Carbanak

Hackers abuse Google Apps Script to steal credit cards, bypass CSP

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Hackers abuse Google Apps Script to steal credit cards, bypass CSP

Odinaff Trojan attacks banks and more, monitoring networks and stealing credentials

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Odinaff Trojan attacks banks and more, monitoring networks and stealing credentials

FIN7 Backdoor Masquerades as Ethical Hacking Tool

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor FIN7 Backdoor Masquerades as Ethical Hacking Tool

Cobalt Group - Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Cobalt Group - Threat Group Cards: A Threat Actor Encyclopedia

Unveiling the intricacies of DiceLoader

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Unveiling the intricacies of DiceLoader

The Hunt for Lurk

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor The Hunt for Lurk

Malware Unpacking With Hardware Breakpoints - Cobalt Strike Shellcode Loader

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Malware Unpacking With Hardware Breakpoints - Cobalt Strike Shellcode Loader

Carbanak, Anunak - Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Carbanak, Anunak - Threat Group Cards: A Threat Actor Encyclopedia

FIN7 Spear Phishing Campaign Targets Personnel Involved in SEC Filings « FIN7 Spear Phishing Campaign Targets Personnel Involved in SEC Filings

date ORKL added it fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor FIN7 Spear Phishing Campaign Targets Personnel Involved in SEC Filings « FIN7 Spear Phishing Campaign Targets Personnel Involved in SEC Filings

How to Use Ghidra to Analyse Shellcode and Extract Cobalt Strike Command & Control Servers

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor How to Use Ghidra to Analyse Shellcode and Extract Cobalt Strike Command & Control Servers

REvil (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor REvil (Malware Family)

Metel Bank Robbers Borrowing from APT Attacks

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Metel Bank Robbers Borrowing from APT Attacks

Ghidra Tutorial - Using Entropy To Locate Cobalt Strike Decryption Functions

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Ghidra Tutorial - Using Entropy To Locate Cobalt Strike Decryption Functions

IcedID (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor IcedID (Malware Family)

Another Alleged FIN7 Cybercrime Gang Member Arrested

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Another Alleged FIN7 Cybercrime Gang Member Arrested

MimiKatz (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor MimiKatz (Malware Family)

The Evolution of the FIN7 JSSLoader

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor The Evolution of the FIN7 JSSLoader

Carbanak Banking Malware Resurfaces with New Ransomware Tactics

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Carbanak Banking Malware Resurfaces with New Ransomware Tactics

Griffon (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Griffon (Malware Family)

FIN7 sysadmin behind "billions in damage" gets 10 years

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor FIN7 sysadmin behind "billions in damage" gets 10 years

DarkSide (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor DarkSide (Malware Family)

Fileless attacks against enterprise networks

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Fileless attacks against enterprise networks

Cobalt Strike (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Cobalt Strike (Malware Family)

Three Members of Notorious International Cybercrime Group “Fin7” In Custody for Role in Attacking Over 100 U.S. companies

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Three Members of Notorious International Cybercrime Group “Fin7” In Custody for Role in Attacking Over 100 U.S. companies

The Great Bank Robbery: the Carbanak APT

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor The Great Bank Robbery: the Carbanak APT

Consequences - The Conti Leaks and future problems

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Consequences - The Conti Leaks and future problems

Financially motivated threat actors misusing App Installer | Microsoft Security Blog

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Financially motivated threat actors misusing App Installer | Microsoft Security Blog

Threat Intelligence Query Examples - Real World Queries for Identifying Malware Infrastructure

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Threat Intelligence Query Examples - Real World Queries for Identifying Malware Infrastructure

The Shadow Campaigns: Uncovering Global Espionage

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Shadow Campaigns: Uncovering Global Espionage

The Notepad++ supply chain attack — unnoticed execution chains and new IoCs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Notepad++ supply chain attack — unnoticed execution chains and new IoCs

GOGITTER, GITSHELLPAD, and GOSHELL Analysis | ThreatLabz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GOGITTER, GITSHELLPAD, and GOSHELL Analysis | ThreatLabz

From a New Year's surprise to a bag of coal - Analysis of mystery PowerShell

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From a New Year's surprise to a bag of coal - Analysis of mystery PowerShell

Multiple Threat Actors Leveraging CVE-2025-55182 (React2Shell)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Multiple Threat Actors Leveraging CVE-2025-55182 (React2Shell)

APT24's Pivot to Multi-Vector Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT24's Pivot to Multi-Vector Attacks

The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns

UAT-8099: Chinese-speaking cybercrime group targets high-value IIS for SEO fraud

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UAT-8099: Chinese-speaking cybercrime group targets high-value IIS for SEO fraud

From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion

Chinese Hackers RedNovember Target Global Governments Using Pantegana and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese Hackers RedNovember Target Global Governments Using Pantegana and Cobalt Strike

TAOTH Campaign Exploits End-of-Support Software to Target Traditional Chinese Users and Dissidents

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TAOTH Campaign Exploits End-of-Support Software to Target Traditional Chinese Users and Dissidents

ShadowSilk: A Cross-Border Binary Union for Data Exfiltration | Group-IB Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ShadowSilk: A Cross-Border Binary Union for Data Exfiltration | Group-IB Blog

TLP-CLEAR-31072025-ShadowSyndicate-infrastructure-illumination-EN.pdf

Malpedia library date Julien DUGAY fromORKL

Archived copy on ORKL Detailsfor TLP-CLEAR-31072025-ShadowSyndicate-infrastructure-illumination-EN.pdf

The SOC files: Rumble in the jungle or APT41’s new target in Africa

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The SOC files: Rumble in the jungle or APT41’s new target in Africa

Dissecting the ClickFix User-Execution Attack and Its Sophisticated Persistence via ADS

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dissecting the ClickFix User-Execution Attack and Its Sophisticated Persistence via ADS

Phish and Chips: China-Aligned Espionage Actors Ramp Up Taiwan Semiconductor Industry Targeting | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Phish and Chips: China-Aligned Espionage Actors Ramp Up Taiwan Semiconductor Industry Targeting | Proofpoint US

Scattered Spider: Rapid7 Insights, Observations, and Recommendations

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Scattered Spider: Rapid7 Insights, Observations, and Recommendations

