obfuscation Game: The Lead Data Brokers Out To Waste Your Time
An increasing number of data brokers active in Chinese-speaking dark web forums and Telegram channels are advertising large volumes of...
Go to
Blog
Is Fraud Distorting Your iGaming Growth Numbers?
A candid conversation on fraud disguised as iGaming growth with Sarah Psaila, Head of Gaming at Group-IB.
Go to
Blog
Introducing Group-IB Prevyn AI
How Group-IB is building a cognitive core that anticipates threats before they happen
Go to
What Is an Incident Response Retainer? (And Why Waiting Until a Breach Is Too Late)
Blog
What Is an Incident Response Retainer? (And Why Waiting Until a Breach Is Too Late)
An incident response retainer gives organizations immediate access to cybersecurity experts when a breach occurs, without losing critical time to...
Go to
Blog
Digital Brand Protection in Cybersecurity: Why It Matters in 2026
Digital brand protection helps organizations detect and disrupt external threats, such as phishing sites, fake social profiles, counterfeit listings, and...
Go to
Fake Investments, Real Consequences: Uncovering Investment Scams Targeting USA and Australia
Report
Fake Investments, Real Consequences: Uncovering Investment Scams Targeting USA and Australia
Go to
Inside the Fake Investment Platform Economy
Report
Inside the Fake Investment Platform Economy
Group-IB uncovers a sprawling fraudulent scheme that lures its victims in the US and Australia into making investments.
Go to
Blog
The French 2-Step: Exposing a Multi-stage Scam Targeting the National Railway Company in France
This highly targeted scam scheme uses advanced phishing and social engineering cues, rely on brand recognition, event-based campaigns and emotional...
Go to
Blog
Group-IB Digital Risk Protection Integrates with Google SecOps: Brand Threat Intelligence, Now In Your SOC
Go to
Gartner® Magic Quadrant™ 2026 — Cyberthreat Intelligence Technologies
Report
Gartner® Magic Quadrant™ 2026 — Cyberthreat Intelligence Technologies
Group-IB Named a Leader in the 2026 Gartner® Magic Quadrant™ for Cyberthreat Intelligence Technologies
Go to
Blog
The Architecture of Deception: How a $187 Million Fraud Ecosystem Exploits Trust Across Australia and the United States
This blog examines how threat actors use deepfake impersonation and social media to manipulate real stocks, how a network of...
Go to
Social Media Pump-and-Dump Investment Scam
Report
Social Media Pump-and-Dump Investment Scam
Group-IB uncovers a sprawling fraudulent scheme that lures its victims in the US and Australia into making investments.
Go to
TeamTNT
Podcast
Team TNT: Could You Be Unknowingly Mining for Crypto?
Cryptocurrency promised huge potential for investors. But it’s cybercriminals who are reaping the benefits. From multimillion-dollar ransomware payouts to borderless...
Go to
Blog
Phoenix Rising: Exposing the PhaaS Kit Behind Global Mass Phishing Campaigns
While analyzing global smishing operations spanning APAC, LATAM, Europe, and MEA, Group-IB researchers uncovered the 'Phoenix System' administrative panel, a...
Go to
Kuwait’s Fraud Risk Reality Has a Regulatory Answer. Does Your Bank Have a Plan?
Report
Kuwait’s Fraud Risk Reality Has a Regulatory Answer. Does Your Bank Have a Plan?
Central Bank of Kuwait's Cyber and Operational Resilience Framework (CORF) is live. This guide breaks down exactly what Kuwaiti banks...
Go to
AUNZ Intelligence Insights Report, January 2026
Report
AUNZ Intelligence Insights Report, January 2026
Monthly actionable threat intelligence and sharp insights into ransomware, hacktivisim, infostealers and financial fraud curated by Group-IB’s Threat Intelligence team...
Go to
APAC Intelligence Insights Report, January 2026
Report
APAC Intelligence Insights Report, January 2026
Monthly intelligence on ransomware, hacktivism, infostealers, and financial fraud across the Asia-Pacific region — curated by Group-IB’s Threat Intelligence team.
Go to
AUNZ Intelligence Insights Report, March 2026
Report
AUNZ Intelligence Insights Report, March 2026
Insights Monthly actionable threat intelligence and sharp insights into ransomware, hacktivism, infostealers and financial fraud curated by Group-IB's Threat Intelligence...
Go to
APAC Intelligence Insights Report, February 2026
Report
APAC Intelligence Insights Report, February 2026
Monthly intelligence on ransomware, hacktivisim, infostealers and financial fraud curated by Group-IB’s Threat Intelligence team from across the Asia-Pacific region.
Go to
Inside Europe’s Manufacturing Cyber Threat Landscape
Report
Inside Europe’s Manufacturing Cyber Threat Landscape
Why the biggest risks to industrial operations begin outside the factory
Go to
AUNZ Intelligence Insights Report, February 2026
Report
AUNZ Intelligence Insights Report, February 2026
Monthly actionable threat intelligence and sharp insights into ransomware, hacktivisim, infostealers and financial fraud curated by Group-IB’s Threat Intelligence team...
Go to
Group-IB Named an Overall Leader in Fraud Reduction Intelligence Platforms for eCommerce
Report
Group-IB Named an Overall Leader in Fraud Reduction Intelligence Platforms for eCommerce
KuppingerCole Analysts AG recognises Group-IB as an Overall Leader, Product Leader, and Innovation Leader in the 2025 Leadership Compass for...
Go to
Intelligence Insights Report, March 2026
Report
Intelligence Insights Report, March 2026
Explore the most notable cybersecurity events in the region and the best practices
Go to
Intelligence Insights Report, February 2026
Report
Intelligence Insights Report, February 2026
Explore the most notable cybersecurity events in the region and the best practices
Go to
APAC Intelligence Insights Report, March 2026
Report
APAC Intelligence Insights Report, March 2026
Monthly intelligence on ransomware, hacktivisim, infostealers and financial fraud curated by Group-IB’s Threat Intelligence team from across the Asia-Pacific region.
Go to
Blog
Anatomy of a Fraud Operation: Mule Account Creation on B2B Fintech Platforms in France
How corporate/retail accounts are exploited for financial fraud through sophisticated device fingerprinting and mule networks.
Go to
Intelligence Insights Report, January 2026
Report
Intelligence Insights Report, January 2026
Explore the most notable cybersecurity events in the region and the best practices
Go to
APAC Intelligence Insights, December 2025
Report
APAC Intelligence Insights, December 2025
Navigate the year-end surge in cyber aggression with actionable threat intelligence on the adversaries, attack vectors, and AI-driven tactics shaping...
Go to
Blog
W3LL Unmasked: Inside the Takedown of a Global BEC Phishing-as-a-Service Ecosystem
The takedown of a global phishing-as-a-service ecosystem
Go to
Blog
Seven Signals Cyber Experts Agreed on at FIRST Paris 2026
Group-IB hosted the FIRST Technical Colloquium in Paris, where cybersecurity experts challenged assumptions around modern cyber defense. FIRST Chair Olivier...
Go to
Blog
Are Risks Revealed in Actions or Activity? Understanding Behavioral Analytics in Cybersecurity
Attackers count on static defenses. Switch to advanced behavioral analytics to spot abnormal behavior while its still unfolding and protect...
Go to
Blog
Cyber Saga: In the Footsteps of the DPRK IT Workers
Discover how North Korean threat actors use synthetic identities, AI-assisted workflows, and overlapping infrastructure to infiltrate companies, and learn actionable...
Go to
Violazione singola, attacchi supply chain multipli
Webinar
Violazione singola, attacchi supply chain multipli
Approfondimenti dal report Group-IB High-Tech Crime Trends 2026
Go to
Understanding Japan’s Cyber Threats in 2026: On The Front Lines of Supply Chain Attacks and Geopolitical Risks
Webinar
Understanding Japan’s Cyber Threats in 2026: On The Front Lines of Supply Chain Attacks and Geopolitical Risks
Learn the latest intelligence on supply chain vulnerabilities, AI-driven phishing and ransomware trends specifically impacting Japan and the Asia-Pacific region....
Go to
La era de los ataques a la cadena de suministro
Webinar
La era de los ataques a la cadena de suministro
Webinar exclusivo | Tendencias del Cibercrimen en América Latina 2026
Go to
Blog
Hooking the Archipelago: Dissecting a Phishing Campaign Targeting Philippine Banking Users
Group-IB researchers uncover an ongoing phishing campaign targeting major banks in the Philippines. This blog details how threat actors abuse...
Go to
Iran – Israel – U.S. conflict: Month 1 cyber impact assessment
Webinar
Iran – Israel – U.S. conflict: Month 1 cyber impact assessment
Join Group-IB Threat Intelligence experts for a private webinar analyzing how the situation has evolved over the month and what...
Go to
Blog
Phantom Stealer: Credential Theft as a Service
Group-IB shows how Business Email Protection blocked Phantom Stealer phishing emails across different campaign waves.
Go to
Blog
Beyond Compliance: How Financial Institutions Can Meet New Fraud-Sharing Mandates While Respecting Privacy
Global regulators are mandating fraud intelligence sharing. Learn how financial institutions can collaborate in real-time while maintaining privacy compliance through...
Go to
Boolka
Podcast
Boolka: The Evolution of a Cybercriminal Enterprise
If evolution has taught humanity anything, it’s that adaptation is key to survival. As prey develop camouflage techniques, predators get...
Go to
Blog
Cybersecurity Strategy Planning: The Essential Reset for Security Teams and Leaders in 2026
Is your cybersecurity truly built to withstand today’s nuanced threats or is it just living on paper? Find out more.
Go to
Blog
Esquema de Phishing GTFire: Evitando la detección mediante servicios de Google
Cómo GTFire abusa de Google Firebase y Google Translate para escalar campañas globales de phishing
Go to
Blog
Cloud Phones: The Invisible Threat
Tracing the evolution of cloud phone technology from harmless social media engagement automation to industrial-scale financial fraud that’s invisible to...
Go to
GXC Team takedown
Investigation
GXC Team takedown
Group-IB helped a Spanish Guardia Civil operation in dismantling “GXC Team”, a Crime-as-a-Service syndicate that weaponized AI to defraud bank...
Go to
Blog
How Hastalamuerte Operates: Group-IB’s Analysis of The Gentlemen’s Attack Methods
The report provides an overview on tactics, techniques, and procedures (TTPs) of The Gentlemen observed by Group-IB in intrusions conducted...
Go to
LATAM Intelligence Insights Report, Q1 2026
Report
LATAM Intelligence Insights Report, Q1 2026
Manténgase a la vanguardia frente al cambiante panorama de amenazas cibernéticas y descubra cómo los ciberdelincuentes están evolucionando sus tácticas...
Go to
Cómo una única brecha desencadena muchas otras en los ataques a la cadena de suministro
Webinar
Cómo una única brecha desencadena muchas otras en los ataques a la cadena de suministro
Conclusiones del informe «Tendencias en delitos de alta tecnología 2026» de Group-IB.
Go to
Blog
The Rise of Fake Shipment Tracking Scams in MEA
Did you really lose your shipment on the way?
Go to
Blog
Six Supply Chain Attack Groups to Watch Out for in 2026
Who's attacking your vendors? Read about the six main supply chain attack groups who are driving SaaS, open-source, and MSP...
Go to
Episode 3 of Group-IB’s Fraud Series
Podcast
The Mule Network: Inside the Industrialization of Digital Fraud
Digital fraud has evolved into a sophisticated, industrial-scale operation. Behind every fraudulent transaction lies a complex web of mule accounts,...
Go to
High-Tech Crime Trends Report Webinar 2026, META: The Age of Supply Chain Attacks
Webinar
High-Tech Crime Trends Report Webinar 2026, META: The Age of Supply Chain Attacks
Cybercrime is no longer defined by single, isolated incidents. Today, supply chain attacks form interconnected ecosystems where trust, access, and...
Go to
Wie eine einzige Sicherheitslücke zahlreiche Angriffe auf die Lieferkette auslöst
Webinar
Wie eine einzige Sicherheitslücke zahlreiche Angriffe auf die Lieferkette auslöst
Erkenntnisse aus Group-IB's High-Tech Crime Trends Bericht 2026
Go to
High-Tech Crime Trends 2026 in Europe
Webinar
High-Tech Crime Trends 2026 in Europe
Supply chain attacks have become the defining force in today’s cyber threat landscape. Rather than targeting organizations directly, attackers exploit...
Go to
Threat Briefing
Webinar
Threat Briefing
Join Group-IB experts to learn about the key cyber threats emerging from the escalation in the Middle East and what...
Go to
Blog
GTFire Phishing Scheme: Avoiding Detection Using Google Services
How GTFire abuses Google Firebase and Google Translate to scale global phishing campaigns
Go to
MuddyWater Strikes Again_1
Blog
Operation Olalampo: Inside MuddyWater’s Latest Campaign
MuddyWater APT has launched a new cyber offensive operation, dubbed Operation Olalampo, deploying new malware variants and leveraging Telegram bots...
Go to
Blog
Beyond Tax Returns: How Shared Malware Infrastructure Scales Brand Abuse In Indonesia
It’s tax season in Indonesia and fraudsters are observed to be ramping up the fraud campaign involving fake Coretax apps,...
Go to
High-Tech Crime Trends Report 2026
Report
High-Tech Crime Trends Report 2026
The High-Tech Crime Trends Report 2026 reveals how this shift has industrialized cybercrime, exposed the limits of perimeter-based defenses, and...
Go to
Unified Counter Fraud Framework: Combating fraud in seven steps
Report
Unified Counter Fraud Framework: Combating fraud in seven steps
Structure, assess, and manage fraud risk with an industry-tested lifecycle
Go to
End of OTP: UAE banks’ fast-track guide to CBUAE Consumer Protection Regulation
Report
End of OTP: UAE banks’ fast-track guide to CBUAE Consumer Protection Regulation
OTP-based transaction authentication is being phased out in the UAE, allowing the region to move towards upgraded fraud resilience. While...
Go to
Blog
Shaping Shadows: Breaking Down New ShadowSyndicate Methods and Infrastructure
ShadowSyndicate levels up by developing new tactics, establishing additional SSH fingerprints and involving more servers.
Go to
Blog
AI, Explain Yourself: Why Is Explainable AI (XAI) Becoming Critical for Cybersecurity?
AI knows everything, but should we trust it blindly? Here’s where XAI becomes important, by helping to keep AI in...
Go to
Blog
Your Cloud(s). Adversaries’ Chance At Control
Reconfigure multi-cloud security with the newly launched Group-IB Cloud Security Posture Management (CSPM)
Go to
Intelligence Insights Report, December 2025
Report
Intelligence Insights Report, December 2025
Explore the most notable cybersecurity events in the region and the best practices
Go to
META & Pakistan Intelligence Insights Report, December 2025
Report
META & Pakistan Intelligence Insights Report, December 2025
The Group-IB Intelligence Insights Report – December 2025 delivers a data-driven overview of the most critical cybercrime and fraud trends...
Go to
Intelligence Blindness: You Bought the Feeds, But You Can’t See the Threats
Webinar
Intelligence Blindness: You Bought the Feeds, But You Can’t See the Threats
Many organizations invest heavily in threat intelligence feeds and tools, yet still fail to see, understand, or act on real...
Go to
Blog
Peruvian Peaks: The Digital Loan Illusion
A deep dive into loan phishing scams in Peru and Latin America. Discover how scammers lure victims with fake loan...
Go to
Weaponized AI: Inside The Criminal Ecosystem Fueling The Fifth Wave of Cybercrime
Report
Weaponized AI: Inside The Criminal Ecosystem Fueling The Fifth Wave of Cybercrime
AI is no longer an emerging risk; it is now operational infrastructure for cybercrime.
Go to
Blog
Top 5 AI Security Risks in 2026
Go to
Blog
Phishing & Email Security: An AI-Ready Playbook
Go to
Blog
Real-World Examples of AI in Cybersecurity
Go to
DeadLock
Blog
DeadLock Ransomware: Smart Contracts for Malicious Purposes
This blog uncovers DeadLock’s stealthy usage of Polygon smart contracts for proxy address storage, a poorly-documented and under-reported technique that...
Go to
Blog
Ghost Tapped: Tracking the Rise of Chinese Tap-to-pay Android Malware
Group-IB researchers detail the inner workings of Chinese tap-to-pay schemes on Telegram and examine the NFC-enabled Android apps fraudsters are...
Go to
Blog
The DocuSign Impersonation Wave with Real-Time Customizable LogoKit
Learn how Group-IB’s Business Email Protection stops the growing wave of DocuSign impersonation before users are exposed, and protects them...
Go to
APAC Intelligence Insights, November 2025
Report
APAC Intelligence Insights, November 2025
Authoritative cyber threat intelligence for leaders defending the Asia-Pacific (APAC) region.
Go to
AUNZ Intelligence Insights, November 2025
Report
AUNZ Intelligence Insights, November 2025
Authoritative cyber threat intelligence for leaders defending the Australia and New Zealand (AUNZ) region.
Go to
The Imposter Factory: When Your Digital Identity Stops Being Yours
Webinar
The Imposter Factory: When Your Digital Identity Stops Being Yours
Digital identities are under attack. Join Group-IB for an exclusive live webinar exploring how cybercriminals steal, manipulate, and exploit digital...
Go to
Blog
Empty Promises in MENA: How Online Quick Cash Schemes Exploit the Gig Economy
Fake online job ads continue to circulate across social media, especially in Arab countries, offering easy remote work and quick...
Go to
Group-IB x Xalq Banki
Success Story
Group-IB x Xalq Banki
How Uzbekistan’s oldest bank protects its name and customers in the digital age
Go to
Intelligence Insights Report, November 2025
Report
Intelligence Insights Report, November 2025
Explore the most notable cybersecurity events in the region and the best practices
Go to
META Intelligence Report Cyber Threat Landscape, September – November 2025
Report
META Intelligence Report Cyber Threat Landscape, September – November 2025
Stay ahead of evolving cyber threats with Group-IB’s latest META Intelligence Report, analyzing the most significant global and regional cybersecurity...
