Ke3chang

Winnti Group, Wicked Panda - Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Winnti Group, Wicked Panda - Threat Group Cards: A Threat Actor Encyclopedia

Accenture | Let there be change

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Accenture | Let there be change

Ke3chang, Vixen Panda, APT 15, GREF, Playful Dragon

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Ke3chang, Vixen Panda, APT 15, GREF, Playful Dragon

BadBazaar espionage tool targets Android users via trojanized Signal and Telegram apps

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor BadBazaar espionage tool targets Android users via trojanized Signal and Telegram apps

ICIT Brief – China’s Espionage Dynasty: Economic Death by a Thousand Cuts

date ORKL added it fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor ICIT Brief – China’s Espionage Dynasty: Economic Death by a Thousand Cuts

PlugX : Mustang Panda APT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PlugX : Mustang Panda APT

PlugX Meeting Invitation via MSBuild and GDATA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PlugX Meeting Invitation via MSBuild and GDATA

The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor

UNC6384 Weaponizes ZDI-CAN-25373 Vulnerability to Deploy PlugX Against Hungarian and Belgian Diplomatic Entities - Arctic Wolf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UNC6384 Weaponizes ZDI-CAN-25373 Vulnerability to Deploy PlugX Against Hungarian and Belgian Diplomatic Entities - Arctic Wolf

PRC-Nexus Espionage Campaign Hijacks Web Traffic to Target Diplomats

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PRC-Nexus Espionage Campaign Hijacks Web Traffic to Target Diplomats

Follow the Smoke | China-nexus Threat Actors Hammer At the Doors of Top Tier Targets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Follow the Smoke | China-nexus Threat Actors Hammer At the Doors of Top Tier Targets

Top Tier Target | What It Takes to Defend a Cybersecurity Company from Today's Adversaries

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Top Tier Target | What It Takes to Defend a Cybersecurity Company from Today's Adversaries

BADBAZAAR and MOONSHINE: Technical analysis and mitigations

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BADBAZAAR and MOONSHINE: Technical analysis and mitigations

BADBAZAAR and MOONSHINE: Spyware targeting Uyghur, Taiwanese and Tibetan groups and civil society actors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BADBAZAAR and MOONSHINE: Spyware targeting Uyghur, Taiwanese and Tibetan groups and civil society actors

NCSC and partners share guidance for communities at high risk of digital surveillance

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor NCSC and partners share guidance for communities at high risk of digital surveillance

Updated Shadowpad Malware Leads to Ransomware Deployment

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Updated Shadowpad Malware Leads to Ransomware Deployment

Meet NailaoLocker: a ransomware distributed in Europe by ShadowPad and PlugX backdoors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Meet NailaoLocker: a ransomware distributed in Europe by ShadowPad and PlugX backdoors

Updated Shadowpad Malware Leads to Ransomware Deployment

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Updated Shadowpad Malware Leads to Ransomware Deployment

China-linked Espionage Tools Used in Ransomware Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-linked Espionage Tools Used in Ransomware Attacks

CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia

Justice Department and FBI Conduct International Operation to Delete Malware Used by China-Backed Hackers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Justice Department and FBI Conduct International Operation to Delete Malware Used by China-Backed Hackers

Chinese State-Sponsored RedDelta Targeted Taiwan, Mongolia, and Southeast Asia with Adapted PlugX Infection Chain

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese State-Sponsored RedDelta Targeted Taiwan, Mongolia, and Southeast Asia with Adapted PlugX Infection Chain

Unmasking Adversary Infrastructure: How Certificates and Redirects Exposed Earth Baxia and PlugX Activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unmasking Adversary Infrastructure: How Certificates and Redirects Exposed Earth Baxia and PlugX Activity

Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdf

DragonRank, a Chinese-speaking SEO manipulator service provider

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DragonRank, a Chinese-speaking SEO manipulator service provider

Sailing_the_Seven_SEAs_Deep_Dive_into_Polaris_Arsenal_and_Intelligence_Insights.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sailing_the_Seven_SEAs_Deep_Dive_into_Polaris_Arsenal_and_Intelligence_Insights.pdf

Cloud Cover: How Malicious Actors Are Leveraging Cloud Services

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cloud Cover: How Malicious Actors Are Leveraging Cloud Services

Threat Actor Groups Tracked by Palo Alto Networks Unit 42 (Updated Aug. 1, 2025)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Actor Groups Tracked by Palo Alto Networks Unit 42 (Updated Aug. 1, 2025)

