Turla

Crimson RAT (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Crimson RAT (Malware Family)

Turla renews its arsenal with Topinambour

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Turla renews its arsenal with Topinambour

Turla Compromises, Infiltrates Iranian APT Infrastructure

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Turla Compromises, Infiltrates Iranian APT Infrastructure

Examining the Activities of the Turla APT Group

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Examining the Activities of the Turla APT Group

Threat actors | Latest Threats | Microsoft Security Blog

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Threat actors | Latest Threats | Microsoft Security Blog

OceanLotus Blossoms: Mass Digital Surveillance and Attacks Targeting ASEAN, Asian Nations, the Media, Human Rights Groups, and Civil Society

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor OceanLotus Blossoms: Mass Digital Surveillance and Attacks Targeting ASEAN, Asian Nations, the Media, Human Rights Groups, and Civil Society

CIRCL » TR-25 Analysis - Turla / Pfinet / Snake

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor CIRCL » TR-25 Analysis - Turla / Pfinet / Snake

TinyTurla-NG in-depth tooling and command and control analysis

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor TinyTurla-NG in-depth tooling and command and control analysis

Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure | CISA

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure | CISA

elf.wellmess (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor elf.wellmess (Malware Family)

Russia-Ukraine War: Cyber Threat Intelligence Report | Security Insider

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Russia-Ukraine War: Cyber Threat Intelligence Report | Security Insider

Mac Malware of 2017

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Mac Malware of 2017

KopiLuwak: A New JavaScript Payload from Turla

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor KopiLuwak: A New JavaScript Payload from Turla

Signals of Trouble: Multiple Russia-Aligned Threat Actors Actively Targeting Signal Messenger

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Signals of Trouble: Multiple Russia-Aligned Threat Actors Actively Targeting Signal Messenger

Miniduke is back: Nemesis Gemina and the Botgen Studio

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Miniduke is back: Nemesis Gemina and the Botgen Studio

Mind the (air) gap: GoldenJackal gooses government guardrails

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Mind the (air) gap: GoldenJackal gooses government guardrails

EKANS Ransomware Misconceptions and Misunderstandings

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor EKANS Ransomware Misconceptions and Misunderstandings

The Garden of Forking Paths: Sophisticated APTs diversify toolsets

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor The Garden of Forking Paths: Sophisticated APTs diversify toolsets

EternalPetya (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor EternalPetya (Malware Family)

Meterpreter (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Meterpreter (Malware Family)

Microsoft: Hackers turn Exchange servers into malware control centers

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Microsoft: Hackers turn Exchange servers into malware control centers

The ‘Penquin’ Turla

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor The ‘Penquin’ Turla

Analysis of Project Cobra

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Analysis of Project Cobra

Mapping the connections inside Russia's APT Ecosystem - Check Point Research

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Mapping the connections inside Russia's APT Ecosystem - Check Point Research

TwoFace (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor TwoFace (Malware Family)

Turla APT Group Abusing Satellite Internet Links

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Turla APT Group Abusing Satellite Internet Links

TURLA’s new phishing-based reconnaissance campaign in Eastern Europe

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor TURLA’s new phishing-based reconnaissance campaign in Eastern Europe

Threat actors | Latest Threats | Microsoft Security Blog

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Threat actors | Latest Threats | Microsoft Security Blog

Turla, Waterbug, Venomous Bear - Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Turla, Waterbug, Venomous Bear - Threat Group Cards: A Threat Actor Encyclopedia

Operation GhostShell: Novel RAT Targets Global Aerospace and Telecoms Firms

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Operation GhostShell: Novel RAT Targets Global Aerospace and Telecoms Firms

Agent.btz: a Source of Inspiration?

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Agent.btz: a Source of Inspiration?

Threat Group Assessment: Turla (aka Pensive Ursa)

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Threat Group Assessment: Turla (aka Pensive Ursa)

Andromeda (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Andromeda (Malware Family)

New details on TinyTurla’s post-compromise activity reveal full kill chain

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor New details on TinyTurla’s post-compromise activity reveal full kill chain

Lab Notes: Persistence and Privilege Elevation using the Powershell Profile

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Lab Notes: Persistence and Privilege Elevation using the Powershell Profile

???????????? COMmand & Evade: Turla's Kazuar v3 Loader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ???????????? COMmand & Evade: Turla's Kazuar v3 Loader

eset-apt-activity-report-q2-2025-q3-2025.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eset-apt-activity-report-q2-2025-q3-2025.pdf

The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns

Gamaredon X Turla collab

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Gamaredon X Turla collab

Frozen in transit: Secret Blizzard’s AiTM campaign against diplomats | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Frozen in transit: Secret Blizzard’s AiTM campaign against diplomats | Microsoft Security Blog

Dark Peep #17: Dark Web Manifesto, Hacker Forums, and Ransomware Misadventures

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dark Peep #17: Dark Web Manifesto, Hacker Forums, and Ransomware Misadventures

Frequent freeloader part II: Russian actor Secret Blizzard using tools of other groups to attack Ukraine | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Frequent freeloader part II: Russian actor Secret Blizzard using tools of other groups to attack Ukraine | Microsoft Security Blog

Snowblind: The invisible hand of Secret Blizzard

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Snowblind: The invisible hand of Secret Blizzard

Frequent freeloader part I: Secret Blizzard compromising Storm-0156 infrastructure for espionage | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Frequent freeloader part I: Secret Blizzard compromising Storm-0156 infrastructure for espionage | Microsoft Security Blog

it didn't turn into a truck, but a widely spread Android botnet

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor it didn't turn into a truck, but a widely spread Android botnet

Virus Bulletin :: TA577 walked just past you: indirect syscalls in Pikabot

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Virus Bulletin :: TA577 walked just past you: indirect syscalls in Pikabot

The Russian APT Tool Matrix

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Russian APT Tool Matrix

To the Moon and back(doors): Lunar landing in diplomatic missions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor To the Moon and back(doors): Lunar landing in diplomatic missions

Pelmeni Wrapper: New Wrapper of Kazuar (Turla Backdoor)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Pelmeni Wrapper: New Wrapper of Kazuar (Turla Backdoor)