Cyber%20Threat%20Intelligence%20Report%202025.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber%20Threat%20Intelligence%20Report%202025.pdf

Threat Hunting Introduction: Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Hunting Introduction: Cobalt Strike

Cobalt Strike Operators Leverage PowerShell Loaders Across Chinese, Russian, and Global Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Operators Leverage PowerShell Loaders Across Chinese, Russian, and Global Infrastructure

Team46 and TaxOff: two sides of the same coin

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Team46 and TaxOff: two sides of the same coin

GrayAlpha Unmasked: New FIN7-Linked Infrastructure, PowerNet Loader, and Fake Update Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GrayAlpha Unmasked: New FIN7-Linked Infrastructure, PowerNet Loader, and Fake Update Attacks

GrayAlpha Uses Diverse Infection Vectors to Deploy PowerNet Loader and NetSupport RAT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GrayAlpha Uses Diverse Infection Vectors to Deploy PowerNet Loader and NetSupport RAT

Earth Lamia Develops Custom Arsenal to Target Multiple Industries

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Lamia Develops Custom Arsenal to Target Multiple Industries

Another Confluence Bites the Dust: Falling to ELPACO-team Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Another Confluence Bites the Dust: Falling to ELPACO-team Ransomware

Malware Analysis - Ave_Maria RAT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Analysis - Ave_Maria RAT

Nitrogen Dropping Cobalt Strike – A Combination of “Chemical Elements”

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Nitrogen Dropping Cobalt Strike – A Combination of “Chemical Elements”

m-trends-2025-en.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor m-trends-2025-en.pdf

Operation HollowQuill: Malware delivered into Russian R&D Networks via Research Decoy PDFs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation HollowQuill: Malware delivered into Russian R&D Networks via Research Decoy PDFs

The Espionage Toolkit of Earth Alux A Closer Look at its Advanced Techniques

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Espionage Toolkit of Earth Alux A Closer Look at its Advanced Techniques

UAT-5918 targets critical infrastructure entities in Taiwan

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UAT-5918 targets critical infrastructure entities in Taiwan

CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia

JSAC2025_1_5_leon-chang_theo-chen_en.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor JSAC2025_1_5_leon-chang_theo-chen_en.pdf

Jul-Dec%202024%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Jul-Dec%202024%20Botnet%20Threat%20Update.pdf

Golang Beacons and VS Code Tunnels: Tracking a Cobalt Strike Server Leveraging Trusted Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Golang Beacons and VS Code Tunnels: Tracking a Cobalt Strike Server Leveraging Trusted Infrastructure

Black Basta Ransomware Campaign Drops Zbot, DarkGate, and Custom Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Black Basta Ransomware Campaign Drops Zbot, DarkGate, and Custom Malware

Rare Watermark Links Cobalt Strike 4.10 Team Servers to Ongoing Suspicious Activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rare Watermark Links Cobalt Strike 4.10 Team Servers to Ongoing Suspicious Activity

The Curious Case of an Egg-Cellent Resume

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor The Curious Case of an Egg-Cellent Resume

Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella

CARBANAK (aka ANUNAK) Distributed via IDATLOADER (aka HIJACKLOADER)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CARBANAK (aka ANUNAK) Distributed via IDATLOADER (aka HIJACKLOADER)

China-Nexus TAG-112 Compromises Tibetan Websites to Distribute Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-Nexus TAG-112 Compromises Tibetan Websites to Distribute Cobalt Strike

China-Nexus TAG-112 Compromises Tibetan Websites to Distribute Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-Nexus TAG-112 Compromises Tibetan Websites to Distribute Cobalt Strike

Tricks, Treats, and Threats: Cobalt Strike & the Goblin Lurking in Plain Sight

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tricks, Treats, and Threats: Cobalt Strike & the Goblin Lurking in Plain Sight

Jumpy Pisces Engages in Play Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Jumpy Pisces Engages in Play Ransomware

Operation Cobalt Whisper: Threat Actor Targets Multiple Industries Across Hong Kong and Pakistan.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Cobalt Whisper: Threat Actor Targets Multiple Industries Across Hong Kong and Pakistan.

Threat Spotlight: WarmCookie/BadSpace

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Spotlight: WarmCookie/BadSpace

Highlighting TA866/Asylum Ambuscade Activity Since 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Highlighting TA866/Asylum Ambuscade Activity Since 2021

Unmasking Adversary Infrastructure: How Certificates and Redirects Exposed Earth Baxia and PlugX Activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unmasking Adversary Infrastructure: How Certificates and Redirects Exposed Earth Baxia and PlugX Activity

Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdf

The Russian APT Tool Matrix

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Russian APT Tool Matrix

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/earth-baxia-uses-spear-phishing-and-geoserver-exploit-to-target-apac/IOCs%20-%20Earth%20Baxia%20Uses%20Spear-Phishing%20and%20GeoServer%20Exploit%20to%20Target%20APAC.txt

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/earth-baxia-uses-spear-phishing-and-geoserver-exploit-to-target-apac/IOCs%20-%20Earth%20Baxia%20Uses%20Spear-Phishing%20and%20GeoServer%20Exploit%20to%20Target%20APAC.txt

Earth Baxia Uses Spear-Phishing and GeoServer Exploit to Target APAC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Baxia Uses Spear-Phishing and GeoServer Exploit to Target APAC

From Cobalt Strike to Mimikatz: A Deep Dive into the SLOW#TEMPEST Campaign Targeting Chinese Users

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From Cobalt Strike to Mimikatz: A Deep Dive into the SLOW#TEMPEST Campaign Targeting Chinese Users

BlackSuit Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor BlackSuit Ransomware

Sailing_the_Seven_SEAs_Deep_Dive_into_Polaris_Arsenal_and_Intelligence_Insights.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sailing_the_Seven_SEAs_Deep_Dive_into_Polaris_Arsenal_and_Intelligence_Insights.pdf

Pirates_of_The_Nang_Hai_Follow_the_Artifacts_of_Tropic_Trooper,_No_One_Knows.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Pirates_of_The_Nang_Hai_Follow_the_Artifacts_of_Tropic_Trooper,_No_One_Knows.pdf

AppDomainManager Injectionを悪用したマルウェアによる攻撃について

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AppDomainManager Injectionを悪用したマルウェアによる攻撃について