Go to
Europe Intelligence Insights, November 2025
Report
Europe Intelligence Insights, November 2025
Europe’s threat landscape continued to evolve between September and November, revealing new patterns in ransomware activity, initial access sales, and...
Go to
Brain Cipher
Podcast
Brain Cipher: What Happens When National Infrastructure comes under strike?
Indonesia, June 2024 - 210 critical government agencies were crippled in one fell swoop. Immigration services were in disarray; customs...
Go to
Android SMS Stealers in Uzbekistan
Blog
Choose Your Fighter: A New Stage in the Evolution of Android SMS Stealers in Uzbekistan
Group-IB analyzes the evolution of Android malware in Uzbekistan, revealing advanced droppers, encrypted payload delivery, anti-analysis techniques, and Wonderland’s bidirectional...
Go to
Protocol 443 episode 1 preview
Podcast
Fintech and Fraud in Uzbekistan
In our first episode, we discuss the explosive growth of fintech in Uzbekistan and the 'price' being paid for digital...
Go to
AI in Cybersecurity
Blog
Your Updated Guide to AI in Cybersecurity: Adoption, Trends, Challenges, and The Future
AI in cybersecurity is changing the threat landscape faster than ever. Stay current and prepared with Group-IB.
Go to
Episode 2 of Group-IB’s Fraud Series
Podcast
Evolving Defense Tactics Against Rising Authorized Fraud
From the real human stories behind fraud defense to cracking APP scams and stopping mule networks in milliseconds… we’re covering...
Go to
Fighting Credit Fraud in Uzbekistan:
Blog
Fighting Credit Fraud in Uzbekistan: An Uphill Battle Against Social Engineering
Comprehensive insights into Uzbekistan’s credit fraud trends, the methods used by fraudsters, and the practical security controls financial institutions are...
Go to
Blog
Stranger Threats Are Coming: Group-IB Cyber Predictions for 2026 and Beyond
Stranger things are happening in the upside-down world of cybercrime. Group-IB’s CEO, Dmitry Volkov, shares his cyber predictions for 2026...
Go to
Cyber Fraud Fusion al Descubierto: El Modelo de Inteligencia de Group-IB que toda organización en LATAM necesita
Webinar
Cyber Fraud Fusion al Descubierto: El Modelo de Inteligencia de Group-IB que toda organización en LATAM necesita
Únete a este webinar exclusivo de ciberseguridad, donde nuestros expertos profundizarán en por qué el enfoque Cyber Fraud Fusion de...
Go to
The Future of Fraud Prevention: Why Sharing Suspicious Activity is Now a Reality
Webinar
The Future of Fraud Prevention: Why Sharing Suspicious Activity is Now a Reality
Learn how Group-IB's Bureau Veritas-validated technology enables compliant, real-time fraud intelligence sharing between institutions — detecting threats as early as...
Go to
Blog
Hook for Gold: Inside GoldFactory’s Сampaign That Turns Apps Into Goldmines
A deep dive into GoldFactory’s evolving mobile fraud campaigns across APAC, including modified banking apps, new malware variants such as...
Go to
APP fraud
Blog
Can You Actually Stop APP Fraud Before It Happens? Inside The Secure, Real-Time Fraud Intelligence Network Proving It’s Possible
Discover how real-time fraud intelligence sharing prevents APP fraud before losses. Stop mule accounts already during warm-up with GDPR-compliant technology.
Go to
Operation Kaerb: The Takedown of iServer Phishing-as-a-Service Platform
Investigation
Operation Kaerb: The Takedown of iServer Phishing-as-a-Service Platform
Group-IB supported “Operation Kaerb,” an international law enforcement effort led by Europol and Ameripol, targeting the iServer phishing-as-a-service platform. Active...
Go to
ajina-default
Podcast
Ajina: Can you really trust that app?
Cyber criminals are masters at exploiting human vulnerability and trust. In Uzbek folklore, there's a creature known for causing chaos,...
Go to
The ALTDOS Takedown Operation: The arrest of a global data leak mastermind
Investigation
The ALTDOS Takedown Operation: The arrest of a global data leak mastermind
Group-IB contributed to the ALTDOS takedown, a collaborative effort involving the Royal Thai Police and Singapore Police Force, which led...
Go to
Blog
Bloody Wolf: A Blunt Crowbar Threat To Justice
Since late June 2025, Group-IB analysts observed a surge in spear-phishing emails across Central Asia. The attackers impersonate government agencies...
Go to
Fraud Protection Spotlight. Product Roadmap, Use Cases & What’s New
Webinar
Fraud Protection Spotlight. Product Roadmap, Use Cases & What’s New
Deepen your Group-IB Fraud Protection expertise. Learn about platform evolution, latest fraud tactics, and effective solution positioning for banks, fintech,...
Go to
AUNZ Intelligence Insights Report, September 2025
Report
AUNZ Intelligence Insights Report, September 2025
Get regional intelligence that matters. Download the September 2025 edition of Intelligence Insights to uncover major cyber trends across AUNZ,...
Go to
APAC Intelligence Insights Report, September 2025
Report
APAC Intelligence Insights Report, September 2025
Stay informed on the key cybersecurity movements across Asia-Pacific in September 2025.
Go to
APAC Intelligence Insights Report, October 2025
Report
APAC Intelligence Insights Report, October 2025
Discover key cybersecurity development shaping the Asia-Pacific (APAC) region for October 2025.
Go to
UNC2891: ATM Threats Never Die
Report
UNC2891: ATM Threats Never Die
Since 2022, Group-IB specialists have investigated a series of attacks carried out by UNC2891 against several financial institutions in Indonesia.
Go to
AUNZ Intelligence Insights Report, October 2025
Report
AUNZ Intelligence Insights Report, October 2025
Discover key cybersecurity developments shaping the AUNZ region for October 2025.
Go to
Intelligence Insights Report, October 2025
Report
Intelligence Insights Report, October 2025
Explore the most notable cybersecurity events in the region and the best practices
Go to
Europe Intelligence Insights, October 2025
Report
Europe Intelligence Insights, October 2025
Europe’s cyber pulse: targeted sectors, refined tactics, and a widening attack surface
Go to
Group-IB x Trusttech
Success Story
Group-IB x Trusttech
Securing digital trust in Uzbekistan's financial sector
Go to
Multi-Stage Phishing Kit
Blog
Uncovering a Multi-Stage Phishing Kit Targeting Italy’s Infrastructure
Group-IB researchers uncovered a professional phishing framework that mimics trusted brands with remarkable precision. Using layered evasion, CAPTCHA filtering, and...
Go to
Business Email Protection Spotlight
Webinar
Business Email Protection Spotlight
Discover the New Era of Group-IB’s Business Email Protection
Go to
Blog
Ghosts in /proc: Manipulation and Timeline Corruption
Discover how attackers could manipulate the Linux /proc filesystem to hide malicious processes and distort forensic timelines. This technical deep...
Go to
Malware Epidemic in Uzbekistan
Webinar
Malware Epidemic in Uzbekistan
In October, Group-IB specialists detected a new wave of attacks using malicious software targeting users in Uzbekistan. During the webinar,...
Go to
Blog
Detecting the NPM Supply Chain Compromise Before It Spread
Discover how Group-IB’s Business Email Protection (BEP) could prevent an NPM supply chain compromise by detecting the initial phishing email...
Go to
Blog
The Illusion of Wealth: Inside the Engineered Reality of Investment Scam Platforms
This blog details online investment scam campaigns, including fraudulent cryptocurrency, forex, and trading platforms, while offering a technical investigation guide...
Go to
oilrig default image
Podcast
MuddyWater & OilRig: The Cyber Espionage Playbook
As digital infrastructure becomes the backbone of global economies, cyber espionage has quietly evolved into one of the most powerful...
Go to
Intelligence Insights Report, September 2025
Report
Intelligence Insights Report, September 2025
Explore the most notable cybersecurity events in the region and the best practices
Go to
Blog
Unmasking MuddyWater’s New Malware Toolkit Driving International Espionage
Group-IB Threat Intelligence has uncovered a sophisticated phishing campaign, attributed with high confidence to the Advanced Persistent Threat (APT) MuddyWater....
Go to
Blog
Exposing the Immediate Era Fraud in Singapore
Group-IB’s Threat Intelligence Report on a Singapore-Targeted Scam Operation
Go to
Blog
East-west tension: Are NDR vendors monitoring the wrong traffic?
Most NDR deployments focus on perimeter traffic. Meanwhile, attackers move laterally inside networks. Here’s why east-west visibility is the blind...
Go to
APAC Digital Risk Protection Cases Report, August 2025
Report
APAC Digital Risk Protection Cases Report, August 2025
Uncover the most critical digital fraud and brand abuse cases across Asia-Pacific (APAC) as well as Australia and New Zealand...
Go to
Europe Intelligence Insights, September 2025
Report
Europe Intelligence Insights, September 2025
In recent months, the manufacturing, construction, and IT sectors faced fresh ransomware campaigns. Hacktivist collectives stepped up their DDoS assaults...
Go to
Blog
A new weapon against payment fraud: Unique threat intelligence for anti-fraud teams
Group-IB’s Suspicious Payment Details module for Threat Intelligence delivers payment identifiers tied to ransomware, illegal casinos, and laundering schemes. Fraud,...
Go to
Blog
Top 7 Cybersecurity Newsletters Worth Your Inbox
Your inbox deserves better than spam. Here are 7 cybersecurity newsletters that actually inform and make you a little smarter...
Go to
The Voice of Fraud: Deepfake Vishing and the New Age of Social Engineering
Report
The Voice of Fraud: Deepfake Vishing and the New Age of Social Engineering
Group-IB’s Fraud Protection team examines the rise of deepfake vishing attacks and caller ID spoofing, exposing how cybercriminals exploit AI...
Go to
Joystick to Jailbreak
Podcast
Joystick to Jailbreak: Exploring the Youth Cybercrime Pandemic
Forget everything you think you know about hackers. Today’s cybercriminals aren’t lurking in shadowy basements - they’re teenagers mastering cheat...
Go to
Blog
Tracking MuddyWater in Action: Infrastructure, Malware and Operations during 2025
The blog provides an in-depth look at MuddyWater’s evolution in tooling, targeting, and infrastructure management, suggesting a more mature and...
Go to
META Intelligence Report, August 2025. Cyber Threat Intelligence Across Middle East, Türkiye, Africa & Pakistan
Report
META Intelligence Report, August 2025. Cyber Threat Intelligence Across Middle East, Türkiye, Africa & Pakistan
Group-IB’s latest intelligence report highlights key cybersecurity developments from August 2025, focusing on global threats with regional impact. From targeted...
Go to
APAC Intelligence Insights Report, August 2025
Report
APAC Intelligence Insights Report, August 2025
Discover key cybersecurity development shaping the Asia-Pacific (APAC) region for August 2025.
Go to
Intelligence Insights Report, August 2025
Report
Intelligence Insights Report, August 2025
Explore the most notable cybersecurity events in the region and the best practices
Go to
Europe Intelligence Insights Report, August 2025
Report
Europe Intelligence Insights Report, August 2025
Italian defense and security data leaked. New ransomware groups make their presence known. Acts of retribution against governments in Germany,...
Go to
APAC Intelligence Insights Report, July 2025
Report
APAC Intelligence Insights Report, July 2025
Explore our insights on the most notable cybersecurity events in the Asia-Pacific (APAC) region for July 2025.
Go to
Hacktivist at War: The Cambodia-Thailand Cyber Escalation July-August 2025
Report
Hacktivist at War: The Cambodia-Thailand Cyber Escalation July-August 2025
Hacktivist cyber attacks often rise in parallel when conflict between nations arise. Understand the common tactics, techniques and procedures that...
Go to
Group-IB x Croatian National CERT
Success Story
Group-IB x Croatian National CERT
Learn how Croatia's national cybersecurity authority used Group-IB's Threat Intelligence platform to strengthen defense capabilities across five regulated sectors and...
Go to
top cybersecurity podcasts
Blog
10 Cybersecurity Podcasts to Add to Your Queue Now
Go to
Blog
From Deepfakes to Dark LLMs: 5 use-cases of how AI is Powering Cybercrime
AI in cybercrime is evolving fast, fueling AI phishing attacks, AI scam calls, AI voice cloning scams, and even AI...
Go to
ransomhub
Podcast
RansomHub: From RaaS Kingpin to Cartel Mystery
When RansomHub, one of the most prolific ransomware groups, vanished overnight back in April, it sent shockwaves through the cybercriminal...
Go to
Blog
ShadowSilk: A Cross-Border Binary Union for Data Exfiltration
This blog describes attacks on victims in Central Asia and APAC. Research into the attack has identified a group also...
Go to
Trust issues: How email threats hide behind your partners
Blog
Trust issues: How email threats hide behind your partners
The most widely used email security tools still focus on yesterday’s threats. Meanwhile, attackers have moved on. By hijacking legitimate...
Go to
APAC Intelligence Insights H1-2025 Review & H2 Forecasts
Webinar
APAC Intelligence Insights H1-2025 Review & H2 Forecasts
Stay ahead of the cyber threats in the Asia-Pacific (APAC) region! Join Group-IB’s experts for a live webinar on 23...
Go to
Classiscam en la region de LATAM
Webinar
Classiscam en la region de LATAM
Descubre cómo opera Classiscam en América Latina en 2025. Conoce sus tácticas de estafa, el uso de bots en Telegram...
Go to
YouTube Video Preview
Video
Attack Surface Management, explained
The attack surface of an organisation includes all the assets, systems.
Go to
Fraud Matrix 2.0 Webinar
Webinar
Fraud Matrix 2.0 Webinar
Fraud Matrix 2.0 Webinar: Combatting Fraud with Intelligence
Go to
Evolving Mule Tactics in the META Region Banking Sector
Blog
Evolving Mule Tactics in the META Region Banking Sector
Discover how mule operators evolved in META-region banks—from IP masking to Starlink tactics with advanced GPS spoofing, SIM abuse, and...
Go to
YouTube Video Preview
Video
Card Shops, Explained
In cybersecurity, a card shop is a type of underground market that sells specific types of data – dumps and...
Go to
META & Pakistan Intelligence Insights Report, July 2025
Report
META & Pakistan Intelligence Insights Report, July 2025
Discover what shaped the threat landscape across the Middle East, Turkey, Africa (META), and Pakistan this July.
Go to
exposing investment scams blog
Blog
Exposing Investment Scams: AI Trading, Deepfake & Online Fraud
AI trading scams use deepfake videos, fake reviews, and fraudulent platforms to steal investor money, and learn the signals that...
Go to
YouTube Video Preview
Video
Encryption, explained
Encryption converts readable data into an unreadable code, unless you possess the key.
Go to
Blog
The Anatomy of a Deepfake Voice Phishing Attack: How AI-Generated Voices Are Powering the Next Wave of Scams
Discover how AI voice deepfake vishing exploits trust, drains millions, and learn practical steps to detect and stop voice‑based scams.
Go to
Intelligence Insights Report, July 2025
Report
Intelligence Insights Report, July 2025
Explore the most notable cybersecurity events in the region and the best practices
Go to
Europe Intelligence Insights Report, July 2025. Intelligence That Defeats The Enemy.
Report
Europe Intelligence Insights Report, July 2025. Intelligence That Defeats The Enemy.
Crypto holders in Europe - tax declarations may drain your funds. Apparel, retail, and luxury businesses - stay alert. Companies...
Go to
Your Gateway To Proactive Defense: Operationalizing Cyber Threat Intelligence (CTI)
Webinar
Your Gateway To Proactive Defense: Operationalizing Cyber Threat Intelligence (CTI)
Unlock the real power of CTI. Join experts live to learn how to turn cyber threat data into actionable defense...
Go to
Episode 1 of Group-IB’s Fraud Series
Podcast
Unmasking Cyber Fraud in the Middle East and Beyond
In this segment, we dive into the evolving deepfake threats targeting organizations across the Middle East and beyond. Key highlights...
Go to
Intelligence Insights Webinar: Cyber Threat Landscape in META & Pakistan
Webinar
Intelligence Insights Webinar: Cyber Threat Landscape in META & Pakistan
Join us for an exclusive intelligence briefing as Group-IB experts reveal key findings from the monthly Intelligence Insights Reports covering...
Go to
Сyberseсurity Ultimate Assessment Guide: Part 2. Human-Centric Assessements
Report
Сyberseсurity Ultimate Assessment Guide: Part 2. Human-Centric Assessements
Assess and strengthen your team's cybersecurity readiness with Group-IB's expert guide
Go to
Blog
UNC2891 Bank Heist: Physical ATM Backdoor & Linux Forensic Evasion
Deep dive into UNC2891’s multi‑stage bank intrusion: Raspberry Pi ATM implant, bind mount evasion, Dynamic DNS C2, and a CAKETAP...
Go to
Podcast
DragonForce: The Cyber Cartel Helping Hackers Hit the High Street
Empty shelves, lost customers, and hundreds of millions of pounds in lost profit are just some of the outcomes that...
Go to
YouTube Video Preview
Video
Account Takeovers, Explained
Let's learn about account takeovers, their impact, and how to defend against them.
Go to
Blog
Predictive AI: The “Quiet Catalyst” Behind The Future of Cybersecurity
Think threat actors are unpredictable? The rise of intelligence-driven defense and the push for incident predictions might just give us...
Go to
MSSPs: Upgrade Your Service Stack with Group-IB’s Unified Risk Platform
Webinar
MSSPs: Upgrade Your Service Stack with Group-IB’s Unified Risk Platform
Conventional tools won't cut it in a world where attackers evolve by the minute. With Group-IB, deliver future-ready cybersecurity capabilities—today....
Go to
Blog
Signed, Sealed, Altered? Deepdive into PDF Tampering
Uncovering the validity of a PDF by utilizing some of the tools and methods to detect changes made to a...
Go to
Blog
Fraud-Proof Your Security: How BioConfirm Protects iGaming Platforms and Players
Enable real-time, token-based account security that stops withdrawal fraud before your brand, players, and their revenue are compromised.