TinyTurla Next Generation - Turla APT spies on Polish NGOs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TinyTurla Next Generation - Turla APT spies on Polish NGOs

Over the Kazuar’s Nest: Cracking Down on a Freshly Hatched Backdoor Used by Pensive Ursa (Aka Turla)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Over the Kazuar’s Nest: Cracking Down on a Freshly Hatched Backdoor Used by Pensive Ursa (Aka Turla)

ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilities

Malpedia library date ESET fromORKLCCS '25 data

Archived copy on ORKL Detailsfor ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilities

deep analysis of Xiangoop Loader and EntryShell payload

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor deep analysis of Xiangoop Loader and EntryShell payload

Sophos X-Ops (@SophosXOps@infosec.exchange)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sophos X-Ops (@SophosXOps@infosec.exchange)

IT threat evolution in Q2 2023

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor IT threat evolution in Q2 2023

MoustachedBouncer: Espionage against foreign diplomats in Belarus

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MoustachedBouncer: Espionage against foreign diplomats in Belarus

Malware development trick - part 35: Store payload in alternate data streams. Simple C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development trick - part 35: Store payload in alternate data streams. Simple C++ example.

CERT-UA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERT-UA

Meet the GoldenJackal APT group. Don’t expect any howls

Malpedia library date Kaspersky fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Meet the GoldenJackal APT group. Don’t expect any howls

Meet the GoldenJackal APT group. Don’t expect any howls

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Meet the GoldenJackal APT group. Don’t expect any howls

Hunting Russian Intelligence “Snake” Malware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Hunting Russian Intelligence “Snake” Malware

Hunting Russian Intelligence “Snake” Malware | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hunting Russian Intelligence “Snake” Malware | CISA

Hunting Russian Intelligence “Snake” Malware

file creation date fromORKL

Archived copy on ORKL Detailsfor Hunting Russian Intelligence “Snake” Malware

Tomiris called, they want their Turla malware back

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Tomiris called, they want their Turla malware back

Tomiris called, they want their Turla malware back

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tomiris called, they want their Turla malware back

m_trends_2023_report.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor m_trends_2023_report.pdf

Sophisticated APT29 Campaign Abuses Notion API to Target the European Commission

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Sophisticated APT29 Campaign Abuses Notion API to Target the European Commission

Sophisticated APT29 Campaign Abuses Notion API to Target the European Commission

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sophisticated APT29 Campaign Abuses Notion API to Target the European Commission

One Year After: The Cyber Implications of the Russo-Ukrainian War

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor One Year After: The Cyber Implications of the Russo-Ukrainian War

google_fog_of_war_research_report.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor google_fog_of_war_research_report.pdf

Turla- A Galaxy of Opportunity

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Turla- A Galaxy of Opportunity

Turla: A Galaxy of Opportunity | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Turla: A Galaxy of Opportunity | Mandiant

Reassessing cyberwarfare. Lessons learned in 2022

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Reassessing cyberwarfare. Lessons learned in 2022

Reassessing cyberwarfare. Lessons learned in 2022

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Reassessing cyberwarfare. Lessons learned in 2022

Operation-Blockbuster-Report

date ORKL added it fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation-Blockbuster-Report

Malware development: persistence - part 11. Powershell profile. Simple C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development: persistence - part 11. Powershell profile. Simple C++ example.

Malware development- persistence - part 11. Powershell profile. Simple Cplusplus example.

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Malware development- persistence - part 11. Powershell profile. Simple Cplusplus example.

Space Invaders- Cyber Threats That Are Out Of This World

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Space Invaders- Cyber Threats That Are Out Of This World

Space Invaders: Cyber Threats That Are Out Of This World

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Space Invaders: Cyber Threats That Are Out Of This World

APT trends report Q2 2020

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT trends report Q2 2020

Burned and Blinded - Escalation Risks of Intelligence Loss from Countercyber Operations in Crisis

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Burned and Blinded - Escalation Risks of Intelligence Loss from Countercyber Operations in Crisis

Continued cyber activity in Eastern Europe observed by TAG

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Continued cyber activity in Eastern Europe observed by TAG

Continued cyber activity in Eastern Europe observed by TAG

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Continued cyber activity in Eastern Europe observed by TAG

Malware development: persistence - part 7. Winlogon. Simple C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development: persistence - part 7. Winlogon. Simple C++ example.

THALES%20THREAT%20HANDBOOK%202022%20Light%20Version_1.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor THALES%20THREAT%20HANDBOOK%202022%20Light%20Version_1.pdf

Malware development trick - part 29: Store binary data in registry. Simple C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development trick - part 29: Store binary data in registry. Simple C++ example.

Tricephalic_Hellkeeper.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tricephalic_Hellkeeper.pdf

Russian Cyber Attack campaigns and actors - NOBELIUM has struck again.pdf

file creation date fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Russian Cyber Attack campaigns and actors - NOBELIUM has struck again.pdf

Russian cyber attack campaigns and actors.pdf

file creation date fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Russian cyber attack campaigns and actors.pdf

Update on cyber activity in Eastern Europe

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Update on cyber activity in Eastern Europe

Update on cyber activity in Eastern Europe

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Update on cyber activity in Eastern Europe

Malware development: persistence - part 3. COM DLL hijack. Simple C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development: persistence - part 3. COM DLL hijack. Simple C++ example.

Malware development: persistence - part 2. Screensaver hijack. C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development: persistence - part 2. Screensaver hijack. C++ example.

Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure

file creation date CISA, NSA, FBI fromORKL

Archived copy on ORKL Detailsfor Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure

Russian State-Sponsored and Criminal Cyber .pdf

file creation date fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Russian State-Sponsored and Criminal Cyber .pdf

AA22-110A_Joint_CSA_Russian_State-Sponsored_and_Criminal_Cyber_Threats_to_Critical_Infrastructure_4_20_22_Final.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AA22-110A_Joint_CSA_Russian_State-Sponsored_and_Criminal_Cyber_Threats_to_Critical_Infrastructure_4_20_22_Final.pdf

Alert (AA22-110A)- Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Alert (AA22-110A)- Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure

Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure | CISA

Russia's FSB malign activity: factsheet

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Russia's FSB malign activity: factsheet

Complete dissection of an APK with a suspicious C2 Server

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Complete dissection of an APK with a suspicious C2 Server

Newly found Android malware records audio, tracks your location

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Newly found Android malware records audio, tracks your location

A step-by-step analysis of the Russian APT Turla backdoor called TinyTurla – CYBER GEEKS

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A step-by-step analysis of the Russian APT Turla backdoor called TinyTurla – CYBER GEEKS

A Step-by-Step Analysis of the Russian APT Turla Backdoor called TinyTurla

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor A Step-by-Step Analysis of the Russian APT Turla Backdoor called TinyTurla

Ghostwriter in the Shell: Expanding on Mandiant’s Attribution of UNC1151 to Belarus

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ghostwriter in the Shell: Expanding on Mandiant’s Attribution of UNC1151 to Belarus

Looking for Penquins in the Wild

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Looking for Penquins in the Wild

Looking for Penquins in the Wild

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Looking for Penquins in the Wild

The Elite Hackers of the FSB

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Elite Hackers of the FSB

An Exhaustively Analyzed IDB for ComLook — Möbius Strip Reverse Engineering

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor An Exhaustively Analyzed IDB for ComLook — Möbius Strip Reverse Engineering

Full Spectrum Detections for 5 Popular Web Shells- Alfa, SharPyShell, Krypton, ASPXSpy, and TWOFACE

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Full Spectrum Detections for 5 Popular Web Shells- Alfa, SharPyShell, Krypton, ASPXSpy, and TWOFACE

Full Spectrum Detections for 5 Popular Web Shells: Alfa, SharPyShell, Krypton, ASPXSpy, and TWOFACE

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Full Spectrum Detections for 5 Popular Web Shells: Alfa, SharPyShell, Krypton, ASPXSpy, and TWOFACE

Something about one of the Uroburos’ RPC-based backdoors – Emanuele De Lucia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Something about one of the Uroburos’ RPC-based backdoors – Emanuele De Lucia

The BigBoss Rules- Something about one of the Uroburos’ RPC-based backdoors

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The BigBoss Rules- Something about one of the Uroburos’ RPC-based backdoors

APT trends report Q3 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q3 2021

Operation GhostShell_ Novel RAT Targets Global Aerospace and Telecoms Firms

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation GhostShell_ Novel RAT Targets Global Aerospace and Telecoms Firms

Operation GhostShell: Novel RAT Targets Global Aerospace and Telecoms Firms

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation GhostShell: Novel RAT Targets Global Aerospace and Telecoms Firms

Deobfuscating PowerShell Malware Droppers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Deobfuscating PowerShell Malware Droppers

Deobfuscating PowerShell Malware Droppers

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Deobfuscating PowerShell Malware Droppers

TinyTurla - Turla deploys new malware to keep a secret backdoor on victim machines

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TinyTurla - Turla deploys new malware to keep a secret backdoor on victim machines

TinyTurla - Turla deploys new malware to keep a secret backdoor on victim machines

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor TinyTurla - Turla deploys new malware to keep a secret backdoor on victim machines

eset_threat_report_t12021.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eset_threat_report_t12021.pdf

eset_threat_report_t12021

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor eset_threat_report_t12021

New Version of Kido (Conficker) (Kaspersky Lab)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New Version of Kido (Conficker) (Kaspersky Lab)

ESET_Industry_Report_Government.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET_Industry_Report_Government.pdf

APT_trends_report_Q1_2021_Securelist

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT_trends_report_Q1_2021_Securelist

APT trends report Q1 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q1 2021

APT trends report Q1 2021

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT trends report Q1 2021

Cyber Threats 2020: A Year in Retrospect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Threats 2020: A Year in Retrospect

Nice to meet you too My name is Ryuk

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Nice to meet you too My name is Ryuk

IronNetInjector: Turla’s New Malware Loading Tool

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor IronNetInjector: Turla’s New Malware Loading Tool

IronNetInjector- Turla’s New Malware Loading Tool

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor IronNetInjector- Turla’s New Malware Loading Tool

Scanned Document

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Scanned Document

ESET_Threat_Report_Q42020.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET_Threat_Report_Q42020.pdf

Mimecast links security breach to SolarWinds hackers

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Mimecast links security breach to SolarWinds hackers

Mimecast links security breach to SolarWinds hackers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mimecast links security breach to SolarWinds hackers

On attribution- APT28, APT29…Turla- No, they are NOT the same

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor On attribution- APT28, APT29…Turla- No, they are NOT the same

The Devil’s in the Details- SUNBURST Attribution

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Devil’s in the Details- SUNBURST Attribution

The Devil’s in the Details: SUNBURST Attribution - DomainTools | Start Here. Know Now.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Devil’s in the Details: SUNBURST Attribution - DomainTools | Start Here. Know Now.

Sunburst backdoor - code overlaps with Kazuar

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sunburst backdoor - code overlaps with Kazuar

Sunburst backdoor – code overlaps with Kazuar

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Sunburst backdoor – code overlaps with Kazuar

securelist.com-Sunburst backdoor code overlaps with Kazuar

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor securelist.com-Sunburst backdoor code overlaps with Kazuar

Top Linux Cloud Threats of 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Top Linux Cloud Threats of 2020

Russian cyber attack campaigns and actors

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Russian cyber attack campaigns and actors

APT annual review: What the world’s threat actors got up to in 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT annual review: What the world’s threat actors got up to in 2020

Turla Crutch_ Keeping the “back door” open _ WeLiveSecurity

date in the CCS '25 data ESET fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Turla Crutch_ Keeping the “back door” open _ WeLiveSecurity

Turla Crutch: Keeping the “back door” open

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Turla Crutch: Keeping the “back door” open

Turla Crutch- Keeping the “back door” open

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Turla Crutch- Keeping the “back door” open

Investigation with a twist: an accidental APT attack and averted data destruction

