APT29

Also reported as UNC2452, Midnight Blizzard, NOBELIUM, The Dukes, UNC3524 and 37 other names. Linked to Russia by four sources.

Reports: 1,179
Last reported: 19 September 2026
Known CVEs: 440
Techniques in ATT&CK: 66
Origin: Russia

ID: G0016
Sources: ATT&CK MISP ETDA Malpedia Microsoft
Merge evidence: 71 alias matches

Reports per quarter

2014 Q3: 1 report
2014 Q4: 2 reports
2015 Q1: no reports
2015 Q2: 2 reports
2015 Q3: 16 reports
2015 Q4: 1 report
2016 Q1: 3 reports
2016 Q2: 6 reports
2016 Q3: 3 reports
2016 Q4: 4 reports
2017 Q1: 9 reports
2017 Q2: 9 reports
2017 Q3: no reports
2017 Q4: 1 report
2018 Q1: 1 report
2018 Q2: 3 reports
2018 Q3: 4 reports
2018 Q4: 10 reports
2019 Q1: 6 reports
2019 Q2: 11 reports
2019 Q3: 3 reports
2019 Q4: 10 reports
2020 Q1: 8 reports
2020 Q2: 17 reports
2020 Q3: 34 reports
2020 Q4: 126 reports
2021 Q1: 108 reports
2021 Q2: 98 reports
2021 Q3: 84 reports
2021 Q4: 68 reports
2022 Q1: 73 reports
2022 Q2: 92 reports
2022 Q3: 73 reports
2022 Q4: 20 reports
2023 Q1: 29 reports
2023 Q2: 19 reports
2023 Q3: 23 reports
2023 Q4: 20 reports
2024 Q1: 15 reports
2024 Q2: 17 reports
2024 Q3: 25 reports
2024 Q4: 14 reports
2025 Q1: 7 reports
2025 Q2: 10 reports
2025 Q3: 8 reports
2025 Q4: 6 reports
2026 Q1: 6 reports
2026 Q2: 72 reports
2026 Q3: 2 reports

Dated reports, 2014 Q3 to 2026 Q3.

Techniques seen in the last two years

T1027 8 reports reports only
T1053.005 8 reports in ATT&CK
T1566.001 8 reports in ATT&CK
T1057 7 reports reports only
T1071.001 7 reports reports only
T1082 7 reports reports only
T1041 6 reports reports only
T1059.001 6 reports in ATT&CK
T1059.003 6 reports reports only
T1071 6 reports reports only