Chinese APT abuses MSC files with GrimResource vulnerability

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese APT abuses MSC files with GrimResource vulnerability

Finding Malware: Unveiling NUMOZYLOD with Google Security Operations

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Finding Malware: Unveiling NUMOZYLOD with Google Security Operations

Ongoing Social Engineering Campaign Refreshes Payloads

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ongoing Social Engineering Campaign Refreshes Payloads

Decoding a Cobalt Strike Downloader Script With CyberChef

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Decoding a Cobalt Strike Downloader Script With CyberChef

APT41 likely compromised Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT41 likely compromised Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike

UAC-0057 Attack Detection: A Surge in Adversary Activity Distributing PICASSOLOADER and Cobalt Strike Beacon

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UAC-0057 Attack Detection: A Surge in Adversary Activity Distributing PICASSOLOADER and Cobalt Strike Beacon

A Beginner's Guide to Hunting Malicious Open Directories - Censys

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Beginner's Guide to Hunting Malicious Open Directories - Censys

APT41 Has Arisen From the DUST

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT41 Has Arisen From the DUST

TAG-100 Uses Open-Source Tools in Suspected Global Espionage Campaign, Compromising Two Asia-Pacific Intergovernmental Bodies

Malpedia library date Insikt Group® by Recorded Future® fromORKL

Archived copy on ORKL Detailsfor TAG-100 Uses Open-Source Tools in Suspected Global Espionage Campaign, Compromising Two Asia-Pacific Intergovernmental Bodies

DodgeBox | ThreatLabz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DodgeBox | ThreatLabz

Jan-Jun%202024%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Jan-Jun%202024%20Botnet%20Threat%20Update.pdf

Exposing FakeBat loader: distribution methods and adversary infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Exposing FakeBat loader: distribution methods and adversary infrastructure

GrimResource - Microsoft Management Console for initial access and evasion

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GrimResource - Microsoft Management Console for initial access and evasion

IcedID Brings ScreenConnect and CSharp Streamer to ALPHV Ransomware Deployment

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor IcedID Brings ScreenConnect and CSharp Streamer to ALPHV Ransomware Deployment

Sharp Dragon Expands Towards Africa and The Caribbean - Check Point Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sharp Dragon Expands Towards Africa and The Caribbean - Check Point Research

Operation Diplomatic Specter: An Active Chinese Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Diplomatic Specter: An Active Chinese Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia

Chinese Espionage Campaign Expands to Target Africa and The Caribbean

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese Espionage Campaign Expands to Target Africa and The Caribbean

Threat actors misusing Quick Assist in social engineering attacks leading to ransomware | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat actors misusing Quick Assist in social engineering attacks leading to ransomware | Microsoft Security Blog

QakBot attacks with Windows zero-day (CVE-2024-30051)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor QakBot attacks with Windows zero-day (CVE-2024-30051)

Ongoing Social Engineering Campaign Linked to Black Basta Ransomware Operators

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ongoing Social Engineering Campaign Linked to Black Basta Ransomware Operators

Securonix Threat Research Security Advisory: Analysis of Ongoing FROZEN#SHADOW Attack Campaign Leveraging SSLoad Malware and RMM Software for Domain Takeover

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Securonix Threat Research Security Advisory: Analysis of Ongoing FROZEN#SHADOW Attack Campaign Leveraging SSLoad Malware and RMM Software for Domain Takeover

[QuickNote] Phishing email distributes WarZone RAT via DBatLoader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor [QuickNote] Phishing email distributes WarZone RAT via DBatLoader

From OneNote to RansomNote: An Ice Cold Intrusion

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor From OneNote to RansomNote: An Ice Cold Intrusion

Rewterz Threat Alert – China-Linked Earth Krahang APT Breached 70 Organizations in 23 Nations – Active IOCs - Rewterz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rewterz Threat Alert – China-Linked Earth Krahang APT Breached 70 Organizations in 23 Nations – Active IOCs - Rewterz

Malware Analysis — Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Analysis — Cobalt Strike

FBI seizes Warzone RAT infrastructure, arrests malware vendor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor FBI seizes Warzone RAT infrastructure, arrests malware vendor

International Cybercrime Malware Service Dismantled by Federal Authorities: Key Malware Sales and Support Actors in Malta and Nigeria Charged in Federal Indictments

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor International Cybercrime Malware Service Dismantled by Federal Authorities: Key Malware Sales and Support Actors in Malta and Nigeria Charged in Federal Indictments

A Beginner's Guide to Tracking Malware Infrastructure - Censys

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Beginner's Guide to Tracking Malware Infrastructure - Censys

JSAC2024_2_7_hara_shoji_higashi_vickie-su_nick-dai_en.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor JSAC2024_2_7_hara_shoji_higashi_vickie-su_nick-dai_en.pdf

Q4%202023%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Q4%202023%20Botnet%20Threat%20Update.pdf

2023 Adversary Infrastructure Report

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023 Adversary Infrastructure Report

Rewterz Threat Alert - Widely Abused MSIX App Installer Disabled by Microsoft – Active IOCs - Rewterz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rewterz Threat Alert - Widely Abused MSIX App Installer Disabled by Microsoft – Active IOCs - Rewterz

How to Use Ghidra to Analyse Shellcode and Extract Cobalt Strike Command & Control Servers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How to Use Ghidra to Analyse Shellcode and Extract Cobalt Strike Command & Control Servers

SQL Brute Force Leads to BlueSky Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor SQL Brute Force Leads to BlueSky Ransomware

Combining Pivot Points to Identify Malware Infrastructure - Redline, Smokeloader and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Combining Pivot Points to Identify Malware Infrastructure - Redline, Smokeloader and Cobalt Strike

Scattered Spider

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Scattered Spider

Scattered Spider | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Scattered Spider | CISA

HostingHunter Series: CHANG WAY TECHNOLOGIES CO. LIMITED

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor HostingHunter Series: CHANG WAY TECHNOLOGIES CO. LIMITED

The New APT Group DarkCasino and the Global Surge in WinRAR 0-Day Exploits - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.

Malpedia library date NSFOCUS fromORKLCCS '25 data

Archived copy on ORKL Detailsfor The New APT Group DarkCasino and the Global Surge in WinRAR 0-Day Exploits - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.