European Election Security At Risk: A Detailed Analysis of State-Sponsored, eCrime, and Hacktivist Threats

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor European Election Security At Risk: A Detailed Analysis of State-Sponsored, eCrime, and Hacktivist Threats

China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence

Operation Diplomatic Specter: An Active Chinese Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Diplomatic Specter: An Active Chinese Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia

IOC Extinction? China-Nexus Cyber Espionage Actors Use ORB Networks to Raise Cost on Defenders

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor IOC Extinction? China-Nexus Cyber Espionage Actors Use ORB Networks to Raise Cost on Defenders

Finding Malware: Detecting SOGU with Google Security Operations.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Finding Malware: Detecting SOGU with Google Security Operations.

Wirtschaftsspionage gegen Volkwagen: VW-Konzern wurde jahrelang ausge…

Malpedia library date fromORKL

The title opens archive.today, not the publisher’s page. Archived copy on ORKL Detailsfor Wirtschaftsspionage gegen Volkwagen: VW-Konzern wurde jahrelang ausge…

Microsoft Security Compliance and Identity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Security Compliance and Identity

Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks

The Secret Life of RATs: connecting the dots by dissecting multiple backdoors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Secret Life of RATs: connecting the dots by dissecting multiple backdoors

PowerPoint 簡報

Malpedia library date TeamT5 fromORKL

Archived copy on ORKL Detailsfor PowerPoint 簡報

A Look into PlugX Kernel driver

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Look into PlugX Kernel driver

2023 Adversary Infrastructure Report

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023 Adversary Infrastructure Report

Unmasking the Enigma: A Historical Dive into the World of PlugX Malware | Splunk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unmasking the Enigma: A Historical Dive into the World of PlugX Malware | Splunk

Carderbee Targets Hong Kong in Supply Chain Attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Carderbee Targets Hong Kong in Supply Chain Attack

My Tea’s not cold. An overview of China’s cyber threat

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor My Tea’s not cold. An overview of China’s cyber threat

2023-02-bfv-cyber-brief.pdf?__blob=publicationFile&v=6

file creation date fromORKL

Archived copy on ORKL Detailsfor 2023-02-bfv-cyber-brief.pdf?__blob=publicationFile&v=6

Carderbee: APT Group use Legit Software in Supply Chain Attack Targeting Orgs in Hong Kong

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Carderbee: APT Group use Legit Software in Supply Chain Attack Targeting Orgs in Hong Kong

RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale

Stealth Mode: Chinese Cyber Espionage Actors Continue to Evolve Tactics to Avoid Detection | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Stealth Mode: Chinese Cyber Espionage Actors Continue to Evolve Tactics to Avoid Detection | Mandiant

The Spies Who Loved You: Infected USB Drives to Steal Secrets | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Spies Who Loved You: Infected USB Drives to Steal Secrets | Mandiant

Chinese Threat Actors Targeting Europe in SmugX Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese Threat Actors Targeting Europe in SmugX Campaign

Graphican: Flea Uses New Backdoor in Attacks Targeting Foreign Ministries

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Graphican: Flea Uses New Backdoor in Attacks Targeting Foreign Ministries

Lancefly: Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lancefly: Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors

New Mustang Panda’s campaing against Australia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Mustang Panda’s campaing against Australia

Botconf2022-19-FaouCoteCyr.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Botconf2022-19-FaouCoteCyr.pdf

With KEYPLUG, China’s RedGolf Spies On, Steals From Wide Field of Targets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor With KEYPLUG, China’s RedGolf Spies On, Steals From Wide Field of Targets

PwC Cyber Threats 2022: A Year in Retrospect.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor PwC Cyber Threats 2022: A Year in Retrospect.pdf

PlugX Malware Being Distributed via Vulnerability Exploitation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PlugX Malware Being Distributed via Vulnerability Exploitation

Investigating the PlugX Trojan Disguised as a Legitimate Windows Debugger Tool

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Investigating the PlugX Trojan Disguised as a Legitimate Windows Debugger Tool

Mustang Panda APT Group Uses European Commission-Themed Lure to Deliver PlugX Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mustang Panda APT Group Uses European Commission-Themed Lure to Deliver PlugX Malware

Chinese PlugX Malware Hidden in Your USB Devices?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese PlugX Malware Hidden in Your USB Devices?