Show all 311 techniques Show fewer

T1105 6 reports in ATT&CK
T1204.002 6 reports in ATT&CK
T1005 5 reports in ATT&CK
T1007 5 reports reports only
T1047 5 reports in ATT&CK
T1068 5 reports in ATT&CK
T1098 5 reports reports only
T1190 5 reports in ATT&CK
T1572 5 reports reports only
T1003.001 4 reports reports only
T1016 4 reports reports only
T1021.001 4 reports reports only
T1033 4 reports reports only
T1046 4 reports reports only
T1055.002 4 reports reports only
T1056.001 4 reports reports only
T1059 4 reports reports only
T1059.007 4 reports reports only
T1070.004 4 reports in ATT&CK
T1071.004 4 reports reports only
T1098.001 4 reports reports only
T1114.002 4 reports in ATT&CK
T1133 4 reports in ATT&CK
T1140 4 reports reports only
T1189 4 reports reports only
T1199 4 reports in ATT&CK
T1482 4 reports reports only
T1505.003 4 reports in ATT&CK
T1566 4 reports reports only
T1583.003 4 reports reports only
T1018 3 reports reports only
T1020 3 reports reports only
T1027.009 3 reports reports only
T1036.005 3 reports in ATT&CK
T1049 3 reports reports only
T1059.005 3 reports reports only
T1069.002 3 reports reports only
T1078 3 reports in ATT&CK
T1078.004 3 reports in ATT&CK
T1083 3 reports reports only
T1087.001 3 reports reports only
T1087.002 3 reports reports only
T1090.003 3 reports in ATT&CK
T1095 3 reports reports only
T1111 3 reports reports only
T1132.001 3 reports reports only
T1136 3 reports reports only
T1136.001 3 reports reports only
T1195.002 3 reports reports only
T1203 3 reports in ATT&CK
T1219 3 reports reports only
T1486 3 reports reports only
T1518.001 3 reports reports only
T1528 3 reports in ATT&CK
T1547.001 3 reports in ATT&CK
T1555.003 3 reports reports only
T1560.001 3 reports reports only
T1567 3 reports reports only
T1570 3 reports reports only
T1571 3 reports reports only
T1573.001 3 reports reports only
T1574.001 3 reports reports only
T1583 3 reports reports only
T1583.001 3 reports reports only
T1584 3 reports reports only
T1588.003 3 reports reports only
T1595 3 reports reports only
T1003.002 2 reports in ATT&CK
T1003.006 2 reports reports only
T1008 2 reports reports only
T1012 2 reports reports only
T1016.001 2 reports in ATT&CK
T1021.002 2 reports reports only
T1021.004 2 reports reports only
T1036 2 reports reports only
T1039 2 reports reports only
T1055 2 reports reports only
T1055.004 2 reports reports only
T1059.006 2 reports in ATT&CK
T1069 2 reports reports only
T1069.001 2 reports reports only
T1070 2 reports reports only
T1074 2 reports reports only
T1090 2 reports reports only
T1090.001 2 reports reports only
T1098.005 2 reports in ATT&CK
T1098.007 2 reports reports only
T1104 2 reports reports only
T1114 2 reports reports only
T1119 2 reports reports only
T1120 2 reports reports only
T1124 2 reports reports only
T1129 2 reports reports only
T1134.001 2 reports reports only
T1135 2 reports reports only
T1195 2 reports reports only
T1204 2 reports reports only
T1213 2 reports reports only
T1213.002 2 reports reports only
T1213.003 2 reports reports only
T1217 2 reports reports only
T1218.005 2 reports in ATT&CK
T1496 2 reports reports only
T1497.003 2 reports reports only
T1505.004 2 reports reports only
T1518 2 reports reports only
T1543.003 2 reports reports only
T1547.009 2 reports reports only
T1548 2 reports reports only
T1550 2 reports reports only
T1550.001 2 reports reports only
T1552 2 reports reports only
T1552.004 2 reports reports only
T1558.003 2 reports reports only
T1560 2 reports reports only
T1566.002 2 reports in ATT&CK
T1566.004 2 reports reports only
T1567.001 2 reports reports only
T1573.002 2 reports reports only
T1583.006 2 reports in ATT&CK
T1586.002 2 reports in ATT&CK
T1587.001 2 reports in ATT&CK
T1590 2 reports reports only
T1595.002 2 reports in ATT&CK
T1608 2 reports reports only
T1608.001 2 reports reports only
T1608.002 2 reports reports only
T1608.003 2 reports reports only
T1608.006 2 reports reports only
T1620 2 reports reports only
T1649 2 reports in ATT&CK
T1003 1 report reports only
T1003.003 1 report reports only
T1003.004 1 report in ATT&CK
T1003.008 1 report reports only
T1010 1 report reports only
T1021 1 report reports only
T1021.005 1 report reports only
T1021.006 1 report reports only
T1027.003 1 report reports only
T1027.005 1 report reports only
T1027.006 1 report in ATT&CK
T1027.007 1 report reports only
T1030 1 report reports only
T1036.003 1 report reports only
T1037 1 report in ATT&CK
T1037.001 1 report reports only
T1037.004 1 report in ATT&CK
T1040 1 report reports only