Go to
YouTube Video Preview
Video
The Deep Web, Explained
Let's learn about the Deep Web.
Go to
Blog
Fake Receipts Generators: the rising threat to major retail brands
Scammers are using tools like MaisonReceipts to create fake receipts and exploit brands. Uncover how this growing fraud ecosystem works...
Go to
APAC Intelligence Insights Report, June 2025
Report
APAC Intelligence Insights Report, June 2025
Gain a confident understanding on how to address APAC’s unique and evolving cyber threats.
Go to
Group-IB x Data Cloud Technology
Success Story
Group-IB x Data Cloud Technology
Data Cloud Technology (DCT) partnered with Group-IB to enhance visibility, secure critical infrastructure, and evolve into a trusted MSSP (with...
Go to
APAC Intelligence Insights Report, May 2025
Report
APAC Intelligence Insights Report, May 2025
Navigate APAC's unique and evolving threat landscape with our strategic insights.
Go to
YouTube Video Preview
Video
XDR Product Update: Smart Alerts
Discover how Smart Alert in Group-IB Managed XDR consolidates thousands of alerts into one, cuts alert volume by 80%, and...
Go to
META & Pakistan Intelligence Insights Report, June 2025
Report
META & Pakistan Intelligence Insights Report, June 2025
From hacktivist escalations to multi-stage malware threats — June 2025 witnessed a sharp rise in cyber risk across the META...
Go to
Blog
What Is a Combolist? How It Works, Risks, and Prevention
Combolists and ULP files circulate on the dark web as new leaks, but most of what they contain was stolen...
Go to
YouTube Video Preview
Video
DDoS, Explained
Let's learn about DDoS attacks.
Go to
Blog
Authenticate Users, Secure Transactions: How BioConfirm Secures High-Stakes Banking Operations
Introducing BioConfirm - Enable real-time, token-based user account security that stops withdrawal fraud before your brand, customers’ trust, and revenue...
Go to
Blog
Exploiting Trust: How Signed Drivers Fuel Modern Kernel Level Attacks on Windows
Discover how attackers leverage Windows Kernel loaders and abuse digitally signed drivers to gain privileged access, disable security tools, and...
Go to
Blog
One attack, one alert: From thousands of signals to one clear story
Discover how Smart Alert in Group-IB Managed XDR consolidates thousands of alerts into one, cuts alert volume by 80%, and...
Go to
Operationalize Threat Intelligence
Report
Operationalize Threat Intelligence
Your All-Hands E-Book On Operationalizing Cyber Threat Intelligence (CTI)
Go to
Figure 1. A screenshot of a deceptive message via Telegram requesting users to download a malicious app to receive financial assistance from the government in Uzbek (top) and translation in English (bottom).
Blog
June’s Dark Gift: The Rise of Qwizzserial
Discovered by Group-IB in mid-2024, the Qwizzserial, which was initially not very active, began to spread strongly in Uzbekistan, masquerading...
Go to
YouTube Video Preview
Video
Zero Days, explained
Let's learn about zero days and how to defend against them.
Go to
Intelligence Insights Report, June 2025
Report
Intelligence Insights Report, June 2025
Explore the most notable cybersecurity events in the region and the best practices
Go to
Europe Intelligence Insights Report, June 2025. Know What Threats Are Impacting Your Region – Before They Impact You.
Report
Europe Intelligence Insights Report, June 2025. Know What Threats Are Impacting Your Region – Before They Impact You.
With a 240-fold increase in credential compromises caused by lesser-known malware and critical insights into ransomware, hacktivism, and DDoS activity,...
Go to
Account Takeover and Social Engineering: Frontlines Stories and Signals to Combat them
Webinar
Account Takeover and Social Engineering: Frontlines Stories and Signals to Combat them
Join Group-IB and industry expert Hailey Windham for an in-depth exploration of the rapidly evolving threat landscape, where fraudsters are...
Go to
Blog
Middle East Cyber Escalation: From Hacktivism to Sophisticated Threat Operations
Regional Conflict Monitoring (June 13 - 20, 2025)
Go to
YouTube Video Preview
Video
Endpoint Security, explained
Let's learn about endpoint security!
Go to
Digital Risk Highlights 2025: Scams Don’t Respect Borders
Report
Digital Risk Highlights 2025: Scams Don’t Respect Borders
Discover how scams are evolving worldwide and what threats to watch for in your region — all in one visual...
Go to
Blog
Declaration trap: Crypto Drainers masquerading as European Tax Authorities
Scammers are using fake tax authority emails to deploy crypto drainers. Discover how the declaration trap works and how to...
Go to
Group-IB x PSR IT Solutions
Success Story
Group-IB x PSR IT Solutions
How a fintech pioneer achieved PCI MPoC compliance and secured mobile payments across the globe
Go to
Phishing Evasion Tactics: Staying Online in LATAM
Webinar
Phishing Evasion Tactics: Staying Online in LATAM
Descubre cómo los atacantes de phishing en LATAM evaden la detección mediante georrestricciones, filtrado por dispositivo y validación de identidad....
Go to
APAC Intelligence Insights Report, March 2025
Report
APAC Intelligence Insights Report, March 2025
Prepare your APAC cybersecurity strategy for the region's unique and emerging threats. Navigate its complex cyber environment with essential intelligence...
Go to
lazarus
Podcast
Lazarus: The State-Sponsored Hackers Who Never Log Off
In December 2014, Sony Pictures announced they were cancelling the release of Seth Rogan’s newest venture The Interview due to...
Go to
APAC Intelligence Insights Report, April 2025
Report
APAC Intelligence Insights Report, April 2025
Arm your cybersecurity strategy with strategic intelligence to masterfully navigate APAC’s unique and ever-evolving threat landscape
Go to
Intelligence Insights Report, May 2025
Report
Intelligence Insights Report, May 2025
Explore the most notable cybersecurity events in the region and the best practices
Go to
YouTube Video Preview
Video
The Dark Web, explained
Let's learn about the dark web!
Go to
META Intelligence Insights Report, May 2025. Cutting-edge Threat Intelligence for the META Region and Beyond
Report
META Intelligence Insights Report, May 2025. Cutting-edge Threat Intelligence for the META Region and Beyond
Stay ahead of the evolving cyber threat landscape with Group-IB's latest Intelligence Insights Report – May 2025. This edition delivers...
Go to
YouTube Video Preview
Video
Botnets, explained
Let's learn about botnets and how to defend against them.
Go to
Europe Intelligence Insights Report, April 2025
Report
Europe Intelligence Insights Report, April 2025
Go to
LATAM Intelligence Insights Report, April 2025 (English/Spanish)
Report
LATAM Intelligence Insights Report, April 2025 (English/Spanish)
Discover how cybercriminals are evolving their tactics in Latin America
Go to
YouTube Video Preview
Video
Phishing, explained
Let's learn about phishing and how to defend against it.
Go to
North America Intelligence Insights Report, April 2025
Report
North America Intelligence Insights Report, April 2025
Uncover the latest cyber threats targeting North America with Group-IB’s monthly threat insights—tailored for security leaders who need to stay...
Go to
YouTube Video Preview
Video
Ransomware, explained
Let's learn about ransomware and how to defend against it.
Go to
Blog
Disguised Cyber Risks On The Colombian Shore: The Insurance Trap
Uncover how cybercriminals in Colombia impersonate financial brands and exploit public data to craft convincing vehicle insurance scams.
Go to
golden factory
Podcast
GoldFactory: The Cybercriminals Who Want to Steal Your Face
Meet GoldFactory — an elusive, Chinese-speaking cybercrime group operating in Asia. They're behind GoldPickaxe, the first-ever iOS banking Trojan, and...
Go to
Blog
Understanding Credential Harvesting via PAM: A Real-World Threat
Learn how attackers exploit Pluggable Authentication Modules (PAM) for credential harvesting—and discover defenses to harden Linux authentication.
Go to
Blog
How To Avoid Critical Integration Mistakes In Your Cybersecurity Stack
Go to
META April Intelligence Insights. Unmasking Threats. Powering Defenses.
Report
META April Intelligence Insights. Unmasking Threats. Powering Defenses.
Stay ahead of the curve with Group-IB’s latest cyber intelligence insights for the META region and beyond. Our April edition...
Go to
Blog
Ransomware debris: an analysis of the RansomHub operation
This blog on RansomHub provides an overview into how this Ransomware-as-a-Service (RaaS) group operates, including its extortion tactics, affiliate recruitment...
Go to
YouTube Video Preview
Video
Keyloggers, explained
Let's learn about keyloggers and how to defend against them.
Go to
Intelligence Insights Report, March/April 2025
Report
Intelligence Insights Report, March/April 2025
Explore the most notable cybersecurity events in the region and the best practices
Go to
Blog
Toll of Deception: Where Evasion Drives Phishing Forward
Discover the latest phishing campaign targeting a major toll road service provider, where cybercriminals use sophisticated evasion techniques to bypass...
Go to
Europe Intelligence Insights Report, March 2025
Report
Europe Intelligence Insights Report, March 2025
Does your current cybersecurity strategy account for new and emerging threats? If not, here’s what you need to know to...
Go to
Blog
Fast, smart, and private: Group-IB introduces AI Assistant
Our new LLM-powered chatbot is designed for efficiency and security. Discover how Group-IB AI Assistant enhances threat intelligence workflows and...
Go to
Unveiling Group-IB AI Assistant for faster and smarter access to Threat Intelligence
Webinar
Unveiling Group-IB AI Assistant for faster and smarter access to Threat Intelligence
Would you like to transform your threat intelligence workflows and gain instant insights into the evolving cyber threat landscape? Our...
Go to
Blog
Typical Dark Web Fraud: Where Scammers Operate and What They Look Like
Go to
Threat Actor
RansomHub
Since its discovery in February 2024, RansomHub has quickly become a dominant force in ransomware. As of now, according to...
Go to
GoldFactory
Threat Actor
GoldFactory
Currently, there’s limited public information on this Masked Actors group. However, in May 2024, we uncovered the first iOS trojan,...
Go to
Lazarus
Threat Actor
Lazarus
Lazarus is a notorious hacking organization of Masked Actors, known as an advanced persistent threat (APT) group. With links to...
Go to
Threat Actor
DragonForce
This significant group of Masked Actors emerged initially in the Middle East and Asia. DragonForce has since expanded globally with...
Go to
Threat Actor
Oilrig
OilRig is an Iranian state-sponsored cyber espionage group that’s been active for over a decade. While these Masked Actors operate...
Go to
MuddyWater
Threat Actor
MuddyWater
MuddyWater is another hacker group of cyber spies. Believed to be a subset of Iran’s Ministry of Intelligence and Security...
Go to
Threat Actor
Brain Cipher
New to the scene, Brain Cipher emerged halfway through last year. These Masked Actors quickly gained attention for their sophisticated...
Go to
Threat Actor
Boolka
Boolka’s evolving stealth tactics have made it a notable player within the Masked Actors community. This group’s ability to adapt...
Go to
Threat Actor
Ajina
This rapidly growing group of Masked Actors are part of an affiliation network, suggesting a bigger organized cybercrime operation. Ajina...
Go to
YouTube Video Preview
Video
2FA, explained
Let's learn about why using 2FA can help save you from a whole lot of trouble.
Go to
Threat Actor
Team TNT
These Masked Actors are infamous for cloud-targeted cryptojacking, Secure Shell (SSH) brute-force attacks, and data theft. Over the years, Team...
Go to
Blog
CISOs Top Order Of Business: Cyber Risk Reduction & Management
For modern CISOs, cyber risk management and reduction are nonstop challenges. But this blog offers exactly what you need to...
Go to
Tendenze dei Crimini Informatici Avanzati del 2025
Webinar
Tendenze dei Crimini Informatici Avanzati del 2025
Unisciti a noi per scoprire perché le aziende europee sono tra i bersagli principali degli APT, attacchi ransomware, schemi di...
Go to
Blog
SMS Pumping: How Criminals Turn Your Messaging Service into Their Cash Machine
Go to
Blog
Fraud Underbelly: Australia’s Digital Boom—A Fraudster’s Goldmine?
Know exactly how cybercriminals are orchestrating attacks on Australia’s citizens and digital assets, and why are they a lucrative target?
Go to
Frost & Sullivan’s 2025 Global Technology Innovation Leadership Award
Report
Frost & Sullivan’s 2025 Global Technology Innovation Leadership Award
Frost & Sullivan has awarded Group-IB the 2025 Global Technology Innovation Leadership Award for redefining cybersecurity with cutting-edge threat intelligence...
Go to
Blog
The beginning of the end: the story of Hunters International
Learn about technical details on the ransomware and Storage Software tool, how the criminals use the affiliate panel as well...
Go to
Operation Nervone: The takedown of OPERA1ER
Investigation
Operation Nervone: The takedown of OPERA1ER
Group-IB played a pivotal role in Operation Nervone, a multinational law enforcement effort led by INTERPOL and AFRIPOL, among others,...
Go to
Blog
Navigating Cybercrime Currents in Latin America: Strengthening the Region’s Defenses
Stripping down barriers of distance, language, and the unknown, Group-IB’s mission to fight cybercrime brings us to our latest frontier...
Go to
Group-IB x Sinority
Success Story
Group-IB x Sinority
With Group-IB's solutions integrated into its portfolio, Sinority can now help its clients rapidly identify and respond to online threats.
Go to
Blog
Unmasking the Classiscam in Central Asia
Scams like Classiscam automate fake websites to steal financial data, exploiting digitalization’s rise in developing countries, making fraud both effective...
Go to
Intelligence Insights Report, February 2025
Report
Intelligence Insights Report, February 2025
Explore the most notable cybersecurity events in the region and the best practices
Go to
Blog
Hunting Rituals #5: Why hypothesis-based threat hunting is essential in cybersecurity
Discover how hypothesis-driven threat hunting uncovered stealthy malware. Learn why having a dedicated in-house team or leveraging expert threat hunting...
Go to
APAC Intelligence Insights Report, February 2025
Report
APAC Intelligence Insights Report, February 2025
The February 2025 edition of our monthly Intelligence Insights Report provides a detailed examination of the critical shifts and emerging...
Go to
2025 Trends in der Hightech Kriminalität
Webinar
2025 Trends in der Hightech Kriminalität
Diskutieren Sie mit uns, warum die Unternehmen in Europa zu den Hauptangriffszielen gehören, während staatlich unterstützte APTs, Ransomware-Angriffe, Phishing-Methoden und...
Go to
Blog
The Cybercriminal with Four Faces: Revealing Group-IB’s Investigation into ALTDOS, DESORDEN, GHOSTR and 0mid16B
Following the arrest of the cybercriminal behind the aliases ALTDOS, DESORDEN, GHOSTR, and 0mid16B, Group-IB provides a deep dive into...
Go to
High-Tech Crime Trends 2025 in North America
Webinar
High-Tech Crime Trends 2025 in North America
Join our experts on April, 3 2025 at 12 pm (ET / GMT-4) for an in-depth analysis of global and...
Go to
Tendencias del Cibercrimen 2025 en Europa
Webinar
Tendencias del Cibercrimen 2025 en Europa
Únase a nosotros para debatir por qué las empresas de la región son objetivos prioritarios, con un aumento de amenazas...
Go to
High-Tech Crime Trends 2025 Deep Dive in APAC
Webinar
High-Tech Crime Trends 2025 Deep Dive in APAC
Join our experts on 3 April 2025 at 11 am GMT+8 for an in-depth analysis of global and APAC-specific insights...
Go to
High-Tech Crime Trends 2025 in LATAM (Spanish)
Webinar
High-Tech Crime Trends 2025 in LATAM (Spanish)
Cybercrime in Latin America is evolving rapidly—are you prepared for the latest threats? Join Group-IB’s experts as we uncover the...
Go to
High-Tech Crime Trends 2025 in Europe
Webinar
High-Tech Crime Trends 2025 in Europe
Join us for a discussion on why businesses in the region are prime targets, with state-sponsored APTs, ransomware attacks, phishing...
Go to
YouTube Video Preview
Video
High-Tech Crime Trends 2025
In 2025, the world of cybercrime continues to evolve at an unprecedented pace.
Go to
ClickFix
Blog
ClickFix: The Social Engineering Technique Hackers Use to Manipulate Victims
Discover how the ClickFix social engineering attack exploits human psychology to bypass security. Learn how hackers use this tactic and...
Go to
High-Tech Crime Trends 2025 in the META Region
Webinar
High-Tech Crime Trends 2025 in the META Region
A surge in APTs, hacktivism, and phishing in META — how cyber threats evolved in 2024
Go to
Europe Intelligence Insights Report, February 2025
Report
Europe Intelligence Insights Report, February 2025
Which threats are shaping Europe’s cybersecurity landscape, and how can you defend against them in time? Get essential details without...
Go to
Blog
The Evolution of SIM Swapping Fraud: How Fraudsters Bypass Security Layers
Discover how SIM swapping fraud has evolved, how cybercriminals bypass security layers, and the best ways to protect yourself from...
Go to
Blog
Building Zero Trust Security: Selectively Trust To Rightfully Secure
Build resilience with a zero trust cybersecurity model. Leverage your existing infrastructure for stronger security. Get all essential insights to...
Go to
Blog
Technology Alone Isn’t the Answer to Cyber Threats: Time to Rethink Security Culture
Get the (ABCs) Awareness, Behavior, and Culture of cybersecurity right - an organization's silent drivers of cyber protection.
Go to
High-Tech Crime Trends Report 2025
Report
High-Tech Crime Trends Report 2025
Group-IB’s annual report delves into the most critical high-tech crime trends, offering a comprehensive analysis of emerging threats, tactics, and...
Go to
North America Intelligence Insights Report, February 2025
Report
North America Intelligence Insights Report, February 2025
Don’t miss key cybersecurity events that affected the region last month, and get defense-equipped by exploring best practices.
Go to
LATAM Intelligence Insights Report, February 2025 (English/Spanish)
Report
LATAM Intelligence Insights Report, February 2025 (English/Spanish)
Don’t miss key cybersecurity events that affected the region last month, and get defense-equipped by exploring best practices.