JSAC2023_2_LT4.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor JSAC2023_2_LT4.pdf

Lookout Discovers Surveillance Campaigns Targeting Uyghurs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lookout Discovers Surveillance Campaigns Targeting Uyghurs

Chinese Playful Taurus Activity in Iran

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese Playful Taurus Activity in Iran

Chinese Playful Taurus Activity in Iran

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Chinese Playful Taurus Activity in Iran

[QuickNote] Another nice PlugX sample

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor [QuickNote] Another nice PlugX sample

Diving into a PlugX sample of Mustang Panda group

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Diving into a PlugX sample of Mustang Panda group

RedDelta Targets European Government Organizations and Continues to Iterate Custom PlugX Variant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RedDelta Targets European Government Organizations and Continues to Iterate Custom PlugX Variant

Precious Gemstones- The New Generation of Kerberos Attacks

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Precious Gemstones- The New Generation of Kerberos Attacks

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog

Hitching a ride with Mustang Panda

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hitching a ride with Mustang Panda

PlugXローダーの進化

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PlugXローダーの進化

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog

Witchetty: Group Uses Updated Toolset in Attacks on Governments in Middle East

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Witchetty: Group Uses Updated Toolset in Attacks on Governments in Middle East

Hunting for Unsigned DLLs to Find APTs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hunting for Unsigned DLLs to Find APTs

Dissecting PlugX to Extract Its Crown Jewels

Malpedia library date Ido Naor fromORKL

Archived copy on ORKL Detailsfor Dissecting PlugX to Extract Its Crown Jewels

New Wave of Espionage Activity Targets Asian Governments

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Wave of Espionage Activity Targets Asian Governments

MustangPanda%20-%20Enemy%20at%20the%20gate_final.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor MustangPanda%20-%20Enemy%20at%20the%20gate_final.pdf

THREAT ANALYSIS REPORT: PlugX RAT Loader Evolution

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor THREAT ANALYSIS REPORT: PlugX RAT Loader Evolution

Advanced Persistent Threats (APTs)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Advanced Persistent Threats (APTs)

Attacks on industrial control systems using ShadowPad | Kaspersky ICS CERT EN

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attacks on industrial control systems using ShadowPad | Kaspersky ICS CERT EN

Gamaredon Group Understanding the Russian APT

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Gamaredon Group Understanding the Russian APT

Operation Earth Berberoka: An Analysis of a Multivector and Multiplatform APT Campaign Targeting Online Gambling Sites

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Earth Berberoka: An Analysis of a Multivector and Multiplatform APT Campaign Targeting Online Gambling Sites

China-based APT Mustang Panda might still have continued their attack activities against organizations in

Malpedia library date VinCSS fromORKLCCS '25 data

Archived copy on ORKL Detailsfor China-based APT Mustang Panda might still have continued their attack activities against organizations in

Space Pirates: analyzing the tools and connections of a new hacker group

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Space Pirates: analyzing the tools and connections of a new hacker group

HUI Loaderの分析 - JPCERT/CC Eyes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor HUI Loaderの分析 - JPCERT/CC Eyes

AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf

Mustang Panda deploys a new wave of malware targeting Europe

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mustang Panda deploys a new wave of malware targeting Europe

Moshen Dragon’s Triad-and-Error Approach | Abusing Security Software to Sideload PlugX and ShadowPad

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Moshen Dragon’s Triad-and-Error Approach | Abusing Security Software to Sideload PlugX and ShadowPad

Chinese APT Bronze President Mounts Spy Campaign on Russian Military

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese APT Bronze President Mounts Spy Campaign on Russian Military

yir-cyber-threats-annex-download.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor yir-cyber-threats-annex-download.pdf

Botconf2022-40-LunghiHorejsi.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Botconf2022-40-LunghiHorejsi.pdf

https://documents.trendmicro.com/assets/txt/earth-berberoka-windows-iocs-2.txt

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor https://documents.trendmicro.com/assets/txt/earth-berberoka-windows-iocs-2.txt

New APT Group Earth Berberoka Targets Gambling Websites With Old and New Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New APT Group Earth Berberoka Targets Gambling Websites With Old and New Malware

Hacking activity of SectorB Group in 2021 – Red Alert

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hacking activity of SectorB Group in 2021 – Red Alert

Ghidra script to handle stack strings – Max Kersten

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ghidra script to handle stack strings – Max Kersten