T1048 1 report reports only
T1048.003 1 report reports only
T1053 1 report reports only
T1053.003 1 report reports only
T1055.001 1 report reports only
T1055.003 1 report reports only
T1055.009 1 report reports only
T1055.012 1 report reports only
T1056 1 report reports only
T1059.002 1 report reports only
T1059.004 1 report reports only
T1059.009 1 report in ATT&CK
T1059.010 1 report reports only
T1059.011 1 report reports only
T1069.003 1 report reports only
T1070.006 1 report in ATT&CK
T1072 1 report reports only
T1074.001 1 report reports only
T1074.002 1 report reports only
T1078.002 1 report reports only
T1078.003 1 report in ATT&CK
T1087 1 report reports only
T1087.003 1 report reports only
T1087.004 1 report in ATT&CK
T1090.002 1 report in ATT&CK
T1091 1 report reports only
T1098.002 1 report in ATT&CK
T1098.003 1 report reports only
T1098.004 1 report reports only
T1098.006 1 report reports only
T1102 1 report reports only
T1102.002 1 report reports only
T1110 1 report reports only
T1110.003 1 report in ATT&CK
T1113 1 report reports only
T1114.001 1 report reports only
T1114.003 1 report reports only
T1115 1 report reports only
T1123 1 report reports only
T1125 1 report reports only
T1132 1 report reports only
T1134 1 report reports only
T1136.002 1 report reports only
T1137 1 report reports only
T1137.006 1 report reports only
T1185 1 report reports only
T1195.001 1 report reports only
T1200 1 report reports only
T1201 1 report reports only
T1204.001 1 report in ATT&CK
T1204.004 1 report reports only
T1210 1 report reports only
T1213.001 1 report reports only
T1218.007 1 report reports only
T1218.011 1 report reports only
T1480 1 report reports only
T1484 1 report reports only
T1484.001 1 report reports only
T1484.002 1 report reports only
T1485 1 report reports only
T1489 1 report reports only
T1490 1 report reports only
T1491.001 1 report reports only
T1491.002 1 report reports only
T1497 1 report reports only
T1497.001 1 report reports only
T1498 1 report reports only
T1499 1 report reports only
T1505 1 report reports only
T1526 1 report reports only
T1529 1 report reports only
T1530 1 report reports only
T1534 1 report reports only
T1537 1 report reports only
T1538 1 report reports only
T1539 1 report reports only
T1543 1 report reports only
T1543.002 1 report reports only
T1543.004 1 report reports only
T1546 1 report reports only
T1546.003 1 report in ATT&CK
T1546.004 1 report reports only
T1546.008 1 report in ATT&CK
T1546.012 1 report reports only
T1546.015 1 report reports only
T1547 1 report reports only
T1547.002 1 report reports only
T1547.005 1 report reports only
T1548.002 1 report in ATT&CK
T1550.002 1 report reports only
T1552.001 1 report reports only
T1552.006 1 report reports only
T1554 1 report reports only
T1555 1 report reports only
T1555.005 1 report reports only
T1556 1 report reports only
T1556.006 1 report reports only
T1556.009 1 report reports only
T1558 1 report reports only
T1559 1 report reports only
T1560.002 1 report reports only
T1564.001 1 report reports only
T1564.004 1 report reports only
T1565 1 report reports only
T1565.001 1 report reports only
T1566.003 1 report in ATT&CK
T1567.002 1 report reports only
T1568.002 1 report reports only
T1569 1 report reports only
T1569.002 1 report reports only
T1573 1 report in ATT&CK
T1574 1 report reports only
T1574.008 1 report reports only
T1574.011 1 report reports only
T1578 1 report reports only
T1580 1 report reports only
T1583.004 1 report reports only
T1584.004 1 report reports only
T1584.005 1 report reports only
T1584.006 1 report reports only
T1585 1 report reports only
T1585.002 1 report reports only
T1587 1 report reports only
T1587.003 1 report in ATT&CK
T1588 1 report reports only
T1588.002 1 report in ATT&CK
T1588.004 1 report reports only
T1588.007 1 report reports only
T1589 1 report reports only
T1589.002 1 report reports only
T1590.005 1 report reports only
T1592 1 report reports only
T1595.001 1 report reports only
T1598 1 report reports only
T1602 1 report reports only
T1602.001 1 report reports only
T1602.002 1 report reports only
T1606.001 1 report reports only
T1606.002 1 report reports only
T1608.004 1 report reports only
T1608.005 1 report reports only
T1613 1 report reports only
T1614 1 report reports only
T1614.001 1 report reports only
T1615 1 report reports only
T1619 1 report reports only
T1621 1 report in ATT&CK
T1622 1 report reports only
T1652 1 report reports only
T1654 1 report reports only
T1657 1 report reports only
T1665 1 report in ATT&CK