Go to
META Intelligence Insights Report, February 2025
Report
META Intelligence Insights Report, February 2025
In an increasingly interconnected world, staying ahead of cyber threats is paramount. Group-IB's META Intelligence Insights report for February 2025...
Go to
Blog
Fingerprint Heists: How your browser fingerprint can be stolen and used by fraudsters
Discover how cybercriminals steal browser fingerprints to mimic users, bypass security measures, and commit online fraud. Learn how to protect...
Go to
Cyber Resilience 2025: Battling Emerging Regional Threats
Webinar
Cyber Resilience 2025: Battling Emerging Regional Threats
Join Ahmed Tharwat in this exclusive webinar to explore the latest cyber threat landscape in the region.
Go to
RansomHub Never Sleeps Episode 1
Blog
RansomHub Never Sleeps Episode 1: The evolution of modern ransomware
Discover how ransomware has evolved into a sophisticated cyber threat, with groups like RansomHub leading the charge. Learn more about...
Go to
YouTube Video Preview
Video
Our Free Malware Analysis Tool
Group-IB’s Threat Intelligence team scours thousands of malware samples every day to detect emerging threats.
Go to
5 ways to leverage our Malware Reports for malware analysis
Blog
5 ways to leverage our Malware Reports for malware analysis
Discover 5 ways to leverage Malware Reports for daily analysis and improve detection. Perfect for SOC analysts, threat hunters, and...
Go to
Blog
The Dark Side of Automation and Rise of AI Agents: Emerging Risks of Card Testing Attacks
Card testing attacks exploit stolen credit card details through small, unnoticed purchases to verify active cards for larger fraud. Cybercriminals...
Go to
LATAM Intelligence Insights Report, January 2025 (English/Spanish)
Report
LATAM Intelligence Insights Report, January 2025 (English/Spanish)
Explore the most notable cybersecurity events in the region and the best practices.
Go to
North America Intelligence Insights Report, January 2025
Report
North America Intelligence Insights Report, January 2025
Spotlighting critical cybercrime trends in North America and beyond.
Go to
Blog
Cat’s out of the bag: Lynx Ransomware-as-a-Service
In this blog, we observed how the Lynx Ransomware-as-a-Service (RaaS) group operates, detailing the workflow of their affiliates within the...
Go to
APAC Intelligence Insights Report, January 2025
Report
APAC Intelligence Insights Report, January 2025
Delve into critical shifts and emerging dangers in the Asia-Pacific (APAC) cyberthreat landscape with the January 2025 edition of our...
Go to
META Intelligence Insights Report, January 2025
Report
META Intelligence Insights Report, January 2025
Uncover the Latest Cyber Threats and Trends. Stay informed and protect your organization with Group-IB’s January Intelligence Report. This comprehensive...
Go to
Europe Intelligence Insights Report, January 2025
Report
Europe Intelligence Insights Report, January 2025
Don’t miss key cybersecurity events that affected the region, and get defense-equipped by exploring best practices.
Go to
Outsmart Cybercriminals with APAC Cyber Intelligence: Group-IB APAC Intelligence Insights Webinar
Webinar
Outsmart Cybercriminals with APAC Cyber Intelligence: Group-IB APAC Intelligence Insights Webinar
Join us for an in-depth analysis of Group-IB’s APAC Intelligence Reports. This webinar is designed to equip your organisation with...
Go to
Blog
Odds & Ends: Unraveling the Surebet Playbook
Discover the world of surebets, a strategy that guarantees profits by leveraging differing odds from multiple bookmakers. Explore how this...
Go to
Blog
Group-IB’s GLOCAL Vision Leading The Fight Against Global Cybercrime
How is Group-IB evolving into a leading cybersecurity force that the community relies on?
Go to
Cybersecurity Ultimate Assessment Guide: Part 1. Assessment Compass
Report
Cybersecurity Ultimate Assessment Guide: Part 1. Assessment Compass
Navigate the complexities of modern assessments with Group-IB’s expert-designed guide.
Go to
The Reality of Deception
Blog
The Realty of Deception: Real Estate Frauds Uncovered in the Middle East
Real estate scams are on the rise as fraudsters exploit online platforms to deceive victims into paying for fake properties....
Go to
APAC Intelligence Insights Report, December 2024
Report
APAC Intelligence Insights Report, December 2024
Explore the most notable cybersecurity events and best practices in the Asia-Pacific (APAC) region from December 2024.
Go to
Blog
Beyond AI: Group-IB’s Local Expertise in Fraud Protection
Minimize false positives, proactively prevent threats, and gain customized fraud protection with Group-IB. Our AI-powered solutions are fine-tuned by local...
Go to
Blog
Social Engineering in Action: How Fraudsters Exploit Trust with Fake Refund Schemes in the Middle East
Fraudsters have devised a sophisticated scheme targeting banking customers in the Middle East, impersonating government officials and using remote access...
Go to
Blog
Cyber Predictions For 2025 (and Beyond): Group-IB’s Expert Take On What’s Coming
Don’t fall weak in the face of change and disruption. Review the upcoming cybersecurity changes and become equipped while there’s...
Go to
Reich 5 Android malware gang nabbed
Investigation
Reich 5 Android malware gang nabbed
Group-IB helped to dismantle a hacker group that infected over 340,000 Android devices to steal money from bank accounts. The...
Go to
META Intelligence Insights Report, December 2024
Report
META Intelligence Insights Report, December 2024
Explore the most notable cybersecurity events in the region and the best practices.
Go to
Blog
Patch Me If You Can: The Truth About Smartphone Vulnerabilities
Discover how smartphone manufacturers conceal security flaws, the risks these vulnerabilities pose to users and businesses, and actionable steps to...
Go to
Group-IB x NVISO
Success Story
Group-IB x NVISO
Partnership for high-fidelity threat intelligence to enable next-gen cybersecurity
Go to
LATAM Intelligence Insights Report, December 2024
Report
LATAM Intelligence Insights Report, December 2024
Explore the most notable cybersecurity events in the region and the best practices.
Go to
Operation Delilah
Investigation
Operation Delilah
Operation Delilah was the third in a series of operations supported by Group-IB, providing intelligence on the threat actor’s network,...
Go to
Operation NightFury
Investigation
Operation NightFury
Unravel a remarkable transnational operation where the global law enforcement and cybersecurity service providers, including Group-IB, dismantled the GetBilling JS-sniffer...
Go to
North America Intelligence Insights Report, December 2024
Report
North America Intelligence Insights Report, December 2024
Explore the most notable cybersecurity events in the region and the best practices.
Go to
Falcon: Operation in two acts
Investigation
Falcon: Operation in two acts
Group-IB supported two INTERPOL-led operations, called Falcon I and Falcon II, to stop a business email compromise (BEC) cybercrime gang...
Go to
Group-IB x One of Malaysia’s Fastest-Growing Healthcare Providers
Success Story
Group-IB x One of Malaysia’s Fastest-Growing Healthcare Providers
Discover how Group-IB ensured uncompromised cybersecurity for the healthcare brand, defending it against a ransomware attack and solidifying defenses.
Go to
IDC Spotlight: “The Weakest Link” — Email Security Should Be Your Top Cyberdefense Priority
Report
IDC Spotlight: “The Weakest Link” — Email Security Should Be Your Top Cyberdefense Priority
Discover how to safeguard your organization against phishing, business email compromise attacks, and advanced email threats with insights from IDC’s...
Go to
Trust Hijacked
Blog
Trust Hijacked: The Subtle Art of Phishing Through Familiar Facades
Explore the advanced tactics employed in recent email phishing campaigns targeting employees from over 30 companies across 12 industries and...
Go to
From chaos to clarity: Transforming cyber investigations with Group-IB’s next-gen Graph
Webinar
From chaos to clarity: Transforming cyber investigations with Group-IB’s next-gen Graph
Join our experts for an exclusive session exploring key features of Group-IB’s Graph — a platform that has been re-imagined...
Go to
Group-IB x FIN-CSIRT
Success Story
Group-IB x FIN-CSIRT
Discover how Serbia’s first financial sector CERT used Group-IB’s Attack Surface Management to enhance security, regulatory compliance, and resilience for...
Go to
Group-IB x AVO bank
Success Story
Group-IB x AVO bank
Learn how a new digital bank in Uzbekistan leveraged Group-IB’s multi-layered cybersecurity to ensure secure operations for over 1 million...
Go to
deepfake
Blog
Deepfake Fraud: How AI is Deceiving Biometric Security in Financial Institutions
Group-IB’s Fraud Protection team examines how fraudsters use deepfake technology to bypass biometric security in financial institutions, including facial recognition...
Go to
Intelligence Insights Report, November 2024
Report
Intelligence Insights Report, November 2024
Explore the most notable cybersecurity events in the region and the best practices.
Go to
Shady Bets
Blog
Shady Bets: How to Protect Yourself from Gambling Fraud Online
Scammers are using fake betting game advertisements on social media to target users, with over 500 deceptive advertisements and 1,377...
Go to
Fraud Matrix 1.5 Webinar: New Features You Need to Know
Webinar
Fraud Matrix 1.5 Webinar: New Features You Need to Know
Join us for a live webinar with Dimitry Pisarev, Product Manager of the Group-IB Fraud Matrix, as he unveils the...
Go to
Rethinking investigation
Blog
Rethinking investigation: Group-IB’s Graph takes a leap forward
Go to
Tracing the Path of VietCredCare and DuckTail
Blog
Tracing the Path of VietCredCare and DuckTail: Vietnamese dark market of infostealers’ data
Following the arrest in May 2024 of more than 20 individuals behind Facebook infostealers campaigns in Vietnam, we have compared...
Go to
Unlock Strategic Cyber Intelligence: Group-IB Intelligence Insights Report Webinar
Webinar
Unlock Strategic Cyber Intelligence: Group-IB Intelligence Insights Report Webinar
Join us on December 11th at 2 PM GST for a deep dive into Group-IB’s Intelligence Insights Report, designed to...
Go to
Beyond the Traditional SOC: Intelligence-Driven Security Operations
Webinar
Beyond the Traditional SOC: Intelligence-Driven Security Operations
Join a knowledge-sharing session led by Group-IB experts and learn how to transform Security Operations Centers through intelligence-driven strategies.
Go to
Three years of change: Digital risks in the Middle East and Africa
Report
Three years of change: Digital risks in the Middle East and Africa
Learn about key trends in digital risks over the past three years, the latest techniques used by scammers, and relevant...
Go to
Group-IB x Fawry
Success Story
Group-IB x Fawry
Explore how Group-IB helped Egypt's largest e-payment provider avert a ransomware threat
Go to
Strengthening AML Defenses
Blog
Strengthening AML Defenses: Detect Money Mules During Their ‘Warm-Up’ Phase
Know the need to catch mules early in their operations to protect you from severe risks, including large-scale money laundering,...
Go to
Stealthy Attributes of APT Lazarus
Blog
Stealthy Attributes of Lazarus APT Group: Evading Detection with Extended Attributes
In this blog, we examine a fresh take on techniques regarding concealing codes in Extended Attributes in order to evade...
Go to
Adversary Hunting Code: Uncover and eliminate unknown cyber threats with Group-IB
Report
Adversary Hunting Code: Uncover and eliminate unknown cyber threats with Group-IB
Threats often lurk in the shadows, undetected, until they escalate into full-blown crises. The key to staying protected is to...
Go to
Chase Cyber Threats
Blog
Run from Chase Cyber Threats
Waiting for risks to be presented to you rather than actively hunting them down? After reading this, you might consider...
Go to
APAC Intelligence Insights Report, November 2024
Report
APAC Intelligence Insights Report, November 2024
Explore the most notable cybersecurity events in the Asia-Pacific (APAC) region from November 2024 and the best practices.
Go to
Delivery Deception
Blog
Delivery Deception: Escalating cybercriminal tactics in the Balkan region
Explore our latest findings on the surge of cyberattacks in the Balkan region, focusing on threats to financial institutions and...
Go to
Blog
Group-IB Fraud Protection: Know your real users, catch the fraudsters
Stop fraud, RATs, and malware with Group-IB's Fraud Protection AI. Our advanced behavioral analysis uses AI to detect and prevent...
Go to
Tailor Your Security with Group-IB
Blog
Global iGaming? Tailor Your Security with Group-IB Fraud Protection
With Group-IB Fraud Protection, you can navigate the complexities of global iGaming regulations and risk. Tailor security measures for each...
Go to
Intelligence Insights Report, October 2024
Report
Intelligence Insights Report, October 2024
Explore the most notable cybersecurity events in the region and the best practices.
Go to
fake-wood
Blog
Woodn’t You Believe It? The Rise of Fake Wood Scams
In this blog we uncover a long-running scheme by scammers selling wood to the people in France during the winter...
Go to
Encrypted Symphony
Blog
Encrypted Symphony: Infiltrating the Cicada3301 Ransomware-as-a-Service Group
In this blog, we observed how the Cicada3301 Ransomware-as-a-Service (RaaS) group operates, detailing the workflow of their affiliates within the...
Go to
The firming grip of cyber fraud in Asia
Blog
The firming grip of cyber fraud in Asia: What effective actions must banks take today?
Banks' current measures against cyber fraud are falling short – and the numbers don’t lie. That said, with a hyperactive...
Go to
Operation Distanthill
Investigation
Operation Distanthill
Group-IB took part in Operation DISTANTHILL, which led to the arrest of 16 cybercriminals involved in large-scale Android RAT campaigns...
Go to
Blog
Unveiling USB Artifacts: A Comparative Analysis
Discover how USB artifacts enhance tracking user activities on files, examining the influence of operating systems, file systems, and applications...
Go to
Pig Butchering Blog Banner
Blog
Pig Butchering Alert: Fraudulent Trading App targeted iOS and Android users
In this article, Group-IB specialists uncovered a large-scale fraud campaign involving fake trading apps targeting Apple iOS and Android users...
Go to
APAC Intelligence Insights Report, October 2024
Report
APAC Intelligence Insights Report, October 2024
Explore the most notable cybersecurity events in the Asia-Pacific (APAC) region from October 2024 and the best practices.
Go to
DragonForce blog banner
Blog
Inside the Dragon: DragonForce Ransomware Group
In this blog, we look at the DragonForce ransomware group, which poses a severe threat with two variants—a LockBit fork...
Go to
Storm clouds on the horizon: Resurgence of TeamTNT?
Blog
Storm clouds on the horizon: Resurgence of TeamTNT?
Investigations into recent campaigns may suggest the reemergence of TeamTNT in 2023 to present day, since evaporating in 2022.
Go to
Group-IB dark web investigations blog cover
Blog
Concealed networks: Are dark web syndicates turning to social media for cybercrime?
Group-IB dark web investigations: To avoid prying eyes, find out how adversaries increasingly shift from the dark web to social...
Go to
Intelligence Insights Report, September 2024
Report
Intelligence Insights Report, September 2024
Explore the most notable cybersecurity events in the META region and the best practices in September 2024.
Go to
Ajina blog cover
Blog
Ajina attacks Central Asia: Story of an Uzbek Android Pandemic
Discovered by Group-IB in May 2024, the Ajina.Banker malware is a major cyber threat in the Central Asia region, disguising...
Go to
Carberp gang knocked down
Investigation
Carberp gang knocked down
Exposing the million-dollar hacking group behind large-scale attacks on payment systems.
Go to
Blog Banner PAM blog
Blog
The Duality of the Pluggable Authentication Module (PAM)
The Group-IB DFIR Team has identified a new technique not yet included in the MITRE ATT&CK framework, which could lead...
Go to
lazarus apt malware banner
Blog
APT Lazarus: Eager Crypto Beavers, Video calls and Games
Explore the growing threats posed by the Lazarus Group's financially-driven campaign against developers. We will examine their recent Python scripts,...
Go to
RansomHub Blog Cover
Blog
RansomHub ransomware-as-a-service
Learn why RansomHub's new affiliate program and its advanced ransomware tactics—recruiting former Scattered Spider members, exploiting unprotected RDP services, and...
Go to
Hiding in plain sight_ Techniques and defenses against `_proc` filesystem manipulation in Linux cover blog
Blog
Hiding in plain sight: Techniques and defenses against `/proc` filesystem manipulation in Linux
Group-IB explores methods of process visibility evasion through /proc filesystem manipulation in Linux, along with effective defenses to counteract these...
Go to
META Intelligence Insights Report, August 2024
Report
META Intelligence Insights Report, August 2024
Explore the most notable cybersecurity events in the META region and the best practices.
Go to
Deciphering the Brain Cipher Ransomware blog cover
Blog
Deciphering the Brain Cipher Ransomware
Deep dive into Brain Cipher ransomware group's activities and techniques, and how they are seemingly linked to other ransomware groups...
Go to
The Threat of Compromised Mobile Device Management Credentials
Blog
Under Siege: The threat of compromised Mobile Device Management credentials and its implications for organizational security
The leakage of credentials for Mobile Device Management (MDM) services could pose significant risks to organizations and their data security.
Go to
Blog
NIS 2 compliance for EU businesses: Meet cybersecurity requirements before the deadline (October 17)
With NIS 2 non-compliance proving detrimental — resulting in millions in fines, business activity suspension, and more, become compliant while...
Go to
Beware the RAT: Android Remote Access malware strikes in Malaysia
Blog
Beware CraxsRAT: Android Remote Access malware strikes in Malaysia
CraxsRAT is a notorious Android malware family known for its Remote Administration Tools (RAT), which include remote device control and...
Go to
GXC Team Unmasked
Blog
GXC Team Unmasked: The cybercriminal group targeting Spanish bank users with AI-powered phishing tools and Android malware
Specializing in AI-powered phishing-as-a-service and Android malware capable of intercepting OTP codes, the GXC Team targets Spanish bank users and...
Go to
CYBERSECURITY X AI: Building capabilities to defend assets and defeat attackers
Report
CYBERSECURITY X AI: Building capabilities to defend assets and defeat attackers
There’s no denying it: Artificial intelligence has emboldened and empowered cyber criminals, helping them attack faster, more frequently, and with...