Mustang Panda's Hodur : Vieux trucs, nouvelle variante de Korplug

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mustang Panda's Hodur : Vieux trucs, nouvelle variante de Korplug

Chinese APT Combines Fresh Hodur RAT with Complex Anti-Detection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese APT Combines Fresh Hodur RAT with Complex Anti-Detection

New Mustang Panda hacking campaign targets diplomats, ISPs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Mustang Panda hacking campaign targets diplomats, ISPs

Mustang Panda’s Hodur: Old tricks, new Korplug variant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mustang Panda’s Hodur: Old tricks, new Korplug variant

TA416: Activity, Techniques, & Targeting Explained | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TA416: Activity, Techniques, & Targeting Explained | Proofpoint US

Adam Kozy Testimony

Malpedia library date Adam Kozy fromORKL

Archived copy on ORKL Detailsfor Adam Kozy Testimony

A “GULP” of PlugX

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A “GULP” of PlugX

Nickel

Malpedia library date Notice of Pleadings fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Nickel

NICKEL targeting government organizations across Latin America and Europe

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor NICKEL targeting government organizations across Latin America and Europe

Complaint filed by Microsoft against NICKEL-APT15

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Complaint filed by Microsoft against NICKEL-APT15

NICKEL targeting government organizations across Latin America and Europe | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor NICKEL targeting government organizations across Latin America and Europe | Microsoft Security Blog

Protecting people from recent cyberattacks

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Protecting people from recent cyberattacks

Threat Spotlight: BlackMatter, LockBit, and THOR - Cisco Umbrella

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Spotlight: BlackMatter, LockBit, and THOR - Cisco Umbrella

Microsoft Word - exorcist whitepaper.docx

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Word - exorcist whitepaper.docx

4 Chinese APT Groups Identified Targeting Mail Server of Afghan Telecommunications Firm Roshan

date in the CCS '25 data Recorded Future fromCCS '25 data

The original link failed its last check. Detailsfor 4 Chinese APT Groups Identified Targeting Mail Server of Afghan Telecommunications Firm Roshan

Microsoft Digital Defense Report OCTOBER 2021

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Microsoft Digital Defense Report OCTOBER 2021

Indonesian intelligence agency compromised in suspected Chinese hack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Indonesian intelligence agency compromised in suspected Chinese hack

Advanced Persistent Threats (APTs)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Advanced Persistent Threats (APTs)

Quarians, Turians and…QuickHeal

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Quarians, Turians and…QuickHeal

D1T1%20-%20%20ShadowPad%20-%20A%20Masterpiece%20of%20Privately%20Sold%20Malware%20in%20Chinese%20Espionage%20-%20Yi-Jhen%20Hsieh%20&%20Joey%20Chen.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor D1T1%20-%20%20ShadowPad%20-%20A%20Masterpiece%20of%20Privately%20Sold%20Malware%20in%20Chinese%20Espionage%20-%20Yi-Jhen%20Hsieh%20&%20Joey%20Chen.pdf

THOR: Previously Unseen PlugX Variant Deployed During Microsoft Exchange Server Attacks by PKPLUG Group

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor THOR: Previously Unseen PlugX Variant Deployed During Microsoft Exchange Server Attacks by PKPLUG Group

LuminousMoth – PlugX, File Exfiltration and Persistence Revisited

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor LuminousMoth – PlugX, File Exfiltration and Persistence Revisited

Threat Activity Group RedFoxtrot Linked to China’s PLA Unit 69010; Targets Bordering Asian Countries

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Activity Group RedFoxtrot Linked to China’s PLA Unit 69010; Targets Bordering Asian Countries

BackdoorDiplomacy: Upgrading from Quarian to Turian

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BackdoorDiplomacy: Upgrading from Quarian to Turian

BackdoorDiplomacy- Upgrading from Quarian to Turian

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor BackdoorDiplomacy- Upgrading from Quarian to Turian

RedDelta PlugX Undergoing Changes and Overlapping Again with Mustang Panda PlugX Infrastructure

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedDelta PlugX Undergoing Changes and Overlapping Again with Mustang Panda PlugX Infrastructure

Mustang Panda PlugX - 45.251.240.55 Pivot

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Mustang Panda PlugX - 45.251.240.55 Pivot

PowerPoint 簡報

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PowerPoint 簡報

RedEcho group parks domains after public exposure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RedEcho group parks domains after public exposure