Counts come from technique IDs in the actor's report text. “Reports only” means reports name the technique but MITRE ATT&CK® does not list it for this actor.

Also listed by ATT&CK

Show all 13 techniques Show fewer

T1685.002

CVEs named in reports

Show all 440 CVEs Show fewer

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

19 September 2026

Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection
31 July 2026

CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft
14 May 2026

FrostyNeighbor: Fresh mischief and digital shenanigans

publisher's date ESET Research fromORKLESET

Archived copy on ORKL Detailsfor FrostyNeighbor: Fresh mischief and digital shenanigans
13 April 2026

Unmasking APT29: The Sophisticated Phishing Campaign Targeting European Diplomacy

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Unmasking APT29: The Sophisticated Phishing Campaign Targeting European Diplomacy
6 April 2026

Cozy Bear

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Cozy Bear
6 April 2026

APT29 Continues Targeting Microsoft 365 | You Can't Audit Me

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor APT29 Continues Targeting Microsoft 365 | You Can't Audit Me
6 April 2026

TEARDROP (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor TEARDROP (Malware Family)
6 April 2026

Russian Foreign Intelligence Service (SVR) Cyber Operations: Trends and Best Practices for Network Defenders | CISA

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Russian Foreign Intelligence Service (SVR) Cyber Operations: Trends and Best Practices for Network Defenders | CISA
6 April 2026

Midnight Blizzard attack on Microsoft corporate environment: a detailed analysis, detections and recommendations

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Midnight Blizzard attack on Microsoft corporate environment: a detailed analysis, detections and recommendations
6 April 2026

To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions | Mandiant

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions | Mandiant

Show all 1,179 reports Show fewer

6 April 2026

Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia
6 April 2026

Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452 | Blog | Mandiant

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452 | Blog | Mandiant
6 April 2026

UNC2452 Merged into APT29 | Russia-Based Espionage Group

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor UNC2452 Merged into APT29 | Russia-Based Espionage Group
6 April 2026

New activity from Russian actor Nobelium

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor New activity from Russian actor Nobelium
6 April 2026

Lapsus$ Activity Betrays Nation-State Motivation

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Lapsus$ Activity Betrays Nation-State Motivation
6 April 2026

APT 29, Cozy Bear, The Dukes

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor APT 29, Cozy Bear, The Dukes
6 April 2026

Sliver C2 Leveraged by Many Threat Actors

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Sliver C2 Leveraged by Many Threat Actors
6 April 2026

Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia
6 April 2026

APT 29, Cozy Bear, The Dukes

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor APT 29, Cozy Bear, The Dukes
6 April 2026

Russian hackers bypass 2FA by annoying victims with repeated push notifications

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Russian hackers bypass 2FA by annoying victims with repeated push notifications
6 April 2026

Analysis of cyberattack on U.S. think tanks, non-profits, public sector by unidentified attackers

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Analysis of cyberattack on U.S. think tanks, non-profits, public sector by unidentified attackers
6 April 2026

DNS Beacons

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor DNS Beacons
6 April 2026

Analysis of the SolarWinds Supply Chain Attack

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Analysis of the SolarWinds Supply Chain Attack
6 April 2026

What are State Sponsored Cyber Attacks? - Detailed Guide

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor What are State Sponsored Cyber Attacks? - Detailed Guide
6 April 2026

Anti-Forensic Techniques Used By Lazarus Group - ASEC

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Anti-Forensic Techniques Used By Lazarus Group - ASEC
6 April 2026

UNC3524: Eye Spy on Your Email | Mandiant

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor UNC3524: Eye Spy on Your Email | Mandiant
6 April 2026

Operation RestyLink: APT campaign targeting Japanese companies

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Operation RestyLink: APT campaign targeting Japanese companies
6 April 2026

Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure | CISA

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure | CISA
6 April 2026

France warns of Nobelium cyberspies attacking French orgs

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor France warns of Nobelium cyberspies attacking French orgs
6 April 2026

elf.wellmess (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor elf.wellmess (Malware Family)
6 April 2026

SUNBURST (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor SUNBURST (Malware Family)
6 April 2026

Notorious Cybercriminals Evil Corp Actually Russian Spies? - Trulysuper

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Notorious Cybercriminals Evil Corp Actually Russian Spies? - Trulysuper
6 April 2026

HPE: Russian hackers breached security team's email accounts

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor HPE: Russian hackers breached security team's email accounts
6 April 2026

Russia-Ukraine War: Cyber Threat Intelligence Report | Security Insider

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Russia-Ukraine War: Cyber Threat Intelligence Report | Security Insider
6 April 2026

Cloud Security Resources

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Cloud Security Resources
6 April 2026

Living off the Land - Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Living off the Land - Threat Group Cards: A Threat Actor Encyclopedia
6 April 2026

APT 29, Cozy Bear, The Dukes

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor APT 29, Cozy Bear, The Dukes
6 April 2026

Malware Unpacking With Hardware Breakpoints - Cobalt Strike Shellcode Loader

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Malware Unpacking With Hardware Breakpoints - Cobalt Strike Shellcode Loader
6 April 2026

TeamViewer's corporate network was breached in alleged APT hack

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor TeamViewer's corporate network was breached in alleged APT hack
6 April 2026

How to Use Ghidra to Analyse Shellcode and Extract Cobalt Strike Command & Control Servers

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor How to Use Ghidra to Analyse Shellcode and Extract Cobalt Strike Command & Control Servers
6 April 2026

APT trends report Q2 2021

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor APT trends report Q2 2021
6 April 2026

GoldMax (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor GoldMax (Malware Family)
6 April 2026

Unit42-timely-threat-intel/2024-06-25-IOCs-from-Latrodectus-activity.txt at main · PaloAltoNetworks/Unit42-timely-threat-intel