New Gootloader Variant “GootBot” Changes the Game in Malware Tactics

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Gootloader Variant “GootBot” Changes the Game in Malware Tactics

Malware Unpacking With Hardware Breakpoints - Cobalt Strike Shellcode Loader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Unpacking With Hardware Breakpoints - Cobalt Strike Shellcode Loader

Popping Blisters for research: An overview of past payloads and exploring recent developments

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Popping Blisters for research: An overview of past payloads and exploring recent developments

CERTFR-2023-CTI-009.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERTFR-2023-CTI-009.pdf

Kazakhstan-associated YoroTrooper disguises origin of attacks as Azerbaijan

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Kazakhstan-associated YoroTrooper disguises origin of attacks as Azerbaijan

Cobalt Strike .VBS Loader - Decoding with Advanced CyberChef and Emulation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike .VBS Loader - Decoding with Advanced CyberChef and Emulation

Cobalt Strike Malware Analysis With CyberChef and Emulation - .HTA Loader Example

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Malware Analysis With CyberChef and Emulation - .HTA Loader Example

Ghidra Tutorial - Using Entropy To Locate Cobalt Strike Decryption Functions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ghidra Tutorial - Using Entropy To Locate Cobalt Strike Decryption Functions

Forensic Timeline of an IcedID Infection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Forensic Timeline of an IcedID Infection

2023%20Q3%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023%20Q3%20Botnet%20Threat%20Update.pdf

Grayling: Previously Unseen Threat Actor Targets Multiple Organizations in Taiwan

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Grayling: Previously Unseen Threat Actor Targets Multiple Organizations in Taiwan

Backchannel Diplomacy: APT29's Rapidly Evolving Diplomatic Phishing Operations | Mandiant

Malpedia library date Mandiant fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Backchannel Diplomacy: APT29's Rapidly Evolving Diplomatic Phishing Operations | Mandiant

Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda

Malware distributor Storm-0324 facilitates ransomware access | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware distributor Storm-0324 facilitates ransomware access | Microsoft Security Blog

CERTFR-2023-CTI-007.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERTFR-2023-CTI-007.pdf

Uncovering DDGroup — A long-time threat actor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Uncovering DDGroup — A long-time threat actor

aa23-250a-apt-actors-exploit-cve-2022-47966-and-cve-2022-42475.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor aa23-250a-apt-actors-exploit-cve-2022-47966-and-cve-2022-42475.pdf

Earth Estries Targets Government, Tech for Cyberespionage

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Estries Targets Government, Tech for Cyberespionage

HTML Smuggling Leads to Domain Wide Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor HTML Smuggling Leads to Domain Wide Ransomware

Technical analysis of WarZoneRAT malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Technical analysis of WarZoneRAT malware

Analysis of APT Attack Cases Targeting Web Services of Korean Corporations - ASEC

Malpedia library date AhnLab fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Analysis of APT Attack Cases Targeting Web Services of Korean Corporations - ASEC

Andariel 그룹의 새로운 공격 활동 분석 - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Andariel 그룹의 새로운 공격 활동 분석 - ASEC

Understanding Syscalls: Direct, Indirect, and Cobalt Strike Implementation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Understanding Syscalls: Direct, Indirect, and Cobalt Strike Implementation

Unmasking CamoFei An In-depth Analysis of an Emerging APT Group Focused on Healthcare Sectors in East Asia

date in the CCS '25 data Team T5 fromCCS '25 data

Detailsfor Unmasking CamoFei An In-depth Analysis of an Emerging APT Group Focused on Healthcare Sectors in East Asia

Chinese Entanglement | DLL Hijacking in the Asian Gambling Sector

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese Entanglement | DLL Hijacking in the Asian Gambling Sector

Unmasking CamoFei

file creation date fromORKL

Archived copy on ORKL Detailsfor Unmasking CamoFei

RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale

gcat_threathorizons_full_jul2023.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor gcat_threathorizons_full_jul2023.pdf

Malware development trick - part 35: Store payload in alternate data streams. Simple C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development trick - part 35: Store payload in alternate data streams. Simple C++ example.

2023%20Q2%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023%20Q2%20Botnet%20Threat%20Update.pdf

Beyond appearances: unknown actor using APT29’s TTP against Chinese users

Malpedia library date Lab52 fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Beyond appearances: unknown actor using APT29’s TTP against Chinese users

Cobalt Strike’s Deployment with Hardware Breakpoint for AMSI Bypass

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike’s Deployment with Hardware Breakpoint for AMSI Bypass

Securonix Threat Labs Security Advisory: New MULTI#STORM Attack Campaign Involving Python-based Loader Masquerading as OneDrive Utilities Dropping Multiple RAT Payloads Using Security Analytics

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Securonix Threat Labs Security Advisory: New MULTI#STORM Attack Campaign Involving Python-based Loader Masquerading as OneDrive Utilities Dropping Multiple RAT Payloads Using Security Analytics

PicassoLoader and Cobalt Strike Beacon Detection: UAC-0057 aka GhostWriter Hacking Group Attacks the Ukrainian Leading Military Educational Institution

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PicassoLoader and Cobalt Strike Beacon Detection: UAC-0057 aka GhostWriter Hacking Group Attacks the Ukrainian Leading Military Educational Institution

eSentire Threat Intelligence Malware Analysis: Resident Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eSentire Threat Intelligence Malware Analysis: Resident Campaign

Threat Intelligence Query Examples - Real World Queries for Identifying Malware Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Intelligence Query Examples - Real World Queries for Identifying Malware Infrastructure

Malware development trick - part 28: Dump lsass.exe. Simple C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development trick - part 28: Dump lsass.exe. Simple C++ example.