Exchange servers under siege from at least 10 APT groups

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Exchange servers under siege from at least 10 APT groups

China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions

Cyber Threats 2020: A Year in Retrospect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Threats 2020: A Year in Retrospect

Report2021GTR.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Report2021GTR.pdf

https---www.ptsecurity.com-ww-en-analytics-antisandbox-techniques-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor https---www.ptsecurity.com-ww-en-analytics-antisandbox-techniques-

Analytics

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Analytics

Investigation into PlugX Uncovers Unique APT Technique

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Investigation into PlugX Uncovers Unique APT Technique

CRACKING A SOFT CELL IS HARDER THAN YOU THINK

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CRACKING A SOFT CELL IS HARDER THAN YOU THINK

Higaisa or Winnti? APT41 backdoors, old and new

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Higaisa or Winnti? APT41 backdoors, old and new

China's APT hackers move to ransomware attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China's APT hackers move to ransomware attacks

China cyber attacks- the current threat landscape

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor China cyber attacks- the current threat landscape

Operation StealthyTrident: corporate software under attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation StealthyTrident: corporate software under attack

APT group targeting governmental agencies in East Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT group targeting governmental agencies in East Asia

TA416's Golang PlugX Malware Loader | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TA416's Golang PlugX Malware Loader | Proofpoint US

Weaponizing Open Source Software for Targeted Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Weaponizing Open Source Software for Targeted Attacks

APT trends report Q3 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q3 2020

APT41: Indictments Put Chinese Espionage Group in the Spotlight

Malpedia library date Symantec fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT41: Indictments Put Chinese Espionage Group in the Spotlight

Back Despite Disruption: RedDelta Resumes Operations

Malpedia library date Insikt Group® fromORKL

Archived copy on ORKL Detailsfor Back Despite Disruption: RedDelta Resumes Operations

Research Roundup: Activity on Previously Identified APT33 Domains | ThreatConnect

Malpedia library date ThreatConnect fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Research Roundup: Activity on Previously Identified APT33 Domains | ThreatConnect

ESET_Threat_Report_Q22020.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET_Threat_Report_Q22020.pdf

APT trends report Q2 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q2 2020

What even is Winnti? - Risky Business Media

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What even is Winnti? - Risky Business Media

Chinese state hackers target Hong Kong Catholic Church

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese state hackers target Hong Kong Catholic Church

Accenture | Let there be change

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Accenture | Let there be change

Multiyear Surveillance Campaigns Discovered Targeting Uyghurs

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Multiyear Surveillance Campaigns Discovered Targeting Uyghurs

BfV Cyber-Brief Nr. 01/2020

file creation date Bundesamt für Verfassungsschutz fromORKL

The original link failed its last check. Original publisher Detailsfor BfV Cyber-Brief Nr. 01/2020

Cycldek: Bridging the (air) gap

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cycldek: Bridging the (air) gap

Mustang Panda Recent Activity: Dll-Sideloading trojans with temporal C2 servers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mustang Panda Recent Activity: Dll-Sideloading trojans with temporal C2 servers

lookout-uyghur-malware-tr-us

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor lookout-uyghur-malware-tr-us

Intezer - The Evolution of APT15's Codebase 2020

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Intezer - The Evolution of APT15's Codebase 2020

The Evolution of APT15’s Codebase 2020

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Evolution of APT15’s Codebase 2020

The Evolution of APT15’s Codebase 2020

Malpedia library date Intezer fromORKLCCS '25 data

Archived copy on ORKL Detailsfor The Evolution of APT15’s Codebase 2020

Mikroceen: Spying backdoor leveraged in high-profile networks in Central Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mikroceen: Spying backdoor leveraged in high-profile networks in Central Asia

The energy reserves in the Eastern Mediterranean Sea and a malicious campaign of APT10 against Turkey

Malpedia library date Lab52 fromORKLCCS '25 data

Archived copy on ORKL Detailsfor The energy reserves in the Eastern Mediterranean Sea and a malicious campaign of APT10 against Turkey

COVID-19 Themes Are Being Utilized by Threat Actors of Varying Sophistication

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor COVID-19 Themes Are Being Utilized by Threat Actors of Varying Sophistication

Phân tích mã độc lợi dụng dịch Covid-19 để phát tán giả mạo “Chỉ thị của thủ tướng Nguyễn Xuân Phúc” - Phần

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Phân tích mã độc lợi dụng dịch Covid-19 để phát tán giả mạo “Chỉ thị của thủ tướng Nguyễn Xuân Phúc” - Phần

Is APT 27 Abusing COVID-19 To Attack People !

date in the CCS '25 data Yoroi fromCCS '25 data

The original link failed its last check. Detailsfor Is APT 27 Abusing COVID-19 To Attack People !

