State of the underground

Security research report

State of the Underground 2025

Ransomware is up. Credential leaks are rising quickly. Malware is diversifying. This year’s report drills into how cybercriminals are evolving—and what defenders must do to keep up. We analyzed millions of endpoints, credentials, and forums to expose the realities of the cyber underground in 2024. This isn’t theory—it’s what’s actually happening right now.

Download report

Featured Research

Lumma Stealer is out hero

Bitsight Research

Lumma Stealer Is Out… of Business!

Bitsight joined forces with Microsoft and global partners to disrupt LummaC2 — the world’s most prolific infostealer. Over 1,000 domains and 90+ criminal channels were taken down to weaken its malware infrastructure.
Read More
Big Brother Is Watching You And So Is Everyone Else

security research report

Researching Exposed Cameras in the Wild

In our latest research at Bitsight TRACE, we found over 40,000 open, publicly accessible network cameras, streaming live footage from offices, factories, medical facilities, and even private homes. We first raised the alarm in 2023, and based on this latest study, the situation hasn’t improved. These cameras — intended for security or convenience — have inadvertently become public windows into sensitive spaces, often without their owners’ knowledge.

Download report
Bitsight TRACE Report - Security Digitization and the Global Supply Chain CTA cover

Security research report

Under the Surface: Uncovering Cyber Risk in the Global Supply Chain

Your supply chain isn’t just a series of links—it’s a vast, tangled web of dependencies, many of which have weak security. This report uncovers the critical but often-overlooked providers that could be the next cybersecurity weak spot, along with data-driven insights to help you mitigate risks before they disrupt your business.

Download the Report

All Research

Lumma Stealer is out hero

Bitsight Research

Lumma Stealer Is Out… of Business!

Bitsight joined forces with Microsoft and global partners to disrupt LummaC2 — the world’s most prolific infostealer. Over 1,000 domains and 90+ criminal channels were taken down to weaken its malware infrastructure.
Read More
BADBOX Botnet is back hero v2

Bitsight Research

BADBOX Botnet Is Back

The TRACE team investigated BADBOX, which is a large-scale cybercriminal operation selling off-brand Android TV boxes, smartphones, and other Android electronics with preinstalled malware.
Read More
Bitsights approach to security in ICS devices

Bitsight Research

ICS Security Is a Team Sport

Brandon Smith discusses some of the challenges an Automation Engineer face, Bitsight's partnership with Schneider Electric, and what manufacturers in general are doing to tackle ICS security.
Read More
Examining CISA KEV Performance in the Financial Sector

Bitsight Research

CISA KEV performance in the Financial Sector

I’ve had a number of requests to examine the finance sector in more detail including breakdowns of exactly what kind of financial organizations are experiencing greater risk and who is remediating more quickly. Here's some answers.
Read More
The Impact of the Kaspersky Ban

Bitsight Research

The Impact of the Kaspersky Ban

How will the prohibition of Kaspersky Lab, Inc. impact global users? Read our analysis of the prevalence of Kaspersky products used by organizations around the globe.
Read More
AI image of a duck on the porch of a farmhouse with a man in black lurking in the shaddows

Bitsight Research

The xz apocalypse that almost was*

Dive into a significant cybersecurity scare that could have led to widespread chaos, highlighting the vulnerabilities that were exposed and the swift actions taken to prevent disaster.
Read More
Blog Image KEV Research Announcement

Bitsight Research

Slicing through CISA’s KEV Catalog

Bitsight’s global, advanced scanning and detection capabilities provide insight into many actively exploited vulnerabilities that others just can’t touch. Explore how we do it.
Read More
2024 Ivanti Vulnerability hero

Bitsight Research

New Year, New Ivanti Vulnerability

Explore recent Ivanti Secure vulnerabilities affecting SSL VPN and Network Access Control solutions. Understand the criticality, patch delays, and ongoing exploitation.
Read More
SmokeLoader Malware banner

Bitsight Research

SmokeLoader's Plugins

Bitsight dissects SmokeLoader's plugins received by an infected computer from the botnet "0020". We explore their inner workings, capabilities, and threat vectors.
Read More
Mylobot- Investigating a proxy botnet

Bitsight Research

Mylobot: Investigating a proxy botnet

Mylobot is a malware that targets Windows systems, it first appeared in 2017. In this article, we'll focus on its main capability, which is transforming the infected system into a proxy.
Read More

Want to learn more about Bitsight Threat Research and Education (TRACE), and meet the team?

Let's Go →