Tomiris called, they want their Turla malware back

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tomiris called, they want their Turla malware back

Malware-Analysis/Cobalt Strike/Indirect Syscalls.md at main · dodo-sec/Malware-Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware-Analysis/Cobalt Strike/Indirect Syscalls.md at main · dodo-sec/Malware-Analysis

Ex-Conti and FIN7 Actors Collaborate with New Domino Backdoor

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Ex-Conti and FIN7 Actors Collaborate with New Domino Backdoor

Following the Lazarus group by tracking DeathNote campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Following the Lazarus group by tracking DeathNote campaign

2023%20Q1%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023%20Q1%20Botnet%20Threat%20Update.pdf

ALPHV Ransomware Affiliate Targets Vulnerable Backup Installations to Gain Initial Access | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ALPHV Ransomware Affiliate Targets Vulnerable Backup Installations to Gain Initial Access | Mandiant

Malicious ISO File Leads to Domain Wide Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Malicious ISO File Leads to Domain Wide Ransomware

1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf

With KEYPLUG, China’s RedGolf Spies On, Steals From Wide Field of Targets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor With KEYPLUG, China’s RedGolf Spies On, Steals From Wide Field of Targets

eSentire Threat Intelligence Malware Analysis: BatLoader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eSentire Threat Intelligence Malware Analysis: BatLoader

Mélofée: a new alien malware in the Panda's toolset targeting Linux hosts

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mélofée: a new alien malware in the Panda's toolset targeting Linux hosts

[QuickNote] Decrypting the C2 configuration of Warzone RAT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor [QuickNote] Decrypting the C2 configuration of Warzone RAT

Bee-Ware of Trigona, An Emerging Ransomware Strain

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bee-Ware of Trigona, An Emerging Ransomware Strain

From Royal with Love

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From Royal with Love

OneNote | ThreatLabz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OneNote | ThreatLabz

Technical Advisory: Various Threat Actors Targeting ManageEngine Exploit CVE-2022-47966

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Technical Advisory: Various Threat Actors Targeting ManageEngine Exploit CVE-2022-47966

Hydrochasma: Previously Unknown Group Targets Medical and Shipping Organizations in Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hydrochasma: Previously Unknown Group Targets Medical and Shipping Organizations in Asia

Royal Ransomware Deep Dive

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Royal Ransomware Deep Dive

Dalbit (m00nlight): Chinese Hacker Group's APT Attack Campaign - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dalbit (m00nlight): Chinese Hacker Group's APT Attack Campaign - ASEC

Earth Zhulong Familiar Patterns Target Southeast Asian Firms

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Zhulong Familiar Patterns Target Southeast Asian Firms

Ave Maria and the Chambers of Warzone RAT | Huntress

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ave Maria and the Chambers of Warzone RAT | Huntress

Hive Ransomware Technical Analysis and Initial Access Discovery

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hive Ransomware Technical Analysis and Initial Access Discovery

Following the Scent of TrickGate: 6-Year-Old Packer Used to Deploy the Most Wanted Malware - Check Point Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Following the Scent of TrickGate: 6-Year-Old Packer Used to Deploy the Most Wanted Malware - Check Point Research

The Year of the Wiper | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Year of the Wiper | FortiGuard Labs

Black Basta - Technical Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Black Basta - Technical Analysis

奇安信威胁情报中心

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 奇安信威胁情报中心

Bluebottle: Campaign Hits Banks in French-speaking Countries in Africa

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bluebottle: Campaign Hits Banks in French-speaking Countries in Africa

FIN7_TLPCLEAR.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor FIN7_TLPCLEAR.pdf

Trojanized Windows 10 Operating System Installers Targeted Ukrainian Government | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trojanized Windows 10 Operating System Installers Targeted Ukrainian Government | Mandiant

Breaking the silence - Recent Truebot activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Breaking the silence - Recent Truebot activity

Eu_Repo_C_APT_profile_Conti_Wizard_Spider_dc2a733e18.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Eu_Repo_C_APT_profile_Conti_Wizard_Spider_dc2a733e18.pdf

Blowing Cobalt Strike Out of the Water With Memory Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Blowing Cobalt Strike Out of the Water With Memory Analysis

mas_6-1.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor mas_6-1.pdf

Somnia Malware Detection: UAC-0118 aka FRwL Launches Cyber Attacks Against Organizations in Ukraine Using Enhanced Malware Strains

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Somnia Malware Detection: UAC-0118 aka FRwL Launches Cyber Attacks Against Organizations in Ukraine Using Enhanced Malware Strains

Hack the Real Box: APT41’s New Subgroup Earth Longzhi

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hack the Real Box: APT41’s New Subgroup Earth Longzhi

Black Basta Ransomware - Attacks Deploy Custom EDR Evasion Tools Tied to FIN7 Threat Actor

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Black Basta Ransomware - Attacks Deploy Custom EDR Evasion Tools Tied to FIN7 Threat Actor

Cobalt Strike Analysis and Tutorial: Identifying Beacon Team Servers in the Wild

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Analysis and Tutorial: Identifying Beacon Team Servers in the Wild

French-speaking gang OPERA1ER APT in Africa | Group-IB Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor French-speaking gang OPERA1ER APT in Africa | Group-IB Blog

Black Basta Ransomware | Attacks Deploy Custom EDR Evasion Tools Tied to FIN7 Threat Actor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Black Basta Ransomware | Attacks Deploy Custom EDR Evasion Tools Tied to FIN7 Threat Actor

Orion Threat Alert: Qakbot TTPs Arsenal and the Black Basta Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Orion Threat Alert: Qakbot TTPs Arsenal and the Black Basta Ransomware

eset_threat_report_t22021.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor eset_threat_report_t22021.pdf

APT27 - One Year To Exfiltrate Them All: Intrusion In-Depth Analysis

Malpedia library date Intrinsec fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT27 - One Year To Exfiltrate Them All: Intrusion In-Depth Analysis

2022%20Q3%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2022%20Q3%20Botnet%20Threat%20Update.pdf

Microsoft Security Response Center Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Security Response Center Blog

Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike

Bumblebee: increasing its capacity and evolving its TTPs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bumblebee: increasing its capacity and evolving its TTPs

Water Labbu Abuses Malicious DApps to Steal Cryptocurrency

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Water Labbu Abuses Malicious DApps to Steal Cryptocurrency

Witchetty: Group Uses Updated Toolset in Attacks on Governments in Middle East

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Witchetty: Group Uses Updated Toolset in Attacks on Governments in Middle East

BumbleBee: Round Two

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor BumbleBee: Round Two

Noberus Ransomware- Darkside and BlackMatter Successor Continues to Evolve its Tactics