Phân tích mã độc lợi dụng dịch Covid-19 để phát tán giả mạo “Chỉ thị của thủ tướng Nguyễn Xuân Phúc” - Phần 1 - VinCSS Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Phân tích mã độc lợi dụng dịch Covid-19 để phát tán giả mạo “Chỉ thị của thủ tướng Nguyễn Xuân Phúc” - Phần 1 - VinCSS Blog

the adversary playbook for the long-standing espionage activity of a Chinese nation-state adversary

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor the adversary playbook for the long-standing espionage activity of a Chinese nation-state adversary

Operation DRBControl: Uncovering a Cyberespionage Campaign Targeting Gambling Companies in Southeast Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation DRBControl: Uncovering a Cyberespionage Campaign Targeting Gambling Companies in Southeast Asia

CLAMBLING - A New Backdoor Base On Dropbox (EN)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CLAMBLING - A New Backdoor Base On Dropbox (EN)

Microsoft Word - Threat Intelligence and the Limits of Malware Analysis_smc1.docx

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Word - Threat Intelligence and the Limits of Malware Analysis_smc1.docx

Fresh PlugX October 2019

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Fresh PlugX October 2019

APT cases exploiting vulnerabilities in region‑specific software

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT cases exploiting vulnerabilities in region‑specific software

Analytics

Malpedia library date Positive Technologies fromORKLCCS '25 data

The original link failed its last check. Original publisher Detailsfor Analytics

APT15

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT15

APT15

date in the CCS '25 data Intezer fromCCS '25 data

The original link failed its last check. Detailsfor APT15

New threat group behind Airbus cyber attacks, claim researchers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New threat group behind Airbus cyber attacks, claim researchers

PKPLUG: Chinese Cyber Espionage Group Attacking Southeast Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PKPLUG: Chinese Cyber Espionage Group Attacking Southeast Asia

Analytics

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Analytics

Operation-Taskmasters-2019-eng

date in the CCS '25 data Positive Technologies fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation-Taskmasters-2019-eng

ESET_Okrum_and_Ketrican.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor ESET_Okrum_and_Ketrican.pdf

Okrum: Ke3chang group targets diplomatic missions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Okrum: Ke3chang group targets diplomatic missions

Okrum- Ke3chang group targets diplomatic missions

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Okrum- Ke3chang group targets diplomatic missions

ESET_Okrum_and_Ketrican

date in the CCS '25 data ESET fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ESET_Okrum_and_Ketrican

Threat Group Cards: A Threat Actor Encyclopedia

file creation date ThaiCERT fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Threat Group Cards: A Threat Actor Encyclopedia

Threat Group Cards: A Threat Actor Encyclopedia

file creation date Martijn van der Heide fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia

Into the Fog - The Return of ICEFOG APT

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Into the Fog - The Return of ICEFOG APT

Into the Fog - The Return of ICEFOG APT

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Into the Fog - The Return of ICEFOG APT

Uncovering New Activity By APT10 | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Uncovering New Activity By APT10 | FortiGuard Labs

rpt-mtrends-2019.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor rpt-mtrends-2019.pdf

SectorM04 Targeting Singapore – An Analysis – Red Alert

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SectorM04 Targeting Singapore – An Analysis – Red Alert

rpt-mtrends-2019

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor rpt-mtrends-2019

Operation Red Signature Targets South Korean Companies

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Red Signature Targets South Korean Companies

Malicious document targets Vietnamese officials

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malicious document targets Vietnamese officials

MirageFox: APT15 Resurfaces With New Tools Based On Old Ones - Intezer

date in the CCS '25 data Intezer fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor MirageFox: APT15 Resurfaces With New Tools Based On Old Ones - Intezer

Malware Analysis – PlugX – Part 2

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Analysis – PlugX – Part 2

Royal APT - APT15 Repository

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Royal APT - APT15 Repository