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Investigation with a twist: an accidental APT attack and averted data destruction

Group-IB_Hi-Tech_Crime_Trends_2020-2021_en

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Group-IB_Hi-Tech_Crime_Trends_2020-2021_en

The Enigmatic Energetic Bear

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Enigmatic Energetic Bear

The Enigmatic Energetic Bear

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Enigmatic Energetic Bear

MAR-10310246-2.v1 – PowerShell Script: ComRAT | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MAR-10310246-2.v1 – PowerShell Script: ComRAT | CISA

Malware Analysis Report (AR20-303A)- PowerShell Script- ComRAT

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Malware Analysis Report (AR20-303A)- PowerShell Script- ComRAT

Turla uses HyperStack, Carbon, and Kazuar to compromise government entity

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Turla uses HyperStack, Carbon, and Kazuar to compromise government entity

What We Think | Business & Technology Insights

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What We Think | Business & Technology Insights

ESET_Threat_Report_Q32020

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ESET_Threat_Report_Q32020

Graphology of an Exploit – Hunting for exploits by looking for the author’s fingerprints

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Graphology of an Exploit – Hunting for exploits by looking for the author’s fingerprints

Turla Carbon System

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Turla Carbon System

APT28 Delivers Zebrocy Malware Campaign using NATO Theme as Lure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT28 Delivers Zebrocy Malware Campaign using NATO Theme as Lure

Detecting Threats in Real-time With Active C2 Information

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detecting Threats in Real-time With Active C2 Information

An overview of targeted attacks and APTs on Linux

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor An overview of targeted attacks and APTs on Linux

An overview of targeted attacks and APTs on Linux

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor An overview of targeted attacks and APTs on Linux

An Exhaustively-Analyzed IDB for ComRAT v4 — Möbius Strip Reverse Engineering

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor An Exhaustively-Analyzed IDB for ComRAT v4 — Möbius Strip Reverse Engineering

Attribution- A Puzzle

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Attribution- A Puzzle

Attribution: A Puzzle

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attribution: A Puzzle

APT_trends_report_Q2_2020_Securelist

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT_trends_report_Q2_2020_Securelist

ESET_Threat_Report_Q22020.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET_Threat_Report_Q22020.pdf

ESET_Threat_Report_Q22020

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ESET_Threat_Report_Q22020

APT trends report Q2 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q2 2020

APT trends report Q2 2020

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT trends report Q2 2020

Turla _ Venomous Bear updates its arsenal_ _NewPass_ appears on the APT threat scene - Telsy

date in the CCS '25 data Telsy fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Turla _ Venomous Bear updates its arsenal_ _NewPass_ appears on the APT threat scene - Telsy

Turla - Venomous Bear updates its arsenal- “NewPass” appears on the APT threat scene

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Turla - Venomous Bear updates its arsenal- “NewPass” appears on the APT threat scene

Turla / Venomous Bear updates its arsenal: "NewPass" appears on the APT threat scene - Telsy

Malpedia library date Telsy fromORKLCCS '25 data

The original link failed its last check. Original publisher Detailsfor Turla / Venomous Bear updates its arsenal: "NewPass" appears on the APT threat scene - Telsy

0628-2020APT上半年报告-画册

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 0628-2020APT上半年报告-画册

EKANS Ransomware Misconceptions and Misunderstandings

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor EKANS Ransomware Misconceptions and Misunderstandings

EKANS Ransomware Misconceptions and Misunderstandings

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor EKANS Ransomware Misconceptions and Misunderstandings

AcidBox: Rare Malware Repurposing Turla Group Exploit Targeted Russian Organizations

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AcidBox: Rare Malware Repurposing Turla Group Exploit Targeted Russian Organizations

AcidBox- Rare Malware Repurposing Turla Group Exploit Targeted Russian Organizations

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor AcidBox- Rare Malware Repurposing Turla Group Exploit Targeted Russian Organizations

AcidBox_ Rare Malware Repurposing Turla Group Exploit Targeted Russian Organizations

date in the CCS '25 data Palo Alto fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor AcidBox_ Rare Malware Repurposing Turla Group Exploit Targeted Russian Organizations

Looking at Big Threats Using Code Similarity. Part 1

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Looking at Big Threats Using Code Similarity. Part 1

Looking at Big Threats Using Code Similarity. Part 1

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Looking at Big Threats Using Code Similarity. Part 1

SysInTURLA

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor SysInTURLA

ESET_Turla_ComRAT

Malpedia library date ESET fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ESET_Turla_ComRAT

ACIDBOX Clustering

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor ACIDBOX Clustering

From Agent.BTZ to ComRAT v4- A ten‑year journey

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor From Agent.BTZ to ComRAT v4- A ten‑year journey

From Agent.BTZ to ComRAT v4: A ten-year journey

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From Agent.BTZ to ComRAT v4: A ten-year journey

T1055 Process Injection

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor T1055 Process Injection

MITRE ATT&CK T1055 Process Injection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MITRE ATT&CK T1055 Process Injection

COMpfun authors spoof visa application with HTTP status-based Trojan _ Securelist

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor COMpfun authors spoof visa application with HTTP status-based Trojan _ Securelist

Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf

COMpfun authors spoof visa application with HTTP status-based Trojan

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor COMpfun authors spoof visa application with HTTP status-based Trojan

ESET_Threat_Report_Q12020

date in the CCS '25 data ESET fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ESET_Threat_Report_Q12020

report-bb-decade-of-the-rats

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor report-bb-decade-of-the-rats

Tracking Turla_ New backdoor delivered via Armenian watering holes _ WeLiveSecurity

date in the CCS '25 data ESET fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Tracking Turla_ New backdoor delivered via Armenian watering holes _ WeLiveSecurity

Swallowing the Snake's Tail: Tracking Turla Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Swallowing the Snake's Tail: Tracking Turla Infrastructure

Tracking Turla- New backdoor delivered via Armenian watering holes

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Tracking Turla- New backdoor delivered via Armenian watering holes

Tracking Turla: New backdoor delivered via Armenian watering holes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tracking Turla: New backdoor delivered via Armenian watering holes