Go to
Intelligence Insights Report, June 2024
Report
Intelligence Insights Report, June 2024
Explore the most notable cybersecurity events in the META region and the best practices.
Go to
Qilin Revisited blog
Blog
Qilin Revisited: Diving into the techniques and procedures of the recent Qilin Ransomware Attacks
Discover the insidious tactics of the Qilin ransomware group, notorious for their $50 million attack on the healthcare sector, impacting...
Go to
Group-IB Digital Risk Protection blog
Blog
Group-IB Digital Risk Protection: How does it enable the fastest violation detection and takedown?
The digital space is riddled with risks to your brand. Ensure it stays defended with Group-IB Digital Risk Protection’s automated...
Go to
Patch or Peril: A Veeam Vulnerability Incident
Blog
Patch or Peril: A Veeam vulnerability incident
Delaying security updates and neglecting regular reviews created vulnerabilities that were exploited by attackers, resulting in severe ransomware consequences.
Go to
Breaking silos: The convergence of cybersecurity and fraud prevention
Blog
Breaking silos: The convergence of cybersecurity and fraud prevention
Where adversaries do not hesitate to initiate blended attacks combining multiple tactics, why are security teams still operating in silos?
Go to
El Dorado Ransomware: The New Golden Empire of Cybercrime?
Blog
Eldorado Ransomware: The New Golden Empire of Cybercrime?
All about Eldorado Ransomware and how its affiliates make their own samples for distribution.
Go to
Boost Your MSSP's Competitive Edge
Blog
Boost your MSSP’s competitive edge: New strategies for leveraging Threat Intelligence
How to best empower your business clients’ cybersecurity with critical cyber threat intelligence
Go to
Investigating in tip-top fashion: TipTop group identified and arrested
Investigation
Investigating in tip-top fashion: TipTop group identified and arrested
Group-IB helped the police take down the largest mobile malware gang in Russia, which had infected more than 800,000 Android...
Go to
Craxs RAT Malware Blog
Blog
Craxs Rat, the master tool behind fake app scams and banking fraud
The scam schemes enabled by Craxs Rat malware provide complete remote control of the victims’ devices. Defend yourself from being...
Go to
Boolka Unveiled: From web attacks to modular malware
Blog
Boolka Unveiled: From web attacks to modular malware
Uncovering the operations of threat actor Boolka, driven by the creation of malicious scripts, malware trojans, sophisticated malware delivery platforms,...
Go to
No-Vax Free: Exposing the real faces behind the fake Green Pass
Investigation
No-Vax Free: Exposing the real faces behind the fake Green Pass
Group-IB helped to expose the cybercriminal gang who offered fake green passes, targeting Italian victims.
Go to
Cron: Overthrown titan
Investigation
Cron: Overthrown titan
Group-IB helped law enforcement to identify and arrest a notorious gang that compromised more than one million devices with Android...
Go to
GoldPickaxe exposed: How Group-IB analyzed the face-stealing iOS Trojan and how to do it yourself
Blog
GoldPickaxe exposed: How Group-IB analyzed the face-stealing iOS Trojan and how to do it yourself
Learn how to protect your devices against evolving iOS threats
Go to
Paunch & The BlackHole Exploit Kit Case
Investigation
Paunch & The BlackHole Exploit Kit Case
Group-IB supported the police in identifying and taking down a malware kingpin who once dominated the exploit kit sales market,...
Go to
Ransomware readiness: From quick wins to long-term strategies
Report
Ransomware readiness: From quick wins to long-term strategies
Check all the key ransomware readiness boxes and shield your infrastructure with Group-IB's industry-proven framework.
Go to
Group-IB x Special Needs School
Success Story
Group-IB x Special Needs School
Learn how Group-IB helped a school to combat ransomware in real time and shored up its defenses against future threats.
Go to
To GenAI or not to GenAI
Blog
Reorienting Cybersecurity: To GenAI or not to GenAI?
Amidst the GenAI revolution, how can you harness its potential to boost cybersecurity?
Go to
Group-IB x Sorint.SEC
Success Story
Group-IB x Sorint.SEC
Know how the joint expertise of Group-IB and Sorint.SEC enhances critical infrastructure security and facilitates the seamless adoption of cybersecurity...
Go to
Blog
GDPR: A shield for consumers, a shackle for fraud fighters?
Does the GDPR, designed to protect customer data, unintentionally create opportunities for cybercriminals to exploit it?
Go to
Hi-Tech Crime Trends 2024 – Latin America
Webinar
Hi-Tech Crime Trends 2024 – Latin America
Join us as we discuss why businesses in the LATAM region are prime targets for exploitation, given the surge in...
Go to
Twin brothers in crime
Investigation
Twin brothers in crime
Group-IB partnered with law enforcement to bring a phishing gang to justice for the first time in Russia. The operation...
Go to
Hi-Tech Crime Trends 2024 – North America
Webinar
Hi-Tech Crime Trends 2024 – North America
Join us as we talk about AI threats, the rise in nation-state threat actors, APT groups, persisting ransomware threats and...
Go to
Hi-Tech Crime Trends 2024 – Asia-Pacific
Webinar
Hi-Tech Crime Trends 2024 – Asia-Pacific
Join us as we talk about why businesses in the region are ripe targets for exploitation, given the surge in...
Go to
Hi-Tech Crime Trends 2024 – Middle East and Africa
Webinar
Hi-Tech Crime Trends 2024 – Middle East and Africa
Join us as we discuss why businesses in the region are ripe targets for exploitation, given the surge in information-stealing...
Go to
Hi-Tech Crime Trends 2024 – Europe
Webinar
Hi-Tech Crime Trends 2024 – Europe
Join us as we discuss why businesses in the region are prime targets for exploitation, given the increase in compromised...
Go to
Generative AI Blog
Blog
Generative AI: Raising the stakes for fraud in iGaming
Fraudsters see potential in generative AI to defraud the gambling industry. Here’s how.
Go to
Blog
Phishy Business: Unraveling LabHost’s scam ecosystem
Group-IB takes part in a global operation to cripple Canadian Phishing-as-a-Service provider LabHost
Go to
Hunting Rituals
Blog
Hunting Rituals #4: Threat hunting for execution via Windows Management Instrumentation
Actionable insights on hunting for Windows Management Instrumentation (WMI) execution abuse
Go to
Pegasus and other spyware
Blog
In-Depth Analysis of Pegasus Spyware and How To Detect It on Your Mobile Devices
Pegasus infects mobile devices through zero-click exploits and silently harvests messages, calls, location, and microphone access. Learn how the spyware...
Go to
The Reconnaissance Handbook: Map and mitigate intrusion pathways into your network
Report
The Reconnaissance Handbook: Map and mitigate intrusion pathways into your network
As adversaries use reconnaissance to plot their attacks against you, discover how you can leverage the same process to thwart...
Go to
Operation Lyrebird
Investigation
Operation Lyrebird
Group-IB supported INTERPOL in disrupting a prolific cybercriminal’s activities - codenamed Lyrebird. This effort led to the identification and apprehension...
Go to
Shooting down in flames: tactical guide to outrun ransomware groups
Webinar
Shooting down in flames: tactical guide to outrun ransomware groups
Watch a critical session by Group-IB's DFIR experts, as they shed light on the latest ransomware tactics seen in the...
Go to
Hi-Tech Crime Trends 2023/2024 – Global
Report
Hi-Tech Crime Trends 2023/2024 – Global
Discover the Group-IB’s annual threat research to discover the global cybersecurity landscape and get region-tailored insights.
Go to
Hi-Tech Crime Trends 2023/2024 – Latin America
Report
Hi-Tech Crime Trends 2023/2024 – Latin America
Discover Group-IB’s unmatched annual report delivering valuable findings related to the Latin American region
Go to
Hi-Tech Crime Trends 2023/2024 – Middle East and Africa
Report
Hi-Tech Crime Trends 2023/2024 – Middle East and Africa
Dive into Group-IB’s comprehensive report sharing facts, data, findings, and our takes on these findings related to the Middle East
Go to
Hi-Tech Crime Trends 2023/2024 – Europe
Report
Hi-Tech Crime Trends 2023/2024 – Europe
Discover Group-IB’s unparalleled annual report calibrated by the latest findings related to the European region
Go to
Hi-Tech Crime Trends 2023/2024 – Asia-Pacific
Report
Hi-Tech Crime Trends 2023/2024 – Asia-Pacific
Discover Group-IB’s unmatched annual report fine-tuned by the latest insights related to the Asia-Pacific region
Go to
Hi-Tech Crime Trends 2023/2024 – North America
Report
Hi-Tech Crime Trends 2023/2024 – North America
Explore Group-IB’s unmatched annual report delivering actionable cybersecurity insights related to the North American region
Go to
The Fraud Family Case
Investigation
The Fraud Family Case
Group-IB partnered with the Dutch National Police to uncover critical details about the criminal syndicate - the Fraud Family and...
Go to
Blog
Extra credit: VietCredCare information stealer takes aim at Vietnamese businesses
Group-IB discovers new information stealer targeting Vietnam with rare functionality to filter out Facebook accounts with advertising credits
Go to
Blog
Face Off: Group-IB identifies first iOS trojan stealing facial recognition data
Group-IB uncovers the first iOS Trojan harvesting facial recognition data used for unauthorized access to bank accounts. The GoldDigger family...
Go to
Frost & Sullivan’s 2023 Competitive Strategy Leadership Award
Report
Frost & Sullivan’s 2023 Competitive Strategy Leadership Award
Gain unmatched localized cybersecurity with Group-IB's award-winning decentralized model and tailored cyber-fraud framework.
Go to
Fraud and Online Scams Trends – December 2023
Webinar
Fraud and Online Scams Trends – December 2023
In this short video we explore the latest scams, regulatory updates, and the key challenges facing the industry.
Go to
ResumeLooters gang
Blog
Dead-end job: ResumeLooters infect websites in APAC through SQL injection and XSS attacks
ResumeLooters gang infects websites with XSS scripts and SQL injections to vacuum up job seekers' personal data and CVs
Go to
Gartner® Report: Emerging Tech: Security — Cyber-Fraud Fusion Is the Future of Online Fraud Detection
Report
Gartner® Report: Emerging Tech: Security — Cyber-Fraud Fusion Is the Future of Online Fraud Detection
In the rapidly evolving landscape of online fraud, traditional fraud detection methods can’t keep up. Read the report by Gartner...
Go to
Phishing Store Shutdown
Investigation
Phishing Store Shutdown
Group-IB made a significant contribution to an international crime fighting operation involving INTERPOL and national law enforcement agencies from Indonesia,...
Go to
Operation Dragon Eye
Investigation
Operation Dragon Eye
Group-IB played a crucial role in identifying the individual behind the Dragon botnet, which was responsible for relentless distributed denial-of-service...
Go to
Operation Dating Disaster
Investigation
Operation Dating Disaster
Group-IB played a major role in identifying members of CybSec Group, which was engaged in extortion and DDoS attacks on...
Go to
Blog
Inferno Drainer: A Deep Dive into Crypto Wallet-Draining Malware
Inferno Drainer may have shut down in November 2023, but users of the devastating scam-as-a-service platform still pose a risk...
Go to
The Art of SOC
Report
The Art of SOC
Ultimate guide to establishing and evolving intelligence-driven security operations with Group-IB SOC Framework
Go to
Fraud and Online Scams Trends – November 2023
Webinar
Fraud and Online Scams Trends – November 2023
In this digest, we cover the newest scam schemes, regulatory updates, and industry challenges to keep you posted and your...
Go to
Hunting Rituals
Blog
Hunting Rituals #3: Threat hunting for scheduled tasks
Actionable guide to hunting for the scheduled tasks by using Group-IB MXDR
Go to
Blog
The future is now: Watch out for these 20 trends that will change the course of cybersecurity (Part 2)
Cybersecurity is changing, and changing fast. Learn how Group-IB can help you lead the change instead of being carried by...
Go to
Blog
The future is now: Watch out for these 20 trends that will change the course of cybersecurity (Part 1)
Cybersecurity is changing, and changing fast. Learn how Group-IB can help you lead the change instead of being carried by...
Go to
Blog
You versus adversaries: How to become unbeatable in 20 cybersecurity moves (Part 2)
Cybersecurity essentials that ensure your business stays undisrupted in the upcoming year.
Go to
Blog
Ace in the Hole: exposing GambleForce, an SQL injection gang
Analysis of TTPs tied to GambleForce, which carried out SQL injection attacks against companies in the APAC region
Go to
Fraud and Online Scams Trends – October 2023
Webinar
Fraud and Online Scams Trends – October 2023
In this video, we will discuss the cases researched at Group-IB, active threats, and the most pressing challenges related to...
Go to
Blog
You versus adversaries: How to become unbeatable in 20 cybersecurity moves (Part 1)
Cybersecurity essentials that will ensure your business stays undisrupted in the upcoming year.
Go to
Blog
Curse of the Krasue: New Linux Remote Access Trojan targets Thailand
This piece of malware has an insatiable appetite. Group-IB's Threat Intelligence unit offers their insights on the new RAT used...
Go to
Current Cyber Threats in the Middle East Region
Webinar
Current Cyber Threats in the Middle East Region
Learn how Group-IB’s joint initiative with CORVIT will help cybersecurity professionals and leaders in cyber activity within the MEA region.
Go to
Hunting Rituals
Blog
Hunting Rituals #2.2: Threat hunting for abuse of Windows Services
Actionable guide to hunting for the Windows Services abuse by using Group-IB MXDR.Part 2: Execution of Windows Services
Go to
Group-IB x Libertex Group
Success Story
Group-IB x Libertex Group
Explore how Group-IB helped Libertex Group stay ahead of emerging cyber risks and strengthen its security posture with proactive and...
Go to
Fraud and Online Scam Trends – September 2023
Webinar
Fraud and Online Scam Trends – September 2023
In this video, we will discuss the cases researched at Group-IB, active threats, and the most pressing challenges related to...
Go to
Investigation into farnetwork cover
Blog
Ransomware manager: Investigation into farnetwork, a threat actor linked to five strains of ransomware
Take a deep dive into the operations of one of the most active players in the Ransomware-as-a-Service market.
Go to
Cybersecurity Space: Analytics, Threats, and Solutions
Webinar
Cybersecurity Space: Analytics, Threats, and Solutions
Access exclusive insights from our top-rated Threat Intelligence team on recent cyber threats and how Group-IB can safeguard your sector,...
Go to
Blog
The untold story of incident response: Insider’s Gambit
Get a close look at details of the most notable cases faced by Group-IB’s Digital Forensics and Incident Response (DFIR)...
Go to
Blog
Analyzing cyber activity surrounding the conflict in the Middle East
Hacktivists take center stage with DDoS, defacement attacks – summary of Week 1 and 2 of the conflict. The blog...
Go to
Blog
The untold story of incident response: A Christmas Miracle
Twas the night before Christmas, when out came the cry, a cyberattack is happening, so stop them, won’t you try?
Go to
Blog
Let’s dig deeper: dissecting the new Android Trojan GoldDigger with Group-IB Fraud Matrix
Delve into the tactics of the GoldDigger Trojan and discover ways to safeguard your customers
Go to
Group-IB x Security Lab
Success Story
Group-IB x Security Lab
Learn how innovative solutions and joint expertise helped a MSSP provider enhance customer protection
Go to
Blog
Dusting for fingerprints: ShadowSyndicate, a new RaaS player?
No sleep until the Cybercrime Fighters Club is done with finding the answer as to who is behind this new...
Go to
Blog
It’s a trap: Detecting a cryptominer on a popular website using Group-IB MXDR
Group-IB analysts discovered and analyzed a cryptojacking campaign on a popular educational resource using Group-IB Managed XDR.
Go to
Hunting Rituals
Blog
Hunting Rituals #2: Threat hunting for abuse of Windows Services
Actionable guide to hunting for the Windows Services abuse by using Group-IB MXDR.Part 1: Creation/modification of Windows Services
Go to
Group-IB x Tier-1 Global Bank
Success Story
Group-IB x Tier-1 Global Bank
Explore how Group-IB’s real-time Threat Intelligence and defense-driven solutions helped solve modern cybersecurity challenges for a global bank and bolster...
Go to
Blog
Incident Response through an opportunity lens: In conversation with Dmitry Volkov (CEO, Group-IB)
Gather valuable insights on how incident response can be a make-or-break factor in securing your business.
Go to
Blog
From Rags to Riches: The illusion of quick wealth in investment scams
Group-IB Digital Risk Protection uncovers malicious campaign leveraging almost 900 scam pages with potential financial damage estimated at $280,000 over...
Go to
W3LL done: uncovering hidden phishing ecosystem driving BEC attacks
Report
W3LL done: uncovering hidden phishing ecosystem driving BEC attacks
Access untapped details into the scope and sophistication of the W3LL’s BEC-focused criminal enterprise
Go to
Respond Like A Rockstar: The Group-IB Advantage in Incident Response for APAC
Webinar
Respond Like A Rockstar: The Group-IB Advantage in Incident Response for APAC
Learn how Group-IB’s Incident Response team helps you fight real cybercriminals in the APAC region.
Go to
Blog
Stealing the extra mile: How fraudsters target global airlines in air miles and customer service scams
Uncover the vulnerabilities crippling the airline industry and learn how to implement appropriate countermeasures
Go to
Blog
New hierarchy, heightened threat: Classiscam’s sustained global campaign
The automated scam-as-a-service program designed to steal your money and data is still going strong four years after launch
Go to
Beyond OWASP Top 10: The ultimate guide to web application security (2023 and onwards)
Report
Beyond OWASP Top 10: The ultimate guide to web application security (2023 and onwards)
Leverage the latest OWASP list combined with Group-IB experts’ manual analysis techniques to identify, prioritize and thwart the most critical...