Royal APT - APT15 Repository

date in the CCS '25 data NCC Group fromCCS '25 data

Detailsfor Royal APT - APT15 Repository

New tools uncovered from hacking group APT15

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor New tools uncovered from hacking group APT15

Time of death? A therapeutic postmortem of connected medicine

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Time of death? A therapeutic postmortem of connected medicine

APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS

date in the CCS '25 data NCC Group fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS

APT15 is alive and strong- An analysis of RoyalCli and RoyalDNS

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT15 is alive and strong- An analysis of RoyalCli and RoyalDNS

Cyber Security Research

Malpedia library date NCC Group fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Cyber Security Research

An analysis of RoyalCli and RoyalDNS

date in the CCS '25 data NCC Group fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor An analysis of RoyalCli and RoyalDNS

Malware Analysis – PlugX

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Analysis – PlugX

PlugXと攻撃者グループ "DragonOK"の関連性 | LAC WATCH

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PlugXと攻撃者グループ "DragonOK"の関連性 | LAC WATCH

Advanced Persistent Threat Groups

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Advanced Persistent Threat Groups

Paranoid PlugX

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Paranoid PlugX

Intrusions Affecting Multiple Victims Across Multiple Sectors | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Intrusions Affecting Multiple Victims Across Multiple Sectors | CISA

RedLeaves - Malware Based on Open Source RAT - JPCERT/CC Eyes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RedLeaves - Malware Based on Open Source RAT - JPCERT/CC Eyes

Unpacking the spyware disguised as antivirus | Malwarebytes Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unpacking the spyware disguised as antivirus | Malwarebytes Labs

security_report_20160613.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor security_report_20160613.pdf

Operation Ke3chang Resurfaces With New TidePool Malware

file creation date Palo Alto fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Operation Ke3chang Resurfaces With New TidePool Malware

Operation Ke3chang Resurfaces With New TidePool Malware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Operation Ke3chang Resurfaces With New TidePool Malware

Operation Ke3chang Resurfaces With New TidePool Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Ke3chang Resurfaces With New TidePool Malware

Operation Ke3chang Resurfaces With New TidePool Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Ke3chang Resurfaces With New TidePool Malware

Operation Ke3chang Resurfaces With New TidePool Malware - Palo Alto Networks BlogPalo Alto Networks Blog

date in the CCS '25 data Palo Alto fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation Ke3chang Resurfaces With New TidePool Malware - Palo Alto Networks BlogPalo Alto Networks Blog

PowerPoint Presentation

date in the CCS '25 data CrowdStrike fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor PowerPoint Presentation

Targeted Attack Distributes PlugX in Russia | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Targeted Attack Distributes PlugX in Russia | Proofpoint US

Uncovering the Seven Pointed Dagger

Malpedia library date Arbor Networks fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Uncovering the Seven Pointed Dagger

Elite cyber crime group strikes back after attack by rival APT gang

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Elite cyber crime group strikes back after attack by rival APT gang

Global Threat Intel Report

Malpedia library date Crowdstrike fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Global Threat Intel Report

Chinese hackers 'breach Australian media' ahead of G20

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese hackers 'breach Australian media' ahead of G20

Chinese hackers 'breach Australian media organisations' ahead of G20

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Chinese hackers 'breach Australian media organisations' ahead of G20

Putter Panda

Malpedia library date Crowdstrike fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Putter Panda

OPERATION “KE3CHANG”-Targeted Attacks Against Ministries of Foreign Affairs

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor OPERATION “KE3CHANG”-Targeted Attacks Against Ministries of Foreign Affairs

Cloud Security Resources

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cloud Security Resources

Operation Ke3Chang Targeted Attacks Against Ministries Of Foreign Affairs

file creation date FireEye fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation Ke3Chang Targeted Attacks Against Ministries Of Foreign Affairs

CrowdCasts Monthly: You Have an Adversary Problem

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor CrowdCasts Monthly: You Have an Adversary Problem

BKDR_RARSTONE: New RAT to Watch Out For - TrendLabs Security Intelligence Blog

Malpedia library date fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor BKDR_RARSTONE: New RAT to Watch Out For - TrendLabs Security Intelligence Blog

TDL4 - Purple Haze (Pihar) Variant - sample and analysis

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor TDL4 - Purple Haze (Pihar) Variant - sample and analysis

TDL4 - Purple Haze (Pihar) Variant - sample and analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TDL4 - Purple Haze (Pihar) Variant - sample and analysis