Report2020CrowdStrikeGlobalThreatReport

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Report2020CrowdStrikeGlobalThreatReport

Cyber Threats 2019: A Year in Retrospect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Threats 2019: A Year in Retrospect

2020.02.22_APT_threat_report_2019_CN_version

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 2020.02.22_APT_threat_report_2019_CN_version

EKANS Ransomware and ICS Operations

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor EKANS Ransomware and ICS Operations

IBM X-Force IRIS ZeroCleare - Tehcnical Paper

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor IBM X-Force IRIS ZeroCleare - Tehcnical Paper

Dustman APT: Art of Copy-Paste

Malpedia library date The Vault Blog fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Dustman APT: Art of Copy-Paste

Dustman APT- Art of Copy-Paste

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Dustman APT- Art of Copy-Paste

Saudi-Arabia-CNA-report

date in the CCS '25 data IBM Security fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Saudi-Arabia-CNA-report

Operation Gamework: Infrasturcture Overlaps Found Between BlueAlpha and Iranian APTs

Malpedia library date Recorded Future fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation Gamework: Infrasturcture Overlaps Found Between BlueAlpha and Iranian APTs

Group-IB_Hi-Tech_Crime_Trends_2019-2020_en

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Group-IB_Hi-Tech_Crime_Trends_2019-2020_en

Microsoft Word - New Destructive Wiper ZeroCleare v1 MLM comments.docx

date in the CCS '25 data IBM Security fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Microsoft Word - New Destructive Wiper ZeroCleare v1 MLM comments.docx

APT review: what the world’s threat actors got up to in 2019

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT review: what the world’s threat actors got up to in 2019

Group-IB_Hi-Tech_Crime_Trends_2019-2020

date in the CCS '25 data Group-IB fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Group-IB_Hi-Tech_Crime_Trends_2019-2020

NSA_CSA_Turla_20191021%20ver%204%20-%20nsa.gov.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor NSA_CSA_Turla_20191021%20ver%204%20-%20nsa.gov.pdf

Advisory: Turla group exploits Iranian APT to expand coverage of victims

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Advisory: Turla group exploits Iranian APT to expand coverage of victims

Advisory- Turla group exploits Iranian APT to expand coverage of victims

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Advisory- Turla group exploits Iranian APT to expand coverage of victims

APT trends report Q3 2019

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q3 2019

COMpfun successor Reductor infects files on the fly to compromise TLS traffic

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor COMpfun successor Reductor infects files on the fly to compromise TLS traffic

COMpfun successor Reductor infects files on the fly to compromise TLS traffic

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor COMpfun successor Reductor infects files on the fly to compromise TLS traffic

Mapping the connections inside Russia APT Ecosystem

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Mapping the connections inside Russia APT Ecosystem

APT34- The Helix Kitten Cybercriminal Group Loves to Meow Middle Eastern and International Organizations

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT34- The Helix Kitten Cybercriminal Group Loves to Meow Middle Eastern and International Organizations

APT34: The Helix Kitten Cybercriminal Group Loves to Meow Middle Eastern and International Organizations

Malpedia library date Cyware fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT34: The Helix Kitten Cybercriminal Group Loves to Meow Middle Eastern and International Organizations

An Overview of Public Platform C2’s

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor An Overview of Public Platform C2’s

APT_trends_report_Q2_2019_Securelist

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT_trends_report_Q2_2019_Securelist

APT trends report Q2 2019

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q2 2019

APT trends report Q2 2019

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT trends report Q2 2019

ClearSky-2019-H1-Cyber-Events-Summary-Report.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ClearSky-2019-H1-Cyber-Events-Summary-Report.pdf

malware-ioc/turla at master · eset/malware-ioc

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor malware-ioc/turla at master · eset/malware-ioc

Turla Indicators of Compromise

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Turla Indicators of Compromise

Analyzing KSL0T Turlas Keylogger Part 1

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Analyzing KSL0T Turlas Keylogger Part 1

Analyzing KSL0T (Turla’s Keylogger), Part 1 – Reupload | 0ffset Training Solutions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing KSL0T (Turla’s Keylogger), Part 1 – Reupload | 0ffset Training Solutions

Analyzing KSL0T (Turla’s Keylogger), Part 2 – Reupload | 0ffset Training Solutions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing KSL0T (Turla’s Keylogger), Part 2 – Reupload | 0ffset Training Solutions

Analyzing KSL0T Turlas Keylogger Part 2

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Analyzing KSL0T Turlas Keylogger Part 2

Threat Group Cards: A Threat Actor Encyclopedia

file creation date ThaiCERT fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Threat Group Cards: A Threat Actor Encyclopedia

Waterbug_ Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Waterbug_ Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments

Waterbug: Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Waterbug: Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments

Waterbug- Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Waterbug- Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments

Waterbug: Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments

date in the CCS '25 data Symantec fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Waterbug: Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments

Threat Group Cards: A Threat Actor Encyclopedia

file creation date Martijn van der Heide fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia

Possible Turla HTTP Listener

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Possible Turla HTTP Listener

Zebrocy Multilanguage Malware Salad

date in the CCS '25 data EFF fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Zebrocy Multilanguage Malware Salad

A dive into Turla PowerShell usage

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor A dive into Turla PowerShell usage

A dive into Turla PowerShell usage

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A dive into Turla PowerShell usage

A dive into Turla PowerShell usage

date in the CCS '25 data ESET fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor A dive into Turla PowerShell usage

Turla LightNeuron- An email too far

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Turla LightNeuron- An email too far

Turla LightNeuron: An email too far

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Turla LightNeuron: An email too far

ESET-LightNeuron

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ESET-LightNeuron

GitHub - hfiref0x/TDL: Driver loader for bypassing Windows x64 Driver Signature Enforcement

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GitHub - hfiref0x/TDL: Driver loader for bypassing Windows x64 Driver Signature Enforcement

TDL (Turla Driver Loader) Repository

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor TDL (Turla Driver Loader) Repository