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Noberus Ransomware- Darkside and BlackMatter Successor Continues to Evolve its Tactics

Noberus Ransomware: Darkside and BlackMatter Successor Continues to Evolve its Tactics

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Noberus Ransomware: Darkside and BlackMatter Successor Continues to Evolve its Tactics

ALPHV-BlackCat ransomware family becoming more dangerous

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor ALPHV-BlackCat ransomware family becoming more dangerous

ALPHV/BlackCat ransomware family becoming more dangerous

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ALPHV/BlackCat ransomware family becoming more dangerous

Russia-Nexus UAC-0113 Emulating Telecommunication Providers in Ukraine

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Russia-Nexus UAC-0113 Emulating Telecommunication Providers in Ukraine

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense

New Wave of Espionage Activity Targets Asian Governments

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Wave of Espionage Activity Targets Asian Governments

Dead or Alive? An Emotet Story

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Dead or Alive? An Emotet Story

Lazarus and the tale of three RATs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lazarus and the tale of three RATs

Cyble - Bumblebee Returns With New Infection Technique

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyble - Bumblebee Returns With New Infection Technique

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog

Initial access broker repurposing techniques in targeted attacks against Ukraine

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Initial access broker repurposing techniques in targeted attacks against Ukraine

Estudio del análisis de Nobelium

file creation date fromORKL

Archived copy on ORKL Detailsfor Estudio del análisis de Nobelium

incibe-cert_estudio_analisis_nobelium_2022_v1.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor incibe-cert_estudio_analisis_nobelium_2022_v1.pdf

Malware development tricks: parent PID spoofing. Simple C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development tricks: parent PID spoofing. Simple C++ example.

#StopRansomware: Vice Society | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor #StopRansomware: Vice Society | CISA

Worok: The big picture

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Worok: The big picture

Ransomware Spotlight: Black Basta

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware Spotlight: Black Basta

Hacker Infrastructure Used in Cisco Breach Discovered Attacking a Top Workforce Management Corporation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hacker Infrastructure Used in Cisco Breach Discovered Attacking a Top Workforce Management Corporation

BlueSky Ransomware | AD Lateral Movement, Evasion and Fast Encryption Put Threat on the Radar

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BlueSky Ransomware | AD Lateral Movement, Evasion and Fast Encryption Put Threat on the Radar

MERCURY leveraging Log4j 2 vulnerabilities in unpatched systems to target Israeli organizations | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MERCURY leveraging Log4j 2 vulnerabilities in unpatched systems to target Israeli organizations | Microsoft Security Blog

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research

新APT组织穆伦鲨(MurenShark) 调查报告：袭向土耳其海军的鱼雷 – 绿盟科技技术博客

Malpedia library date NSFOCUS fromORKLCCS '25 data

Archived copy on ORKL Detailsfor 新APT组织穆伦鲨(MurenShark) 调查报告：袭向土耳其海军的鱼雷 – 绿盟科技技术博客

APT41 World Tour 2021 on a tight schedule

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT41 World Tour 2021 on a tight schedule

Overview of the Cyber Weapons Used in the Ukraine - Russia War | Trustwave

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Overview of the Cyber Weapons Used in the Ukraine - Russia War | Trustwave

THREAT ANALYSIS REPORT: Bumblebee Loader – The High Road to Enterprise Domain Control

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor THREAT ANALYSIS REPORT: Bumblebee Loader – The High Road to Enterprise Domain Control

DCShadow Attacks: Detecting a Rogue Domain Controller

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DCShadow Attacks: Detecting a Rogue Domain Controller

Monster Libra (TA551/Shathak) pushes IcedID (Bokbot) with Dark VNC and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Monster Libra (TA551/Shathak) pushes IcedID (Bokbot) with Dark VNC and Cobalt Strike

The Increase in Ransomware Attacks on Local Governments - SecurityScorecard

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Increase in Ransomware Attacks on Local Governments - SecurityScorecard

LNK forensic and config extraction of a cobalt strike beacon

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor LNK forensic and config extraction of a cobalt strike beacon

BumbleBee Roasts Its Way to Domain Admin

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor BumbleBee Roasts Its Way to Domain Admin

Flight of the Bumblebee: Email Lures and File Sharing Services Lead to Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Flight of the Bumblebee: Email Lures and File Sharing Services Lead to Malware

Manjusaka: A Chinese sibling of Sliver and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Manjusaka: A Chinese sibling of Sliver and Cobalt Strike

Malware AV evasion - part 8. Encode payload via Z85 algorithm. C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware AV evasion - part 8. Encode payload via Z85 algorithm. C++ example.

Living Off Windows Defender | LockBit Ransomware Sideloads Cobalt Strike Through Microsoft Security Tool

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Living Off Windows Defender | LockBit Ransomware Sideloads Cobalt Strike Through Microsoft Security Tool

Cyble - Targeted Attacks Being Carried Out Via DLL SideLoading

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyble - Targeted Attacks Being Carried Out Via DLL SideLoading

RL Blog | ReversingLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RL Blog | ReversingLabs

Gootkit Loader’s Updated Tactics and Fileless Delivery of Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Gootkit Loader’s Updated Tactics and Fileless Delivery of Cobalt Strike

Mandiant Red Team Emulates FIN11 Tactics To Control Operational Technology Servers | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mandiant Red Team Emulates FIN11 Tactics To Control Operational Technology Servers | Mandiant

Malicious IIS extensions quietly open persistent backdoors into servers | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malicious IIS extensions quietly open persistent backdoors into servers | Microsoft Security Blog

Binary Ninja - Reverse Engineering a Cobalt Strike Dropper With Binary Ninja

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Binary Ninja - Reverse Engineering a Cobalt Strike Dropper With Binary Ninja

Malware Being Distributed by Disguising Itself as Icon of V3 Lite - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Being Distributed by Disguising Itself as Icon of V3 Lite - ASEC

Analysis of a trojanized jQuery script: GootLoader unleashed

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis of a trojanized jQuery script: GootLoader unleashed

Evacuation and Humanitarian Documents used to Spear Phish Ukrainian Entities | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Evacuation and Humanitarian Documents used to Spear Phish Ukrainian Entities | Mandiant