Go to
Blog
Traders’ dollars in danger: CVE-2023-38831 zero-day vulnerability in WinRAR exploited by cybercriminals to target traders
Spoof extensions help cybercriminals target users on trading forums as 130 devices still infected at time of writing
Go to
Hunting Rituals
Blog
Hunting Rituals #1: Threat hunting for DLL side-loading
Actionable guide to hunting for the DLL side-loading threat by using Group-IB MXDR.
Go to
Group-IB x Oris Lab
Success Story
Group-IB x Oris Lab
Learn how this blockchain fintech company improved its security posture through penetration testing.
Go to
Blog
Breaking down Gigabud banking malware with Group-IB Fraud Matrix
Uncover the disruptive nature of Gigabud malware and take proactive measures to mitigate the associated risks
Go to
Blog
JOIN THE CYBERCRIME FIGHTERS CLUB
Fighting cybercrime is more effective when we work together. Find out more about how you can work with Group-IB to...
Go to
Blog
Demystifying Mysterious Team Bangladesh
Analysis of a highly active hacktivist group with global reach
Go to
Panel discussion “Cybersecurity Landscape in the Middle East”
Webinar
Panel discussion “Cybersecurity Landscape in the Middle East”
Explore Middle East's ever-evolving cyber security landscape with experts. Watch the insightful webinar recording now to uncover the latest threats,...
Go to
Digital Risk Trends 2023
Report
Digital Risk Trends 2023
Explore the most dangerous risks for brands and learn how to mitigate them
Go to
Blog
Clouded Judgment: how mismanaged cloud infrastructure can expose users to cyber risks
Discover how organizations unwittingly create vulnerabilities by misconfiguring their cloud infrastructure
Go to
Group-IB x Digital Wealth Management Platform
Success Story
Group-IB x Digital Wealth Management Platform
Learn how Group-IB’s Digital Risk Protection uncovered a sophisticated fraud network behind a suspicious resource.
Go to
Group-IB x OSOM
Success Story
Group-IB x OSOM
Discover how our web application security analysis service provides a thorough assessment of vulnerabilities, attack vectors, and security mechanisms.
Go to
Respond like a Rockstar (French version)
Webinar
Respond like a Rockstar (French version)
Faites connaissance avec l’équipe de digital forensics et de réponse aux incidents de Group-IB, qui lutte contre la cybercriminalité et...
Go to
Blog
Busting CryptosLabs: a scam ring targeting French speakers for millions
Get all the undisclosed details that our investigators uncovered on CryptosLabs' full scope of fraudulent schemes
Go to
Group-IB Fraud Day (French)
Webinar
Group-IB Fraud Day (French)
Nous continuons nos webinar Fraud Intel, cette fois dédiée à la région africaine.
Go to
Rispondi come una Rockstar!
Webinar
Rispondi come una Rockstar!
Scopri come il gruppo di Digital Forensics e Incident Response di Group-IB combatte i criminali informatici allo scopo di aiutare...
Go to
Blog
Operation Triangulation: Mapping the threat
What we know about APT campaign to date and how to detect it
Go to
Blog
Dark Pink. Episode 2
APT Dark Pink is back with 5 victims in new countries.
Go to
Blog
Bridging the gap: How to leverage API security best practices to combat top 3 vulnerability types
Security misconfiguration, excessive data exposure, and injections top three API vulnerability types for financial and tech firms
Go to
Investment Scam in Europe Video
Webinar
Investment Scam in Europe Video
The classic type of scams that increased with the new, easy-to-use broker applications, NFTs, crypto trading platforms, and more.
Go to
Respond like a Rockstar (English)
Webinar
Respond like a Rockstar (English)
How Group-IB's Incident Response Team fights against real cyber criminals during incident engagements around the MEA region.
Go to
Respond like a Rockstar (Arabic version)
Webinar
Respond like a Rockstar (Arabic version)
How to effectively stop security incidents in the region.
Go to
Blog
The distinctive rattle of APT SideWinder
Bridewell and Group-IB expose the APT’s unknown infrastructure
Go to
Mastering Attack Surface Management for Resilient Cyber Defense
Webinar
Mastering Attack Surface Management for Resilient Cyber Defense
How Group-IB unifies Attack Surface Management, Digital Risk Protection, Threat Intelligence to complement intelligence
Go to
Blog
The Qilin Ransomware: Analysis and Protection Strategies
All you need to know about Qilin ransomware and its operations targeting critical sectors.
Go to
Blog
Managed upgrades. Enhance malware analysis efficiency with Group-IB Malware Detonation Platform updates
New and modified malware detonation capabilities in Group-IB’s Managed XDR and Business Email Protection solutions for precise threat detection and...
Go to
Blog
Tech (non)support: Scammers pose as Meta in Facebook account grab ploy
Group-IB Digital Risk Protection discovers more than 3,200 fake Facebook profiles in ongoing phishing campaign that sees scammers impersonate Meta...
Go to
Blog
Investigation into PostalFurious: a Chinese-speaking phishing gang targeting Singapore and Australia
How to investigate phishing campaigns
Go to
Blog
SimpleHarm: Tracking MuddyWater’s infrastructure
Group-IB analysts discovered the new MuddyWater infrastructure while researching the pro-state group’s use of the legitimate SimpleHelp tool.
Go to
Blog
The old way: BabLock, new ransomware quietly cruising around Europe, Middle East, and Asia
Group-IB uncovers a new stealthy ransomware strain
Go to
Blog
36gate: supply chain attack
What is known about the 3CX supply chain incident and how to defend against it?
Go to
Fraud Day Africa 2023
Webinar
Fraud Day Africa 2023
Fraud Intel Series is dedicated to the African region.
Go to
Blog
Venomous vacancies: Job seekers across MEA hit by sting in scammers’ tail
Group-IB uncovers more than 2,400 scam job pages in ongoing campaign targeting users in Egypt, KSA, Algeria, and 10 other...
Go to
Blog
Bleak outlook: Mitigating CVE-2023-23397
Microsoft Outlook Elevation of Privilege Vulnerability
Go to
Blog
Bad Behaviour: How to detect banking trojans
Mobile banking users are being manipulated by attackers to authorize fraudulent transactions. Learn what financial service providers can do to...
Go to
Blog
Package deal: Malware bundles causing disruption and damage across EMEA
What happens when you combine ransomware with information stealers, remote access Trojans, and other malware in one easy-to-download package?
Go to
Old Snake, New Skin: Analysis of SideWinder APT activity in 2021
Report
Old Snake, New Skin: Analysis of SideWinder APT activity in 2021
Group-IB Threat Intelligence team uncovered a previously undocumented spear phishing campaign carried out by APT SideWinder between June and November...
Go to
Blog
Nice Try Tonto Team
How a nation-state APT attempted to attack Group-IB
Go to
Blog
Know Thy Enemy: unraveling the “Hi-Tech Crime Trends 2022/2023” report
Which cybercrimes will dominate the threat landscape for 2023 and beyond? Find out!
Go to
Hi-Tech Crime Trends 2022/2023
Report
Hi-Tech Crime Trends 2022/2023
Benefit from Group-IB’s flagship cybersecurity report and explore the current threat landscape trends and forecasts
Go to
Blog
Dark Pink
New APT hitting Asia-Pacific, Europe that goes deeper and darker
Go to
Blog
Godfather Trojan – mobile banking malware that is impossible to refuse
Group-IB discovers banking Trojan targeting users of more than 400 apps in 16 countries
Go to
Blog
Scam-free Christmas
8 online scams to protect your customers from
Go to
The financial sector VS Fraud
Report
The financial sector VS Fraud
Keep up with the biggest threats to the financial sector and learn how to counteract them
Go to
Threat Intelligence: Insights for pre-emptive strategies against cyber adversaries
Report
Threat Intelligence: Insights for pre-emptive strategies against cyber adversaries
Download a new Frost & Sullivan report to learn how to approach cybersecurity proactively and incentivize business growth with the...
Go to
Webinar
OPERA1ER – How millions were stolen from banks
Get insights on efficient defense against OPERA1ER’s attacks
Go to
Uncovering the Attack Surface
Report
Uncovering the Attack Surface
An analysis of attack surface risks for a sample of major financial services providers in 3 global regions
Go to
Blog
Understanding Money Mules: The Hidden Link in Cybercrime
A money mule is someone who moves stolen funds across bank accounts on behalf of cybercriminals. Learn how money mules...
Go to
Blog
Hired hand: Scammers mimic Saudi manpower provider
Group-IB uncovers one thousand (and one) fake domains part of a scam campaign targeting users in KSA
Go to
OPERA1ER: Ceux qui jouent à Dieu sans y avoir été autorisés
Report
OPERA1ER: Ceux qui jouent à Dieu sans y avoir été autorisés
Le groupe, équipé seulement d’outils « prêts à l’emploi », est parvenu à dérober des millions à des opérateurs de...
Go to
Blog
Armés et dangereux : une soif d’argent inextinguible L’APT OPERA1ER en Afrique
En 2019, l'équipe Threat Intelligence de Group-IB a détecté une série d'attaques ciblant des organisations financières en Afrique.
Go to
Blog
Financially motivated, dangerously activated: OPERA1ER APT in Africa
The French-speaking gang managed to carry out over 30 successful attacks on banks, financial services and telecommunications companies, mainly located...
Go to
OPERA1ER: Playing God Without Permission
Report
OPERA1ER: Playing God Without Permission
The group relied solely on known “off-the-shelf” tools to steal millions from financial service and telecommunications companies. In total they...
Go to
Blog
Treasure trove. Alive and well point-of-sale malware
Analysis of months-long MajikPOS and Treasure Hunter campaign that infected dozens of terminals
Go to
OldGremlin Ransomware: Never Ever Feed Them after The Locknight
Report
OldGremlin Ransomware: Never Ever Feed Them after The Locknight
The case of OldGremlin illustrates how the ransomware industry has evolved in recent years. In this report, you will find...
Go to
Blog
Deadbolt ransomware decryption: unlock your data
The Group-IB Incident Response Team investigated an incident related to a DeadBolt attack and analyzed a DeadBolt ransomware sample
Go to
Blog
Scam is rising
With well-set digital marketing campaigns and professional call-centres
Go to
Group-IB x IHS Teknoloji
Success Story
Group-IB x IHS Teknoloji
Learn how IHS Teknoloji found the perfect fraud protection partner in Group-IB, meeting all their technical requirements, excelling in performance...
Go to
Webinar
Introduction à Fraud Protection
Découvrez la protection contre la fraude lors de notre webinaire introductif et protégez efficacement votre entreprise contre les activités frauduleuses.
Go to
Blog
Take control of your shadow IT
How Group-IB Attack Surface Management ensures full mastery of your external attack surface
Go to
Blog
Letting off steam
Hackers use the browser-in-the-browser technique to steal Steam accounts
Go to
The 5 Step Guide to Making Your MDR More Efficient
Report
The 5 Step Guide to Making Your MDR More Efficient
Ultimate guide on how to optimize your managed detection and response offering and SOC activity.
Go to
Blog
Roasting 0ktapus: The phishing campaign going after Okta identity credentials
Over 130 organizations have been compromised in a sophisticated attack using simple phishing kits
Go to
Blog
APT41 World Tour 2021 on a tight schedule
4 malicious campaigns, 13 confirmed victims, and a new wave of Cobalt Strike infections
Go to
Blog
Switching side jobs
Links between ATMZOW JS-sniffer and Hancitor
Go to
Blog
Challenge accepted
Detecting MaliBot, a fresh Android banking trojan, with a Fraud Protection solution
Go to
The Global State of Scams Report 2022
Report
The Global State of Scams Report 2022
Defacing the actual nature of current online scams - an underreported and adverse impact of the global pandemic. Also, know...
Go to
Blog
Fake investment scams in Europe
How we almost got rich
Go to
Blog
Under the Hood. Group-IB Managed XDR
What Group-IB’s new all-in-one solution offers: cybersecurity management, network event analysis, and lightning-fast stops to attacks
Go to
Demystifying Classiscam
Report
Demystifying Classiscam
Deep dive into where the scheme started, how it works and evolves. Learn more about one of the most popular...
Go to
Fraud Intel Series by Group-IB Fraud Protection
Webinar
Fraud Intel Series by Group-IB Fraud Protection
This event was created in collaboration with our experts working hard to equip you with the must-have knowledge about the...
Go to
Webinar
Partner fireside talk: Mitigating risk with Group IB Digital Risk
Dmitriy Tiunkin, Head of Digital Risk Protection at Group-IB Europe, talks about the current scam landscape, presents the latest technologies...
Go to
Blog
Group-IB introduces the Unified Risk Platform
Group-IB’s platform allows organizations to overcome cyber risks
Go to
Blog
We see you, Gozi
Hunting the latest TTPs used for delivering the Trojan
Go to
Conti Armada: The ARMattack Campaign
Report
Conti Armada: The ARMattack Campaign
Take a deep dive into “ARMattack”, one of the shortest yet most successful campaigns by the Russian-speaking ransomware group Conti....
Go to
Blog
“We find many things that others do not even see”
Nikita Rostovtsev on current cyber threats and his profession
Go to
Blog
Thousands of IDs exposed in yet another data breach in Brazil
Unsecured public-facing database allowed anyone to access ID selfies for months
Go to
Webinar
Digital Risk Summit 2022
The event brings together independent analysts and researchers, a variety of cybersecurity specialists, as well as representatives of different industries...
Go to
Blog
Swiss Army Knife Phishing
Group-IB identifies massive campaign capable of targeting clients of major Vietnamese banks
Go to
Ransomware Insights 2021-2022
Webinar
Ransomware Insights 2021-2022
What does it take to effectively repel a ransomware attack? Learn how to expose ransomware movements and make it harder...
Go to
Group-IB x Maggioli Group
Success Story
Group-IB x Maggioli Group
Learn how Group-IB Attack Surface Management helped Maggioli Group enhance client security by providing comprehensive visibility into external IT assets...
Go to
Blog
SideWinder.AntiBot.Script
APT SideWinder’s new tool that narrows their reach to Pakistan
Go to
Aite-Novarica Group Named Group-IB the Largest and Most Experienced IRR Provider
Report
Aite-Novarica Group Named Group-IB the Largest and Most Experienced IRR Provider
The Aite-Novarica Group 2022 Incident Response Retainer Services report recognized Group-IB as one of the top IRR service firms in...
Go to
Aite-Novarica Group Named Group-IB the Largest and Most Experienced IRR Provider
Report
Aite-Novarica Group Named Group-IB the Largest and Most Experienced IRR Provider
The Aite-Novarica Group 2022 Incident Response Retainer Services report recognized Group-IB as one of the top IRR service firms in...
Go to
Aite-Novarica Group Named Group-IB the Largest and Most Experienced IRR Provider
Report
Aite-Novarica Group Named Group-IB the Largest and Most Experienced IRR Provider
The Aite-Novarica Group 2022 Incident Response Retainer Services report recognized Group-IB as one of the top IRR service firms in...
Go to
Fraud Hunting Day APAC – Act II – 2022
Webinar
Fraud Hunting Day APAC – Act II – 2022
Hindsight, Deep Dive and Moving Forward
Go to
Ransomware Uncovered 2021/2022
Report
Ransomware Uncovered 2021/2022
The well-known complete guide to the latest tactics, techniques, and procedures of ransomware operators based on MITRE ATT&CK®
Go to
A Guide to Cyber Threats Targeting the Financial Sector
Report
A Guide to Cyber Threats Targeting the Financial Sector
Learn why cyber threats are one of the biggest business risks for the financial sector
Go to
Blog
Old Gremlins, new methods
Russian-speaking ransomware gang OldGremlin resumes attacks in Russia
Go to
Blog
Scammers make off with $1.6 million in crypto
Fake giveaways hit bitcoiners again. Now on YouTube
Go to
Blog
Mitigating Spring4Shell with Group-IB
What we know about Spring4Shell so far
Go to
Arms race: Fraudster use of neural network technology
Webinar
Arms race: Fraudster use of neural network technology
Needless to mention, as a region rich on natural resources, the Middle East is inevitably attractive to investors. But what...
Go to
Blog
Empty Box
Group-IB unveils three groups of fraudsters behind delivery scams in Singapore
Go to
Webinar
Threat Hunting Day APAC
Hunting for signs of impending ransomware attacks in enterprise environment.
Go to
Blog
Lost & Found: Group-IB Unveils Attack Surface Management (ex. AssetZero)
Intelligence-Driven Attack Surface Management
Go to
Webinar
Cyber Response Chain
A framework for security professionals to manage risk and respond to threats.
Go to
Group-IB x Banca Mediolanum
Success Story
Group-IB x Banca Mediolanum
Learn how Group-IB Attack Surface Management helped Banca Mediolanum streamline asset discovery and vulnerability management by automating the identification of...
Go to
Blog
Top 5 recommendations for preventing ransomware for 2022
With ransomware attacks on the rise, companies need to take a proactive approach to security. Group-IB has put together a...
Go to
Fraud Hunting Day APAC
Webinar
Fraud Hunting Day APAC
Discover Group-IB Fraud Hunting Day: our experts shared the latest fraud hunting techniques, use cases, and talked about different types...
Go to
Blog
Cleaning the atmosphere
Weak points in modern-day corporate email security
Go to
Blog
Shedding light on the dark web
Cybersecurity analyst's guide on how to use machine learning to show cybercriminals' true colors
Go to
Blog
Mitigating Log4Shell in Log4j with Group-IB
Group-IB's recommendations to mitigate this vulnerability and protect your organization.
Go to
Blog
How MITRE ATT&CK® helps users of Threat Intelligence
The MITRE ATT&CK® framework became the industry standard to describe attack tactics and techniques.
Go to
Blog
Ready-made fraud
Behind the scenes of targeted scams
Go to
Blog
Inside the Hive
Deep dive into Hive RaaS, analysis of latest samples
Go to
Webinar
Still the Number 1 cyber threat – CyberCrimeCon 2021
Get a broad overview of the ransomware market and learn more about its latest developments in CyberCrimeCon 2021 video presentation.
Go to
Webinar
Unexpected guests – CyberCrimeCon 2021
Group-IB Threat Intelligence Head Dmitry Shestakov presentes a report titled “Unexpected guests: who is selling access to your network” that...