Source code of Iranian cyber-espionage tools leaked on Telegram

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Source code of Iranian cyber-espionage tools leaked on Telegram

Decoded Turla Powershell Implant

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Decoded Turla Powershell Implant

https://raw.githubusercontent.com/k-vitali/Malware-Misc-RE/master/2019-04-13-Possible-Turla-PowerShell-Implant.ps1

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor https://raw.githubusercontent.com/k-vitali/Malware-Misc-RE/master/2019-04-13-Possible-Turla-PowerShell-Implant.ps1

rpt-mtrends-2019.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor rpt-mtrends-2019.pdf

Report2019GlobalThreatReport

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Report2019GlobalThreatReport

APT Trends report Q2 2017

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT Trends report Q2 2017

rpt-mtrends-2019

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor rpt-mtrends-2019

CrowdStrike_GTR_2019.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor CrowdStrike_GTR_2019.pdf

2018 Master Table

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 2018 Master Table

APT review of the year

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT review of the year

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research

Kraken Cryptor Ransomware Gains Popularity Among Cybercriminals

file creation date fromORKL

Archived copy on ORKL Detailsfor Kraken Cryptor Ransomware Gains Popularity Among Cybercriminals

Fallout Exploit Kit Releases the Kraken Ransomware on Its Victims

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Fallout Exploit Kit Releases the Kraken Ransomware on Its Victims

Shedding Skin – Turla’s Fresh Faces

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Shedding Skin – Turla’s Fresh Faces

Shedding Skin - Turla’s Fresh Faces

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Shedding Skin - Turla’s Fresh Faces

Turla Outlook Backdoor Uses Clever Tactics for Stealth and Persistence

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Turla Outlook Backdoor Uses Clever Tactics for Stealth and Persistence

Turla Outlook Backdoor Uses Clever Tactics for Stealth and Persistence

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Turla Outlook Backdoor Uses Clever Tactics for Stealth and Persistence

Eset-Turla-Outlook-Backdoor

Malpedia library date ESET fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Eset-Turla-Outlook-Backdoor

APT Trends Report Q2 2018

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT Trends Report Q2 2018

Mosquito campaign by Turla undergoes significant TTPs shift

date in the CCS '25 data ESET fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Mosquito campaign by Turla undergoes significant TTPs shift

Turla Mosquito: A shift towards more generic tools

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Turla Mosquito: A shift towards more generic tools

Turla Mosquito- A shift towards more generic tools

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Turla Mosquito- A shift towards more generic tools

APT Trends report Q1 2018

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT Trends report Q1 2018

APT Trends report Q1 2018

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT Trends report Q1 2018

Masha and these Bears - 2018 Sofacy Activity

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Masha and these Bears - 2018 Sofacy Activity

masha-and-these-bears

date in the CCS '25 data RSA fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor masha-and-these-bears

Report2018GlobalThreatReport.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor Report2018GlobalThreatReport.pdf

ukatemicrysys_territorialdispute

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ukatemicrysys_territorialdispute

Penquins_Moonlit_Maze_PDF_eng.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Penquins_Moonlit_Maze_PDF_eng.pdf

Territorial Dispute - NSA's perspective on APT landscape

date in the CCS '25 data CrySyS Lab fromCCS '25 data

Detailsfor Territorial Dispute - NSA's perspective on APT landscape

Turla_APT

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Turla_APT

Uroburos_EN.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Uroburos_EN.pdf

PowerPoint Presentation

file creation date fromORKL

Archived copy on ORKL Detailsfor PowerPoint Presentation

OceanLotus Blossoms: Mass Digital Surveillance and Attacks Targeting ASEAN

file creation date Volexity fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor OceanLotus Blossoms: Mass Digital Surveillance and Attacks Targeting ASEAN

This hacking gang just updated the malware it uses against UK targets

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor This hacking gang just updated the malware it uses against UK targets

This hacking gang just updated the malware it uses against UK targets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor This hacking gang just updated the malware it uses against UK targets

Turla group update Neuron malware

date in the CCS '25 data NCSC fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Turla group update Neuron malware

Turla group malware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Turla group malware

Sorry - the page you're looking for has been removed

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sorry - the page you're looking for has been removed

blog

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor blog

ESET_Turla_Mosquito

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ESET_Turla_Mosquito

OilRig Performs Tests on the TwoFace Webshell

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OilRig Performs Tests on the TwoFace Webshell

Turla group using Neuron and Nautilus tools alongside Snake malware

date in the CCS '25 data NCSC fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Turla group using Neuron and Nautilus tools alongside Snake malware

OceanLotus Blossoms: Mass Digital Surveillance and Attacks Targeting ASEAN, Asian Nations, the Media, Human Rights Groups, and Civil Society | Volexity

date in the CCS '25 data Volexity fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor OceanLotus Blossoms: Mass Digital Surveillance and Attacks Targeting ASEAN, Asian Nations, the Media, Human Rights Groups, and Civil Society | Volexity

Introducing WhiteBear - Securelist

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Introducing WhiteBear - Securelist

Analysis of a malicious DOC used by Turla APT group; hunting persistence via PowerShell

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis of a malicious DOC used by Turla APT group; hunting persistence via PowerShell

Analysis of a malicious DOC used by Turla APT group; hunting persistence via PowerShell

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Analysis of a malicious DOC used by Turla APT group; hunting persistence via PowerShell

New Variants of Agent.BTZ/ComRAT Found: The Threat That Hit The Pentagon In 2008 Still Evolving; Part 2/2

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor New Variants of Agent.BTZ/ComRAT Found: The Threat That Hit The Pentagon In 2008 Still Evolving; Part 2/2

New Variants of Agent.BTZ-ComRAT Found- The Threat That Hit The Pentagon In 2008 Still Evolving; Part 2-2

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New Variants of Agent.BTZ-ComRAT Found- The Threat That Hit The Pentagon In 2008 Still Evolving; Part 2-2

Introducing WhiteBear

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Introducing WhiteBear

New ESET research uncovers Gazer, the stealthy backdoor that spies on embassies

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New ESET research uncovers Gazer, the stealthy backdoor that spies on embassies