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense

Russian APT29 Hackers Use Online Storage Services, DropBox and Google Drive

Malpedia library date Palo Alto fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Russian APT29 Hackers Use Online Storage Services, DropBox and Google Drive

Russian Ransomware C2 Network Discovered in Censys Data

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Russian Ransomware C2 Network Discovered in Censys Data

Cobalt Strikes again: UAC-0056 continues to target Ukraine in its latest campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strikes again: UAC-0056 continues to target Ukraine in its latest campaign

Cobalt Strike Analysis and Tutorial: CS Metadata Encryption and Decryption

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Analysis and Tutorial: CS Metadata Encryption and Decryption

CERT-UA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERT-UA

Emotet infection with Cobalt Strike - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet infection with Cobalt Strike - SANS ISC

CERT-UA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERT-UA

The SessionManager IIS backdoor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The SessionManager IIS backdoor

Black Basta Ransomware Operators Expand Their Attack Arsenal With QakBot Trojan and PrintNightmare Exploit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Black Basta Ransomware Operators Expand Their Attack Arsenal With QakBot Trojan and PrintNightmare Exploit

Attacks on industrial control systems using ShadowPad | Kaspersky ICS CERT EN

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attacks on industrial control systems using ShadowPad | Kaspersky ICS CERT EN

Overview of Russian GRU and SVR Cyberespionage Campaigns 1H 2022

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Overview of Russian GRU and SVR Cyberespionage Campaigns 1H 2022

Matanbuchus Loader Resurfaces - Cyble

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Matanbuchus Loader Resurfaces - Cyble

Avos ransomware group expands with new attack arsenal

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Avos ransomware group expands with new attack arsenal

Malspam pushes Matanbuchus malware, leads to Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malspam pushes Matanbuchus malware, leads to Cobalt Strike

Cyble - Bumblebee Loader On The Rise

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyble - Bumblebee Loader On The Rise

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense

[QuickNote] CobaltStrike SMB Beacon Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor [QuickNote] CobaltStrike SMB Beacon Analysis

Attack Graph Response to US CERT AA22-152A: Karakurt Data Extortion Group

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attack Graph Response to US CERT AA22-152A: Karakurt Data Extortion Group

To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions | Mandiant

AA22-152A_Karakurt_Data_Extortion_Group.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AA22-152A_Karakurt_Data_Extortion_Group.pdf

Karakurt Data Extortion Group | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Karakurt Data Extortion Group | CISA

CUBA Ransomware Campaign Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CUBA Ransomware Campaign Analysis

WarzoneRAT Can Now Evade Detection With Process Hollowing

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor WarzoneRAT Can Now Evade Detection With Process Hollowing

SocGholish Campaigns and Initial Access Kit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SocGholish Campaigns and Initial Access Kit

Emotet Botnet Rises Again | Bitsight

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet Botnet Rises Again | Bitsight

Malware Analysis: Trickbot

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Analysis: Trickbot

Malware development trick - part 29: Store binary data in registry. Simple C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development trick - part 29: Store binary data in registry. Simple C++ example.

Why Remediation Alone Is Not Enough When Infected by Malware - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Why Remediation Alone Is Not Enough When Infected by Malware - ASEC

Malicious 'pymafka' Package Drops Cobalt Strike | Sonatype

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malicious 'pymafka' Package Drops Cobalt Strike | Sonatype

Malware Targets InfoSec: Fake PoC Delivers Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Targets InfoSec: Fake PoC Delivers Cobalt Strike

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog

Bumblebee Malware from TransferXL URLs - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bumblebee Malware from TransferXL URLs - SANS ISC

Bumblebee Malware from TransferXL URLs - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bumblebee Malware from TransferXL URLs - SANS ISC

WizardSpider

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor WizardSpider

Ransomware Spotlight: RansomEXX

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware Spotlight: RansomEXX

New SYK Crypter Distributed Via Discord

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New SYK Crypter Distributed Via Discord

What malware to look for if you want to prevent a ransomware attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What malware to look for if you want to prevent a ransomware attack

Phishing Campaign Delivering Three Fileless Malware: AveMariaRAT / BitRAT / PandoraHVNC – Part I | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Phishing Campaign Delivering Three Fileless Malware: AveMariaRAT / BitRAT / PandoraHVNC – Part I | FortiGuard Labs

AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf

Gootloader.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Gootloader.pdf

The Goot cause: Detecting Gootloader and its follow-on activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Goot cause: Detecting Gootloader and its follow-on activity

Operation RestyLink: 日本企業を狙った標的型攻撃キャンペーン

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation RestyLink: 日本企業を狙った標的型攻撃キャンペーン

TA578 using thread-hijacked emails to push ISO files for Bumblebee malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TA578 using thread-hijacked emails to push ISO files for Bumblebee malware

Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself | Microsoft Security Blog

Malware development: persistence - part 4. Windows services. Simple C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development: persistence - part 4. Windows services. Simple C++ example.

Hiding in Plain Sight: Obscuring C2s by Abusing CDN Services

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hiding in Plain Sight: Obscuring C2s by Abusing CDN Services

SEO Poisoning - A Gootloader Story

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor SEO Poisoning - A Gootloader Story

Cobalt Strike Analysis and Tutorial: CS Metadata Encoding and Decoding

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Analysis and Tutorial: CS Metadata Encoding and Decoding

Russian Cyber Attack campaigns and actors - NOBELIUM has struck again.pdf

file creation date fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Russian Cyber Attack campaigns and actors - NOBELIUM has struck again.pdf

This New Fileless Malware Hides Shellcode in Windows Event Logs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor This New Fileless Malware Hides Shellcode in Windows Event Logs

Russian cyber attack campaigns and actors.pdf

file creation date fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Russian cyber attack campaigns and actors.pdf

Mustang Panda deploys a new wave of malware targeting Europe

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mustang Panda deploys a new wave of malware targeting Europe

A new secret stash for “fileless” malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A new secret stash for “fileless” malware

SOLARDEFLECTION C2 Infrastructure Used by NOBELIUM in Company Brand Misuse

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SOLARDEFLECTION C2 Infrastructure Used by NOBELIUM in Company Brand Misuse

Malware development: persistence - part 3. COM DLL hijack. Simple C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development: persistence - part 3. COM DLL hijack. Simple C++ example.