Go to
Webinar
The rise and fall of The Fraud Family – CyberCrimeCon2021
Anton Ushakov and Roberto Martineztell told about cybercriminal syndicate Fraud Family that developed, sold and rented sophisticated phishing frameworks to...
Go to
Webinar
EvilCorp – CyberCrimeCon 2021
Learn more about Evil Corp (EC), an advanced cybercrime operations cluster, in Antonio Pirozzi presentation on CyberCrimeCon 2021.
Go to
Webinar
Carding Action, a joint effort combating online fraud – CyberCrimeCon 2021
Rosal Cosano presented on the importance of public-private partnerships in tackling cybercrime around the world, particularly in fighting online and...
Go to
Webinar
Zero trust why trust – CyberCrimeCon 2021
Meet Craig Jones, INTERPOL's Cybercrime Director at CyberCrimeCon 2021. Explore his presentation as he works to reduce cybercrime's global impact...
Go to
Webinar
Hi-Tech Crime Trends 2021-2022 – CyberCrimeCon 2021
To provide a comprehensive picture of modern cybercrime, Group-IB experts have prepared annual cyber threat reports. Learn more in Dmitry...
Go to
Webinar
Group-IB Mission and Principles – CyberCrimeCon 2021
Group-IB CEO Dmitry Volkov opened CyberCrimeCon21!
Go to
Webinar
Hacking the pandemic most popular software – CyberCrimeCon 2021
Security Researcher at Computest Thijs Alkemade will share his findings about hacking the pandemic's most popular software — Zoom.
Go to
Webinar
Attacking Java Deserialization – CyberCrimeCon 2021
Senior Security Researcher at VNPT Cyber Immunity Quynh Le will shares her findings about attacks on #Java deserialization.
Go to
Webinar
The Art of Cyberwarfare – CyberCrimeCon 2021
Group-IB Senior Malware Analyst Dmitry Kupin analyzes espionage campaigns of Chinese state-sponsored APT groups in APAC.
Go to
Webinar
Master of Disguise – CyberCrimeCon 2021
Denis Kuvshinov, the head of CTI Group at Positive Technologies, shares with you details on the newly discovered APT group...
Go to
Webinar
APT41 2021 World Tour – CyberCrimeCon 2021
Group-IB APT Research Analyst Nikita Rostovcev shares his findings on the notorious APT41 group and its recent “world tour,” during...
Go to
Webinar
APT Cobalt Strike Campaign – CyberCrimeCon 2021
Ladislav Baco, Senior Security Consultant and Malware Analyst, shares his findings about APT campaign targeting European governments, diplomats, individuals and...
Go to
Webinar
Kill One, Kill All – CyberCrimeCon 2021
Cyber Threat Intelligence Manager at CyberSOC Africa Olakanmi Oluwole introduces you to the African and Nigerian Threat Landscape and tells...
Go to
Hi-Tech Crime Trends 2021/2022. Scams and Phishing: The Epidemic of Online Fraud
Report
Hi-Tech Crime Trends 2021/2022. Scams and Phishing: The Epidemic of Online Fraud
New fraud technologies & an analysis of schemes, tools and infrastructure
Go to
Hi-Tech Crime Trends 2021/2022. Big Money: Threats to Financial Sector
Report
Hi-Tech Crime Trends 2021/2022. Big Money: Threats to Financial Sector
A look at the cyber threat landscape: ransomware attacks, carding activity, network access sales, phishing and scams.
Go to
Hi-Tech Crime Trends 2021/2022. Corporansom: Threat Number One
Report
Hi-Tech Crime Trends 2021/2022. Corporansom: Threat Number One
The history and analysis of affiliate programs and trends in the ransomware market.
Go to
Hi-Tech Crime Trends 2021/2022. Uninvited Guests: The Sale of Access to Corporate Networks
Report
Hi-Tech Crime Trends 2021/2022. Uninvited Guests: The Sale of Access to Corporate Networks
Analysis of dark web forums to understand the sale of access to compromised infrastructure.
Go to
RedCurl: The Awakening
Report
RedCurl: The Awakening
Commercial cyber espionage remains a rare and largely unique phenomenon. We cannot rule out, however, that RedCurl’s success could lead...
Go to
Blog
The Darker Things
BlackMatter and their victims
Go to
Blog
Cannibal Carders
Group-IB uncovers largest networks of fake shops – phishing websites disguised as card shops
Go to
Webinar
Australian Latest Trends on Threat Intelligence
Group-IB teams up with Virtual Vendors in Australia and New Zealand to deliver local companies rock solid cyber defense.
Go to
Webinar
The Total Economic Impact of Group-IB Threat Intelligence
Cost savings and business benefits enabled by Threat Intelligence
Go to
Webinar
Incident Response Preparedness: A hard look at the statistics
Many organizations believed that they had an effective security program and incident response solutions. However, statistics prove otherwise.
Go to
Blog
Scamdemic outbreak
Scammers attack users in Middle Eastern countries
Go to
Blog
RUNLIR – phishing campaign targeting Netherlands
Phishers take an approach to bypass security controls never seen in the country
Go to
Digital risks 2021: Scam trends and projections in APAC region
Webinar
Digital risks 2021: Scam trends and projections in APAC region
Kamo Basentsyan, Digital Risk Protection and Anti-piracy Development Director, APAC, and Shafique Dawood, Head of Sales and Development, APAC, share...
Go to
Webinar
Building a customer-centric approach to fraud prevention
Webinar hosted by Group-IB with Sanny Mok, Consultant at Forrester and Kadir Yüceer, CEO at IHS Teknolojilearn, to hear first-hand...
Go to
Webinar
The evolution of threats in Bahrain
Stay ahead of evolving threats in Bahrain with our webinar, as we delve into the dynamic landscape of cybersecurity challenges,...
Go to
Digital risks 2021: Scam trends and projections in MEA region
Webinar
Digital risks 2021: Scam trends and projections in MEA region
Ashraf Koheil, Regional Sales Director (MEA & Turkey), and Igor Stolyarov, Head of Digital Risk Protection (MEA), share valuable insights...
Go to
Blog
Under the hood. Group-IB Threat Intelligence. Part 2
How we make Tailored Threat Intelligence
Go to
Blog
Bold ad campaign
AWC joins illicit carding business by offering 1 Mln compromised cards for free
Go to
Blog
It’s alive!
The story behind the BlackMatter ransomware strain
Go to
Blog
Prometheus TDS
The key to success for Campo Loader, Hancitor, IcedID, and QBot
Go to
Blog
The Art of Cyberwarfare
Chinese APTs attack Russia
Go to
Blog
Under the hood. Group-IB Threat Intelligence. Part 1
Dive into Breached DB section
Go to
Blog
The Fraud Family
Fraud-as-a-Service operation targeting Dutch residents
Go to
Webinar
Warding off REvil: How to keep ransomware gangs out of your company
The massive cyberattack conducted by infamous ransomware gang REvil affected hundreds of businesses in over a dozen countries.
Go to
Forrester: Group-IB TI Solution Generated Significant Return on Investment
Report
Forrester: Group-IB TI Solution Generated Significant Return on Investment
Cost savings and business benefits enabled by Threat Intelligence & Attribution
Go to
Webinar
Red Teaming vs. Penetration Testing
Adversaries are probing your networks on a daily basis in order to find a way in. An organization that can...
Go to
Blog
The Brothers Grim
The reversing tale of GrimAgent malware used by Ryuk
Go to
Blog
REvil Twins: Ransomware-as-a-Service program
Deep Dive into Prolific RaaS Affiliates' TTPs
Go to
Webinar
Leaks, spies, and blackmail: Insights into modern high-tech crime
During this webinar, you’ll learn the secrets behind Group-IB’s international success in investigating modern cybercrime.
Go to
Blog
Big airline heist
APT41 likely behind a third-party attack on Air India
Go to
Webinar
DIGITAL RISK SUMMIT 2021
Group-IB's landmark Digital Risk Summit is a platform for industry experts to discuss the latest global trends, dive deep into...
Go to
The Total Economic Impact™ of Group-IB Fraud Protection
Report
The Total Economic Impact™ of Group-IB Fraud Protection
Cost savings and business benefits enabled by Group-IB Fraud Protection (ex. Fraud Hunting Platform)
Go to
Webinar
Digital Risk Protection win the battle against illegal brand exploitation
Join our webinar to discover how Digital Risk Protection can help you win the battle against illegal brand exploitation, providing...
Go to
Blog
FontPack: A dangerous update
Attribution secrets: Who is behind stealing credentials and bank card data by asking to install fake Flash Player, browser or...
Go to
Blog
BlackCat Ransomware: Tactics, Techniques & Mitigation Strategies
An analysis of the BlackCat ransomware affiliate program
Go to
Blog
Connecting the Bots
Hancitor fuels Cuba Ransomware Operations
Go to
Blog
GrelosGTM group abuses Google Tag Manager to attack e-commerce websites
Group-IB specialists detected GrelosGTM group started to abuse Google Tag Manager legitimate functionality for their own purposes in infections of...
Go to
Blog
Lazarus BTC Changer
Back in action with JS sniffers redesigned to steal crypto
Go to
Webinar
Group-IB Ransomware Insights 2020-2021
The complete guide to the latest tactics, techniques, and procedures of ransomware operators beased on MITRE ATT&CK®
Go to
Blog
Deep water: exploring phishing kits
Group-IB's Computer Emergency Response Team built a solid phishing kit database, which helps Group-IB fight phishing that targets specific brands.
Go to
Webinar
ThreatQuotient | Group IB – Actor centric threat hunting approach
ThreatQuotient, a leading security operations platform innovator, and Group-IB, a global cybersecurity company, are hosting an informative and interactive seminar...
Go to
Blog
When Karma Comes Back
The rise and fall of illicit cardshop breached twice in two years
Go to
Webinar
Infoces Pakistan Data Piracy
Scam as a service targeting emerging economies in APAC via social engineering methods.
Go to
Blog
Kremlin RATs from Nigeria
The analysis of phishing campaigns carried out by a new threat actor
Go to
Digital risks 2021: Scam trends and projections
Webinar
Digital risks 2021: Scam trends and projections
Learn about popular online scam techniques, including fake accounts and payment pages, malicious emails and data leaks, and how to...
Go to
Forget-me-not: using memory analysis to search for traces of commodity malware
Webinar
Forget-me-not: using memory analysis to search for traces of commodity malware
Group-IB’s newest webinar is your one-stop-shop for everything commodity malware. Get an overview of the bots you need to know...
Go to
Digital Risk Insights
Report
Digital Risk Insights
The complete guide to the threat landscape in the digital space and latest techniques of scammers
Go to
The Easy First Step to Starting Your Zero Trust Journey
Report
The Easy First Step to Starting Your Zero Trust Journey
Learn how cybersecurity consulting can put you on the path to realizing Zero Trust Architecture
Go to
Blog
Masters of disguise
Let's hunt some bootkits
Go to
Blog
JavaScript sniffers’ new tricks
Analysis of the E1RB JS sniffer family
Go to
Webinar
Digital risks 2021: Scam trends and projections – Español
Nuestro experto comparte valiosos conocimientos sobre las últimas tendencias y técnicas de estafa en el seminario web.
Go to
Webinar
Risques numériques 2021: Projections et tendances des cyberarnaques
Notre expert partage des informations précieuses sur les dernières tendances et techniques en matière d'escroquerie lors du webinaire !
Go to
Webinar
Tendenze delle frodi online e previsioni
Go to
Group-IB Is Recognized by Frost & Sullivan As a Leader on The Cyber Threat Intelligence Market
Report
Group-IB Is Recognized by Frost & Sullivan As a Leader on The Cyber Threat Intelligence Market
A benchmarking system to Spark Companies to action - innovation that fuels new deal flow and growth pipelines
Go to
Attack of the clones: Scam Game in Social Media
Webinar
Attack of the clones: Scam Game in Social Media
The scam uses famous brands to deceive people into multistage scam schemes, including fake surveys and visiting fraudulent third-party websites.
Go to
Ransomware Uncovered 2020/2021
Report
Ransomware Uncovered 2020/2021
The complete guide to the latest tactics, techniques, and procedures of ransomware operators based on MITRE ATT&CK®
Go to
Blog
Inside Classiscam
A deep dive into Classiscam: automated scam as a service designed to steal money and payment data
Go to
Group-IB x YouHolder
Success Story
Group-IB x YouHolder
Explore how Group-IB's auditing team conducted an External Penetration Test, Web Application Security Assessment, and Social Engineering Test for YouHodler,...
Go to
Blog
The source of everything
Forensic examination of incidents involving source code leaks
Go to
Webinar
Hi-Tech Crime Trends: 2020-2021
Group-IB closely monitors the evolution of cybercriminal tactics, tools and procedures; monitors changes in the global threat landscape and key...
Go to
Digital Risks 2021: Scam trends and projections in Europe
Webinar
Digital Risks 2021: Scam trends and projections in Europe
Dmitriy Tunkin, Chief Regional Officer, Europe, shares valuable insights about latest scam trends and techniques.
Go to
Blog
New attacks by UltraRank group
As part of UltraRank's new campaign, Group-IB Threat Intelligence team discovered 12 eCommerce websites infected with their JavaScript-sniffer.
Go to
Preventable Disaster: Hunting for Egregor Operators in Your Network
Webinar
Preventable Disaster: Hunting for Egregor Operators in Your Network
What makes Egregor more dangerous is that it has also become the ransomware of choice for Qakbot operators, who are...
Go to
Hi-Tech Crime Trends 2020/2021
Report
Hi-Tech Crime Trends 2020/2021
Source of strategic data on the global cyber threat landscape and forecasts for its development
Go to
Blog
The footprints of Raccoon
A story about operators of JS-sniffer FakeSecurity distributing Raccoon stealer
Go to
Blog
The Locking Egregor
Analysis of TTPs employed by Egregor operators
Go to
Frost & Sullivan recognized Group-IB as a leader in Digital Risk Protection
Report
Frost & Sullivan recognized Group-IB as a leader in Digital Risk Protection
Frost & Sullivan recognized Group-IB as a leader in Digital Risk Protection
Go to
Webinar
How to level up on your cyber knowledge: Group-IB hands-on cybersecurity programs
Take your cyber knowledge to the next level with our immersive webinar on Group-IB's hands-on cybersecurity programs. Explore cutting-edge techniques,...
Go to
Webinar
Gioca d’anticipo – i TTP utilizzati dai gruppi di ransomware nel
Preparati in anticipo: scopri le tattiche, tecniche e procedure (TTP) utilizzate dai gruppi di ransomware nel nostro webinar, per difenderti...
Go to
Egregor Ransomware: The Legacy of Maze Lives On
Report
Egregor Ransomware: The Legacy of Maze Lives On
The new gang may be young, but it is already doing serious damage
Go to
Blog
Big Game Hunting: Now in Russia
Top Russian companies and banks under attack from OldGremlin - a group controlling TinyCryptor ransomware
Go to
Blog
Group-IB Fraud Protection (ex. Fraud Hunting Platform)
Keeping user digital identity safe
Go to
Webinar
How to keep your data safe online in 2020
Join our informative webinar to learn essential strategies and best practices on keeping your valuable data secure online in 2020.
Go to
Webinar
Fraud Day Africa
Fraud that customers may face during and after the lockdown.
Go to
Outwit ProLock: The ins and outs of Qakbot’s enterprise ransomware
Webinar
Outwit ProLock: The ins and outs of Qakbot’s enterprise ransomware
At the center of some of the most recent so-called Big Game Hunting campaigns is ProLock, whose use of the...
Go to
Webinar
The ins and outs of modern-day email-borne attacks
96% of all the attacks involving social engineering techniques start in the inboxes. Email is the most common attack vector...
Go to
Lock like a Pro: How Qakbot Fuels Enterprise Ransomware Campaigns
Report
Lock like a Pro: How Qakbot Fuels Enterprise Ransomware Campaigns
Group-IB alerted the world to ProLock. Now, it’s exposing the threat actor further.
Go to
Blog
Lock Like a Pro
Dive in Recent ProLock's Big Game Hunting
Go to
Webinar
RedCurl: New corporate espionage group exposed
RedCurl acts covertly in the network for months to minimize the risk to be discovered. The group then cleverly mimics...
Go to
UltraRank: The Unexpected Twist of a JS-Sniffer Triple Threat
Report
UltraRank: The Unexpected Twist of a JS-Sniffer Triple Threat
New stage in JS-sniffers research. From analyzing malware families to identifying threat actors
Go to
Leaving sandboxes behind: The rise of Malware Detonation Platforms
Webinar
Leaving sandboxes behind: The rise of Malware Detonation Platforms
There is no limit to how far threat actors will go to bypass classic networked sandboxes. Hackers are constantly inventing...
Go to
Webinar
How to Choose a Sandbox: Do’s and Don’ts
Uncover the secrets to selecting the perfect sandbox environment with our expert-led webinar. Learn the crucial do's and don'ts of...
Go to
RedCurl: The Pentest You Didn’t Know About
Report
RedCurl: The Pentest You Didn’t Know About
The APT group continues to successfully attack enterprise companies in North America, Europe, and CIS countries after remaining undetected for...
Go to
Webinar
Enquête au-delà des frontières
Explorez au-delà des frontières avec notre enquête captivante lors de notre webinaire, vous offrant des perspectives uniques et approfondies pour...
Go to
Webinar
Scenario-Based Pentesting and Security Monitoring Webinar
Every year, cyberattack numbers increase, and attackers and defenders continue their never-ending game of cat and mouse. This has forced...
Go to
Webinar
Retail Business vs Online Scammers: The Battle Against Illegal Brand Exploitation
Offline businesses often think they won’t be targeted by digital fraud. In reality, the opposite is true. Supermarkets, pharmacies, and...
Go to
Webinar
Hunt or be Hunted with SCAfrica
Hunt or be hunted with SCAfrica in our thrilling webinar, as you explore advanced threat hunting techniques to detect and...