New ESET research uncovers Gazer, the stealthy backdoor that spies on embassies

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New ESET research uncovers Gazer, the stealthy backdoor that spies on embassies

Introducing WhiteBear

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Introducing WhiteBear

Introducing WhiteBear

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Introducing WhiteBear

Cyberespionage Group Turla Deploys Backdoor Ahead of G20 Task Force Summit

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Cyberespionage Group Turla Deploys Backdoor Ahead of G20 Task Force Summit

Cyberespionage Group Turla Deploys Backdoor Ahead of G20 Task Force Summit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyberespionage Group Turla Deploys Backdoor Ahead of G20 Task Force Summit

Turla APT actor refreshes KopiLuwak JavaScript backdoor for use in G20-themed attack

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Turla APT actor refreshes KopiLuwak JavaScript backdoor for use in G20-themed attack

Analysis of Turla APT G20-Targeted Attack | Proofpoint US

Malpedia library date Proofpoint fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Analysis of Turla APT G20-Targeted Attack | Proofpoint US

Government-of-Canada-Hackers-are-Humans-Too.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Government-of-Canada-Hackers-are-Humans-Too.pdf

APT Trends report Q2 2017

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT Trends report Q2 2017

New Variants of Agent.BTZ/ComRAT Found: The Threat That Hit The Pentagon In 2008 Still Evolving; Part 1/2

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Variants of Agent.BTZ/ComRAT Found: The Threat That Hit The Pentagon In 2008 Still Evolving; Part 1/2

New Variants of Agent.BTZ-ComRAT Found- The Threat That Hit The Pentagon In 2008 Still Evolving; Part 1-2

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New Variants of Agent.BTZ-ComRAT Found- The Threat That Hit The Pentagon In 2008 Still Evolving; Part 1-2

Gazing at Gazer

Malpedia library date ESET fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Gazing at Gazer

TwoFace Webshell: Persistent Access Point for Lateral Movement

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TwoFace Webshell: Persistent Access Point for Lateral Movement

Turla’s watering hole campaign- An updated Firefox extension abusing Instagram

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Turla’s watering hole campaign- An updated Firefox extension abusing Instagram

Turla’s watering hole campaign: An updated Firefox extension abusing Instagram

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Turla’s watering hole campaign: An updated Firefox extension abusing Instagram

Snake malware ported from Windows to Mac | Malwarebytes Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Snake malware ported from Windows to Mac | Malwarebytes Labs

Snake malware ported from Windows to Mac

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Snake malware ported from Windows to Mac

Snake: Coming soon in Mac OS X flavour

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Snake: Coming soon in Mac OS X flavour

Kazuar: Multiplatform Espionage Backdoor with API Access

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Kazuar: Multiplatform Espionage Backdoor with API Access

Snake- Coming soon in Mac OS X flavour

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Snake- Coming soon in Mac OS X flavour

Kazuar: Multiplatform Espionage Backdoor with API Access - Palo Alto Networks Blog

date in the CCS '25 data Palo Alto fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Kazuar: Multiplatform Espionage Backdoor with API Access - Palo Alto Networks Blog

Kazuar: Multiplatform Espionage Backdoor with API Access

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Kazuar: Multiplatform Espionage Backdoor with API Access

Kazuar- Multiplatform Espionage Backdoor with API Access

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Kazuar- Multiplatform Espionage Backdoor with API Access

Moonlight Maze: Lessons from history

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Moonlight Maze: Lessons from history

Moonlight Maze- Lessons from history

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Moonlight Maze- Lessons from history

Penquins_Moonlit_Maze_AppendixB.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Penquins_Moonlit_Maze_AppendixB.pdf

Carbon Paper: Peering into Turla second stage backdoor

date in the CCS '25 data ESET fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Carbon Paper: Peering into Turla second stage backdoor

Carbon Paper- Peering into Turla’s second stage backdoor

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Carbon Paper- Peering into Turla’s second stage backdoor

Carbon Paper: Peering into Turla’s second stage backdoor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Carbon Paper: Peering into Turla’s second stage backdoor

KopiLuwak: A New JavaScript Payload from Turla

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor KopiLuwak: A New JavaScript Payload from Turla

KopiLuwak- A New JavaScript Payload from Turla

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor KopiLuwak- A New JavaScript Payload from Turla

Bartholomew-GuerreroSaade-VB2016.indd

Malpedia library date Kaspersky fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Bartholomew-GuerreroSaade-VB2016.indd

Running for Office_ Russian APT Toolkits Revealed

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Running for Office_ Russian APT Toolkits Revealed

Pacifier APT

Malpedia library date Bitdefender fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Pacifier APT

Threat actors | Latest Threats | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat actors | Latest Threats | Microsoft Security Blog

APT Case RUAG Technical Report

Malpedia library date GovCERT.ch fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT Case RUAG Technical Report

APT Case RUAG - Technical Report

date in the CCS '25 data MELANI GovCERT fromCCS '25 data

Detailsfor APT Case RUAG - Technical Report

APT Case RUAG Technical Report

date in the CCS '25 data GovCERT.ch fromCCS '25 data

The link to Mirror on Box failed its last check. Detailsfor APT Case RUAG Technical Report

BfV Cyber-Brief Nr. 02/2016

file creation date Bundesamt für Verfassungsschutz fromORKL

The original link failed its last check. Original publisher Detailsfor BfV Cyber-Brief Nr. 02/2016

Operation Blockbuster

date in the CCS '25 data Novetta fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Operation Blockbuster

Know Your Enemies 2.0: A Primer on Advanced Persistent Threat Groups

file creation date ICIT fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Know Your Enemies 2.0: A Primer on Advanced Persistent Threat Groups

waterbug-attack-group

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor waterbug-attack-group

Russian group behind 2013 Foreign Ministry hack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Russian group behind 2013 Foreign Ministry hack

Russian group behind 2013 Foreign Ministry hack

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Russian group behind 2013 Foreign Ministry hack

Cyber war in perspective: Russian aggression against Ukraine

file creation date NATO fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Cyber war in perspective: Russian aggression against Ukraine

rpt-witchcoven

Malpedia library date FireEye fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor rpt-witchcoven