ショートカットとISOファイルを悪用する攻撃キャンペーン | セキュリティ研究センターブログ

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ショートカットとISOファイルを悪用する攻撃キャンペーン | セキュリティ研究センターブログ

yir-cyber-threats-annex-download.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor yir-cyber-threats-annex-download.pdf

Tracking APT29 Phishing Campaigns | Atlassian Trello

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tracking APT29 Phishing Campaigns | Atlassian Trello

LockBit Ransomware Side-loads Cobalt Strike Beacon with Legitimate VMware Utility

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor LockBit Ransomware Side-loads Cobalt Strike Beacon with Legitimate VMware Utility

20220427_NP_TLPWHITE_ANSSI_FIN7.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 20220427_NP_TLPWHITE_ANSSI_FIN7.pdf

Botconf2022-40-LunghiHorejsi.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Botconf2022-40-LunghiHorejsi.pdf

https://documents.trendmicro.com/assets/txt/earth-berberoka-windows-iocs-2.txt

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor https://documents.trendmicro.com/assets/txt/earth-berberoka-windows-iocs-2.txt

UNC2452 Merged into APT29 | Russia-Based Espionage Group

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UNC2452 Merged into APT29 | Russia-Based Espionage Group

How Cybercriminals Abuse Cloud Tunneling Services

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How Cybercriminals Abuse Cloud Tunneling Services

Conti and Emotet: A constantly destructive duo

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti and Emotet: A constantly destructive duo

New Core Impact Backdoor Delivered Via VMWare Vulnerability

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Core Impact Backdoor Delivered Via VMWare Vulnerability

Quantum Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Quantum Ransomware

FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7 | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7 | Mandiant

Understanding Cobalt Strike Profiles - Updated for Cobalt Strike 4.6

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Understanding Cobalt Strike Profiles - Updated for Cobalt Strike 4.6

Hive Ransomware Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hive Ransomware Analysis

A blueprint for evading industry leading endpoint protection in 2022

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A blueprint for evading industry leading endpoint protection in 2022

PYSA Ransomware: Technical Overview and Protection Strategies

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PYSA Ransomware: Technical Overview and Protection Strategies

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense

Orion Threat Alert: Flight of the BumbleBee

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Orion Threat Alert: Flight of the BumbleBee

Dismantling ZLoader: How malicious ads led to disabled security tools and ransomware | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dismantling ZLoader: How malicious ads led to disabled security tools and ransomware | Microsoft Security Blog

ESET takes part in global operation to disrupt Zloader botnets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET takes part in global operation to disrupt Zloader botnets

Denys Iarmak, Member of hacking group (FIN7) sentenced for scheme that compromised tens of millions of debit and credit cards

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Denys Iarmak, Member of hacking group (FIN7) sentenced for scheme that compromised tens of millions of debit and credit cards

You Bet Your Lsass: Hunting LSASS Access | Splunk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor You Bet Your Lsass: Hunting LSASS Access | Splunk

Advanced Network Detection & Response - MetaDefender NDR - OPSWAT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Advanced Network Detection & Response - MetaDefender NDR - OPSWAT

GitHub - infinitumitlabs/Karakurt-Hacking-Team-CTI: IOC Data Obtained From Karakurt Hacking Team's Internal Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GitHub - infinitumitlabs/Karakurt-Hacking-Team-CTI: IOC Data Obtained From Karakurt Hacking Team's Internal Infrastructure

Cicada: Chinese APT Group Widens Targeting in Recent Espionage Activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cicada: Chinese APT Group Widens Targeting in Recent Espionage Activity

FIN7 Power Hour Adversary Archaeology and the Evolution of FIN7

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor FIN7 Power Hour Adversary Archaeology and the Evolution of FIN7

FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7 | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7 | Mandiant

FIN7 Power Hour- Adversary Archaeology and the Evolution of FIN7

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor FIN7 Power Hour- Adversary Archaeology and the Evolution of FIN7

JSOutProx RAT_whitePaper

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor JSOutProx RAT_whitePaper

How to: Detect and prevent common data exfiltration attacks | APNIC Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How to: Detect and prevent common data exfiltration attacks | APNIC Blog

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research

Phishing campaign targets Russian govt dissidents with Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Phishing campaign targets Russian govt dissidents with Cobalt Strike

From the Front Lines | Hive Ransomware Deploys Novel IPfuscation Technique To Avoid Detection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From the Front Lines | Hive Ransomware Deploys Novel IPfuscation Technique To Avoid Detection

New spear phishing campaign targets Russian dissidents

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New spear phishing campaign targets Russian dissidents

CobaltStrike UUID stager

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CobaltStrike UUID stager

Conti ransomware source code investigation - part 1

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Conti ransomware source code investigation - part 1

Conti ransomware source code investigation - part 1.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti ransomware source code investigation - part 1.

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research

Dragos_Intel_WP_InitAccess-IndEnvirons-Final.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dragos_Intel_WP_InitAccess-IndEnvirons-Final.pdf

Malicious Microsoft Excel add-ins used to deliver RAT malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malicious Microsoft Excel add-ins used to deliver RAT malware

New JSSLoader Trojan Delivered Through XLL Files

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New JSSLoader Trojan Delivered Through XLL Files

Cobalt Strike: Overview – Part 7

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike: Overview – Part 7

2022_ThreatDetectionReport_RedCanary.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2022_ThreatDetectionReport_RedCanary.pdf

Conti Ransomware V. 3, Including Decryptor, Leaked

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti Ransomware V. 3, Including Decryptor, Leaked

Conti Affiliate Exposed: New Domain Names, IP Addresses and Email Addresses Uncovered by eSentire

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti Affiliate Exposed: New Domain Names, IP Addresses and Email Addresses Uncovered by eSentire

Exposing initial access broker with ties to Conti

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Exposing initial access broker with ties to Conti

Cobalt Strike Analysis and Tutorial: How Malleable C2 Profiles Make Cobalt Strike Difficult to Detect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Analysis and Tutorial: How Malleable C2 Profiles Make Cobalt Strike Difficult to Detect

The Ransomware Threat Landscape: What to Expect in 2022

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor The Ransomware Threat Landscape: What to Expect in 2022