Go to
Blog
Digital forensics specialist’s bookshelf
Top 11 books on digital forensics, incident response, and malware analysis
Go to
Fxmsp: The story of 1 hacker who sold access To networks
Webinar
Fxmsp: The story of 1 hacker who sold access To networks
In October 2017, Group-IB’s Threat Intelligence (TI) specialists detected the activity of the threat actor known as Fxmsp, who at...
Go to
Jolly Roger’s Patrons
Report
Jolly Roger’s Patrons
Group-IB exposes financial crime network of online pirates in developing countries
Go to
Fxmsp: “The Invisible God of Networks”
Report
Fxmsp: “The Invisible God of Networks”
The report shows how Fxmsp’s cybercriminal career evolved from a newbie hacker to one of the major players of the...
Go to
Webinar
Stay one step ahead TTPs used by ransomware groups in 2019
Ransomware attacks are on the rise and show no signs of stopping. Stay one step ahead of the enemy by...
Go to
Webinar
Improve the efficiency of your Security Operations Center
In a world of ever-evolving threats, keeping your Security Operations Center (SOC) technologically and strategically relevant can be a challenge.
Go to
Leadership Compass “Network Detection and Response”
Report
Leadership Compass “Network Detection and Response”
KuppingerCole Analysts AG Names Group-IB a Product Leader for Managed XDR
Go to
Blog
IcedID: new malware version
When ice burns through bank accounts
Go to
Webinar
Playbook of ‘Perswaysion’ Phishing Campaign
Perswaysion is a term coined by one of our Senior Threat Intelligence Analyst, based on a 3-phase phishing campaign which...
Go to
Blog
ATT&CKing ProLock Ransomware
The success of enterprise ransomware attacks has motivated more and more threat actors to join the game.
Go to
Blog
PerSwaysion Campaign
Playbook of Microsoft Document Sharing-Based Phishing Attack
Go to
Webinar
How Fraudsters Attack Their Victims in Early 2020: Case Studies
Go to
Blog
Reconstructing User Activity for Forensics with FeatureUsage
Useful feature that can help forensic analysts and incident responders to reconstruct user activities.
Go to
Webinar
If I have a SOC, do I need Compromise Assessment?
Your security level is not a constant; it is a variable indicator. Can you have absolute certainty that your data...
Go to
Webinar
Intelligence-driven threat hunting, or don’t let the hunter to become the prey
Many businesses blindly implement Threat Hunting in their infrastructures while remaining unaware of the solution that lies at the core...
Go to
Webinar
6 Symptoms of Disease: Risks for Online Pharmaceutical Market
To look into the illegal use of pharma brands, Group-IB’s Digital Risk Protection team analyzed online sales of seven of...
Go to
Webinar
Open API security: Clarity instead of obscurity
APIs have become a hidden part of everyday life. Some industries are only beginning to develop their own open API...
Go to
Webinar
Sporting Goods Maraphon: Official Brands vs. Counterfeiters
The sportswear industry is developing rapidly, which attracts countless counterfeiters who attempt to make money by selling fake products advertised...
Go to
Webinar
The 3 types of online fraud attack you’re most likely to face in 2020
Discover the top three types of online fraud attacks you're most likely to face in 2020 and learn how to...
Go to
Blog
Chromium-based Microsoft Edge from a Forensic Point of View
Explore the forensic perspective of the Microsoft Edge Chromium-based version and its features, such as msedge_proxy, edge cache location, and...
Go to
Webinar
Detection of Advanced Threats: Streamlined Response Proactive Threat Hunting
Each new cyberattack aimed at a company, political party, or critical infrastructure facility gives us the opportunity to see the...
Go to
The Possibilities of Mobile Forensics: Extraction, Investigation, and Crime Solving
Report
The Possibilities of Mobile Forensics: Extraction, Investigation, and Crime Solving
A forensic expert’s guide to the latest methods of extracting data from mobile devices.
Go to
Blog
Hunting for Nextcloud Cloud Storage Forensic Artifacts on Endpoints
Forensic artifacts, which can be found during forensic examination of a Windows endpoint.
Go to
Group-IB x ENCRY TELECOM
Success Story
Group-IB x ENCRY TELECOM
How to ensure enhanced protection for a virtual PBX
Go to
Blog
A Shortcut to Compromise: Cobalt Gang phishing campaign
Cobalt Gang is alive and well, and continued to attack financial institutions around the globe in 2019.
Go to
Hi-Tech Crime Trends 2019/2020
Report
Hi-Tech Crime Trends 2019/2020
A single comprehensive source of strategic data on cyberthreats and reliable forecasts of their development
Go to
Blog
Hunting for Attacker’s Tactics and Techniques With Prefetch Files
Windows Prefetch files were introduced in Windows XP and since that time have helped digital forensics analysts and incident responders...
Go to
Ransomware Uncovered 2019: Attackers’ Latest Methods
Report
Ransomware Uncovered 2019: Attackers’ Latest Methods
The complete guide to the TTPs used by ransomware operators in 2019
Go to
Webinar
Hi-Tech Crime Trends: 2019-2020
Over the past decade, the number of cyberattacks and their complexity have increased significantly, which puts the freedom of communication...
Go to
Blog
Group-IB unveils its Graph
The story about Group-IB searching for graph analysis solution and creating its own unique instrument
Go to
Webinar
Online brand abuse: Trends and evolution of scam methods in 2019
Go to
Blog
Massive malicious campaign by FakeSecurity JS-sniffer
Group-IB specialists detected a new JS-sniffer family called FakeSecurity.
Go to
Blog
WhatsApp in Plain Sight: Where and How You Can Collect Forensic Artifacts
All about WhatsApp forensics and the wealth of data extracted from a device through forensic analysis.
Go to
Cybersecurity Challenges to Pharmaceutical Brands in 2019
Report
Cybersecurity Challenges to Pharmaceutical Brands in 2019
Learn what methods criminals use to abuse pharmaceutical brands and popular drugs and distribute poor-quality medicine under their labels.
Go to
Blog
RDoS attacks by fake Fancy Bear hit banks in multiple locations
Group-IB experts have detected a massive email campaign spreading similar ransom demands sent to banks and financial organizations across the...
Go to
Webinar
Take the next step in your Threat Intelligence program. New features and use cases
Level up your Threat Intelligence program: Discover new features and explore powerful use cases in our webinar, empowering you to...
Go to
Blog
No Time to Waste
How Windows 10 Timeline Can Help Forensic Experts
Go to
Blog
50 Shades of Ransomware
The following article examines forensic artifacts left by the Shade cryptolocker and maps used tactics and techniques to MITRE ATT&CK.
Go to
Blog
Tools up: the best software and hardware tools for computer forensics
Igor Mikhailov gave his review of the best software and hardware solutions for computer forensics.
Go to
Webinar
Three Steps for Building a Successful Brand Protection Strategy
Unlock the secrets to building a successful brand protection strategy with our insightful webinar, taking you through three essential steps...
Go to
Webinar
How to track the most powerful hacking groups APAC
Unlock the secrets of tracking the most powerful hacking groups in APAC during our insightful webinar. Learn effective methodologies and...
Go to
Webinar
Are you ready for a Cyber Incident Response? Expectations vs Reality
Are you keeping up with the ever-changing cyber threatscape and adapting your security posture accordingly?
Go to
Webinar
Silence: Tools & Attack Evolution in 2019
In September 2018, Group-IB released the first comprehensive technical report on the cybergang Silence. This webinar cover the findings Group-IB...
Go to
Silence 2.0: Going Global
Report
Silence 2.0: Going Global
A comprehensive technical analysis of Silence’s tools, tactics, and evolution. This is the first time Group−IB’s reports of this kind...
Go to
Webinar
Protect Your Brand Online – 3 Approaches to Measure the ROI
Learn more about the effective brand protection approaches and gain valuable insights fraud and scam schemes in our webinar!
Go to
Voting results of
Blog
Voting results of “The Voice Kids Russia Season 6”
Go to
Webinar
How to investigate a perfect cybercrime
Tips&Tricks from Group-IB's high-profile cases in our insightful webinar!
Go to
Blog
Catching fish in muddy waters
How the hacker group MuddyWater attacked a Turkish manufacturer of military electronics
Go to
Blog
Following the RTM
Forensic examination of a computer infected with a banking trojan
Go to
Blog
Meet the JS-Sniffers 4: CoffeMokko Family
Group-IB researchers have discovered 38 families of JS-sniffers, whereas only 12 were known previously.
Go to
Blog
Meet the JS-Sniffers 3: Illum Family
Group-IB researchers discovered Illum JS-sniffers family designed to steal payment data of customers of online stores.
Go to
Blog
Meet the JS-Sniffers 2: G-Analytics Family
Group-IB discovered that the stolen payment cards data is sold through an underground store specially created for this purpose.
Go to
Blog
Meet the JS-Sniffers: ReactGet Family
ReactGet is one of the most interesting families of JS-sniffers, designed to steal banking cards data from online stores.
Go to
Blog
Gustuff: Weapon of Mass Infection
Android Trojan named «Gustuff» capable of targeting more than 100 global banking apps, a number of cryptocurrency and marketplace applications
Go to
Crime Without Punishment: In-depth Analysis of JS-Sniffers
Report
Crime Without Punishment: In-depth Analysis of JS-Sniffers
JS-sniffers pose a growing threat by attacking online stores and stealing payment data and credentials of their users. Group-IB experts...
Go to
Blog
The end of torrents era in Russia
Currently, a total of 80% of pirated films and almost 90% of TV series are being watched online
Go to
Relevant Cyberthreats to Perfume Brands in 2019
Report
Relevant Cyberthreats to Perfume Brands in 2019
The scent of fraud. Learn how threat actors are stealing the names and reputations of luxury perfume brands for their...
Go to
Webinar
How to safeguard your business from social engineering attacks
Social engineering, in the context of information security, is the psychological manipulation of people into performing actions or divulging confidential...
Go to
Webinar
The Sound of Silence: New APT attacks on banks discovered in 2018
Interbank systems, Card processing, ATMs, Payment gateways
Go to
Hi-Tech Crime Trends 2018
Report
Hi-Tech Crime Trends 2018
Group-IB annual report on cybercrime trends
Go to
The Evolution of Ransomware And Its Distribution Methods in 2018
Report
The Evolution of Ransomware And Its Distribution Methods in 2018
Ransomware attacks were still on the rise in 2018. Some of them became more sophisticated and adopted tactics and techniques...
Go to
Webinar
Financially motivated Silence
In September 2018, Group-IB released Silence: Moving into the darkside, the first comprehensive technical report on the group’s attacks. The...
Go to
Webinar
Mobile Fraud Trends and Best Practices in Protecting Banking Apps
Stay ahead of mobile fraud trends and gain valuable insights into protecting banking apps with our informative webinar.
Go to
Silence: Moving Into The Darkside
Report
Silence: Moving Into The Darkside
The first detailed report on the tactics and tools used by Silence
Go to
Blog
Silence: Moving into the Darkside
Group-IB has exposed the attacks committed by Silence cybercriminal group.
Go to
2018 Cryptocurrency Exchanges. User Accounts Leaks Analysis
Report
2018 Cryptocurrency Exchanges. User Accounts Leaks Analysis
Estimation of the number of login and passwords leaks of cryptoсurrency exchanges users and analysis of their nature. Recommendations for...
Go to
Webinar
Cobalt Modus Operandi Evolution and Joint Anunak Operations
Learn about Cobalt’s development and modification of tools and tactics which were used to steal approximately 1 billion dollars from...
Go to
Lazarus Arisen: Architecture, Tools and Attribution
Report
Lazarus Arisen: Architecture, Tools and Attribution
The only in-depth report outlining multiple layers of Lazarus infrastructure, thorough analysis of hacker’s tools and evidence leading to North...
Go to
Cobalt: Their Evolution And Joint Operations
Report
Cobalt: Their Evolution And Joint Operations
Learn about Cobalt’s development and modification of tools and tactics which were used to steal approximately 1 billion dollars from...
Go to
Blog
Cobalt Renaissance
New attacks and joint operations
Go to
Webinar
Lazarus Arisen: Architecture, Techniques and Attribution
Due to continued media attention and alleged connections to North Korea, Lazarus has become a well-known hacking group. However, existing...
Go to
Webinar
Cobalt Hacking Group Persists: Evolution of Attacks and New Targets
Cobalt group was first revealed in 2016. It is known for stealing cash directly from the ATMs with “touchless jackpotting”...
Go to
Red Teaming: The Tactics and Methods Involved in Full-Scale Attack Simulations
Report
Red Teaming: The Tactics and Methods Involved in Full-Scale Attack Simulations
So what is the difference between a pentest and Red Teaming? Find out this and more in this definitive guide...
Go to
Analysis of The Counterfeit Goods Market Infringing on Sports Brands
Report
Analysis of The Counterfeit Goods Market Infringing on Sports Brands
This report contains the results of Group-IB Digital Risk Protection’s study into the counterfeit goods and online fraud market with...
Go to
eDiscovery: Basics, Methods and Techniques of Strategic Digital Evidence Management
Report
eDiscovery: Basics, Methods and Techniques of Strategic Digital Evidence Management
Learn about the delicate process of collecting, processing, and analyzing digital evidence so that it can be presented to judges...
Go to
Internet Distribution of Counterfeit Alcohol 2017-2018
Report
Internet Distribution of Counterfeit Alcohol 2017-2018
Investigation of counterfeit alcohol market in Russia
Go to
Webinar
Key Findings and Forecasts from Group IB’s Annual Research in 2017
Gain valuable insights and exclusive forecasts from Group IB's annual research in 2017, as our webinar highlights key findings that...
Go to
Hi-Tech Crime Trends 2017
Report
Hi-Tech Crime Trends 2017
Group-IB annual report on cybercrime trends
Go to
Blog
MoneyTaker: in pursuit of the invisible
Group-IB has uncovered a hacker group attacking banks in the USA and Russia
Go to
MoneyTaker: Revealed After 1.5 Years of Silent Operations
Report
MoneyTaker: Revealed After 1.5 Years of Silent Operations
Explore how this group managed to hide their traces while conducting 20+ attacks on banks and financial services companies in...
Go to
Blog
When Hackers are Quicker than Antiviruses: Cobalt Group Bypasses Antivirus Protection
Go to
Blog
In a Queue for a Scam
How faudsters cash in on hype around new iPhones
Go to
Blog
NotPetya pulls BadRabbit out of the hat
Research revealed that the BadRabbit code was compiled from NotPetya sources.
Go to
Blog
BadRabbit: spread of new cryptolocker
There is a connection between BadRabbit and Not Petya
Go to
Blog
‘Black spot’ for pirates
Russia has developed a strong legal framework to combat online piracy. All that is needed is for it to be...
Go to
Blog
Airline companies «landing» on fake pages
Top global airline companies have been compromised by fraudsters for the second time during the last six months.
Go to
Blog
Secrets of Cobalt
How Cobalt hackers bypass your defenses
Go to
Blog
Insecure venture
On the price of hacker attacks and the toxic cyber environment
Go to
Blog
Kronos devouring its children
The man who "saved the world" from the WannaCry outbreak has been arrested on suspicion of being the author of...
Go to
Blog
Hacktivists unmasked
Group-IB reveals the identity of alleged members of the Islamic hacker group United Islamic Cyber Force
Go to
Blog
Targeted attacks on banks
Russia as a testing ground
Go to
Blog
Petya starts with Ukraine and then goes global
Group-IB has identified the ransomware that has infected energy, telecommunications and financial companies
Go to
Blog
Ghost flights
Top global airline companies have been compromised through fake links distributed by "friends" on Facebook
Go to
Blog
LAZARUS ARISEN
Group-IB reveals the unknown details of attacks from one of the most notorious APT groups: sophisticated espionage and APT techniques...
Go to
Blog
Echoes of cyberwar
Why WannaCry was more dangerous than other ransomware?
Go to
Webinar
MoneyTaker: TTPs and Predictions
Group-IB has recently released a report outlining the activity of a previously unknown targeted attack group that we are dubbing...
Go to
Blog
In a Risk Group
Why cyberattacks may be soon at the top of the World rating of threats (Ilya Sachkov for RBC)
Go to
Cobalt: Logical Attacks on ATMs
Report
Cobalt: Logical Attacks on ATMs
Report outlining activity of the Cobalt hacker group attacking banks in Europe and Asia
Go to
Hi-Tech Crime Trends 2016
Report
Hi-Tech Crime Trends 2016
Group-IB annual report on cybercrime trends
Go to
Webinar
Cobalt ATM jack potting: Real cases and Q&A
The "Cobalt" cyber-criminal group has garnered international attention and focus from the security community from their unique methods of conducting...
Go to
Buhtrap: The Evolution of Targeted Attacks Against Financial Institutions
Report
Buhtrap: The Evolution of Targeted Attacks Against Financial Institutions
The report outlines the activity of the most dangerous and comprehensive cybercriminal group attacking internal banking systems.
Go to
Blog
Cron has fallen
Group-IB supports operations to arrest gang for infecting 1 million smartphones
Go to
Analysis of Attacks Against Trading and Bank Card System
Report
Analysis of Attacks Against Trading and Bank Card System
Group-IB annual report on speculative fluctuations of exchange rate and other incidents in 2015 caused by the Trojan program Corkow...
Go to
Anunak: APT Against Financial Institutions
Report
Anunak: APT Against Financial Institutions
This research includes the findings of Group-IB and Fox‑IT on Anunak (Carbanak) group, which focused its activity on banks and...
Go to
Ransomware Notes
Ransomware Notes
Ransom Notes
We have collected ransom notes from the most active ransomware groups in 2024 to help you stay vigilant and prepare for potential threats.
Go to
Join the Cybercrime
Fighters Club

The global fight against cybercrime is a collaborative effort, and that’s why we’re looking to partner with industry peers to research emerging threats and publish joint findings on our blog. If you’ve discovered a breakthrough into a particular threat actor or a vulnerability in a piece of software, let us know!

Join Learn more
Subscribe to our blog newsletter to follow the latest posts
Group-IB Subscribe