Satellite Turla: APT Command and Control in the Sky - Securelist

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Satellite Turla: APT Command and Control in the Sky - Securelist

Satellite Turla: APT Command and Control in the Sky

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Satellite Turla: APT Command and Control in the Sky

Satellite Turla_ APT Command and Control in the Sky - Securelist

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Satellite Turla_ APT Command and Control in the Sky - Securelist

Satellite Turla- APT Command and Control in the Sky

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Satellite Turla- APT Command and Control in the Sky

Satellite Turla: APT Command and Control in the Sky

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Satellite Turla: APT Command and Control in the Sky

FireEye Intelligence: Threat Landscape Overview

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor FireEye Intelligence: Threat Landscape Overview

Turla - operations & development

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Turla - operations & development

Global Threat Intel Report

Malpedia library date Crowdstrike fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Global Threat Intel Report

The Waterbug Attack Group

file creation date Symantec fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The Waterbug Attack Group

Analysis of Project Cobra

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis of Project Cobra

Analysis of Project Cobra

date in the CCS '25 data Gdata fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Analysis of Project Cobra

Analysis of Project Cobra

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Analysis of Project Cobra

Weiterentwicklung anspruchsvoller Spyware- von Agent.BTZ zu ComRAT

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Weiterentwicklung anspruchsvoller Spyware- von Agent.BTZ zu ComRAT

Weiterentwicklung anspruchsvoller Spyware: von Agent.BTZ zu ComRAT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Weiterentwicklung anspruchsvoller Spyware: von Agent.BTZ zu ComRAT

Evolution of sophisticated spyware: from Agent.BTZ to ComRAT

date in the CCS '25 data Gdata fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Evolution of sophisticated spyware: from Agent.BTZ to ComRAT

New Pacifier APT Components Point to Russian-Linked Turla Group

date in the CCS '25 data Bitdefender fromCCS '25 data

The original link failed its last check. Detailsfor New Pacifier APT Components Point to Russian-Linked Turla Group

Linux Modules Connected to Turla APT Discovered

Malpedia library date Threatpost fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Linux Modules Connected to Turla APT Discovered

Linux Modules Connected to Turla APT Discovered

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Linux Modules Connected to Turla APT Discovered

Defending Against the Dragonfly Cyber Security Attacks v3.0.pdf

file creation date fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Defending Against the Dragonfly Cyber Security Attacks v3.0.pdf

The ‘Penquin’ Turla

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The ‘Penquin’ Turla

The ‘Penquin’ Turla

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The ‘Penquin’ Turla

The ‘Penquin’ Turla - Securelist

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The ‘Penquin’ Turla - Securelist

Regin: nation-state ownage of GSM networks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Regin: nation-state ownage of GSM networks

The Regin Platform Nation-State Ownership Of Gsm Networks

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The Regin Platform Nation-State Ownership Of Gsm Networks

Kaspersky_Lab_whitepaper_Regin_platform_eng.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Kaspersky_Lab_whitepaper_Regin_platform_eng.pdf

Regin- nation-state ownage of GSM networks

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Regin- nation-state ownage of GSM networks

The Darkhotel APT A Story of Unusual Hospitality v1.1

file creation date Kaspersky fromORKL

Archived copy on ORKL Detailsfor The Darkhotel APT A Story of Unusual Hospitality v1.1

The Uroburos case: new sophisticated RAT identified

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Uroburos case: new sophisticated RAT identified

The Uroburos case: Agent.BTZ’s successor, ComRAT

date in the CCS '25 data Gdata fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The Uroburos case: Agent.BTZ’s successor, ComRAT

The Uroburos case- new sophisticated RAT identified

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Uroburos case- new sophisticated RAT identified

The Darkhotel Apt A Story Of Unusual Hospitality v1.0

file creation date Kaspersky fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The Darkhotel Apt A Story Of Unusual Hospitality v1.0

COM Object hijacking: the discreet way of persistence

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor COM Object hijacking: the discreet way of persistence

Profiling An Enigma: The Mystery Of North Korea's Cyber Threat Landscape

date in the CCS '25 data HP fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Profiling An Enigma: The Mystery Of North Korea's Cyber Threat Landscape

The Epic Turla Operation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Epic Turla Operation

The Epic Turla Operation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Epic Turla Operation

The Epic Turla Operation: Solving Some Of The Mysteries Of Snake/Uroboros

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The Epic Turla Operation: Solving Some Of The Mysteries Of Snake/Uroboros

Sophisticated 'Turla' hackers spying on European governments, say researchers

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Sophisticated 'Turla' hackers spying on European governments, say researchers

Sophisticated 'Turla' hackers spying on European governments, say researchers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sophisticated 'Turla' hackers spying on European governments, say researchers

The Epic Turla Operation - Securelist

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The Epic Turla Operation - Securelist

The Epic Turla Operation

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Epic Turla Operation

Tr-25 Analysis - Turla / PNet / Snake/ Uroburos

date in the CCS '25 data CIRCL fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Tr-25 Analysis - Turla / PNet / Snake/ Uroburos

Analysis of Uroburos, using WinDbg

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Analysis of Uroburos, using WinDbg

Analysis of Uroburos, using WinDbg

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis of Uroburos, using WinDbg

Uroburos rootkit: Belgian Foreign Ministry stricken

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Uroburos rootkit: Belgian Foreign Ministry stricken

Uroburos rootkit- Belgian Foreign Ministry stricken

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Uroburos rootkit- Belgian Foreign Ministry stricken

Uroburos the Snake Rootkit

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Uroburos the Snake Rootkit

Agent.btz- a Source of Inspiration-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Agent.btz- a Source of Inspiration-

Agent.btz: a Source of Inspiration?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Agent.btz: a Source of Inspiration?

Turla

date in the CCS '25 data Reuters fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Turla

Uroburos – Deeper travel into kernel protection mitigation

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Uroburos – Deeper travel into kernel protection mitigation

Uroburos – Deeper travel into kernel protection mitigation

Malpedia library date fromORKL