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Unit42-timely-threat-intel/2024-06-25-IOCs-from-Latrodectus-activity.txt at main · PaloAltoNetworks/Unit42-timely-threat-intel
6 April 2026

No Easy Breach DerbyCon 2016

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor No Easy Breach DerbyCon 2016
6 April 2026

Exclusive: Russian spies hacked UK government data and emails earlier this year

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Exclusive: Russian spies hacked UK government data and emails earlier this year
6 April 2026

Ghidra Tutorial - Using Entropy To Locate Cobalt Strike Decryption Functions

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Ghidra Tutorial - Using Entropy To Locate Cobalt Strike Decryption Functions
6 April 2026

Defence Evasion Technique: Timestomping Detection – NTFS Forensics

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Defence Evasion Technique: Timestomping Detection – NTFS Forensics
6 April 2026

APT and financial attacks on industrial organizations in H1 2023 | Kaspersky ICS CERT EN

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor APT and financial attacks on industrial organizations in H1 2023 | Kaspersky ICS CERT EN
6 April 2026

SVR Cyber Actors Adapt Tactics for Initial Cloud Access | CISA

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor SVR Cyber Actors Adapt Tactics for Initial Cloud Access | CISA
6 April 2026

No Easy Breach DerbyCon 2016

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor No Easy Breach DerbyCon 2016
6 April 2026

IT threat evolution Q3 2021 - RedPacket Security

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor IT threat evolution Q3 2021 - RedPacket Security
6 April 2026

Definitive Dossier of Devilish Debug Details — Part One: PDB Paths and Malware | Mandiant

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Definitive Dossier of Devilish Debug Details — Part One: PDB Paths and Malware | Mandiant
6 April 2026

Intruders in the Library: Exploring DLL Hijacking

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Intruders in the Library: Exploring DLL Hijacking
6 April 2026

Evolving Tactics: How Russian APT Groups Are Shaping Cyber Threats in 2024

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Evolving Tactics: How Russian APT Groups Are Shaping Cyber Threats in 2024
6 April 2026

Cranefly: Threat Actor Uses Previously Unseen Techniques and Tools in Stealthy Campaign

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Cranefly: Threat Actor Uses Previously Unseen Techniques and Tools in Stealthy Campaign
6 April 2026

Mapping the connections inside Russia's APT Ecosystem - Check Point Research

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Mapping the connections inside Russia's APT Ecosystem - Check Point Research
6 April 2026

SOLARWINDS HACK - Sunburst, Supernova and more - CYFIRMA

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor SOLARWINDS HACK - Sunburst, Supernova and more - CYFIRMA
6 April 2026

Microsoft Defender Hotinformation | Microsoft Security

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Microsoft Defender Hotinformation | Microsoft Security
6 April 2026

Aktive APT-Gruppen in Deutschland

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Aktive APT-Gruppen in Deutschland
6 April 2026

Russian spies' hacking campaign is 'endangering' French diplomatic interests

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Russian spies' hacking campaign is 'endangering' French diplomatic interests
6 April 2026

BlueTeam CheatSheet * SolarWinds Events* | Last updated: 2020-12-24 1334 UTC

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor BlueTeam CheatSheet * SolarWinds Events* | Last updated: 2020-12-24 1334 UTC
6 April 2026

German Embassy Lure: Likely Part of Campaign Against NATO Aligned Ministries of Foreign Affairs

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor German Embassy Lure: Likely Part of Campaign Against NATO Aligned Ministries of Foreign Affairs
6 April 2026

They See Me Roaming: Following APT29 by Taking a Deeper Look at Windows Credential Roaming | Mandiant

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor They See Me Roaming: Following APT29 by Taking a Deeper Look at Windows Credential Roaming | Mandiant
6 April 2026

Cobalt Strike (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Cobalt Strike (Malware Family)
6 April 2026

BONDUPDATER (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor BONDUPDATER (Malware Family)
6 April 2026

Router Roulette: Cybercriminals and Nation-States Sharing Compromised Networks

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Router Roulette: Cybercriminals and Nation-States Sharing Compromised Networks
6 April 2026

To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions | Mandiant

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions | Mandiant
6 April 2026

Sofacy, APT 28, Fancy Bear, Sednit

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Sofacy, APT 28, Fancy Bear, Sednit
6 April 2026

Consequences - The Conti Leaks and future problems

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Consequences - The Conti Leaks and future problems
6 April 2026

Minidionis - one more APT with a usage of cloud drives

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Minidionis - one more APT with a usage of cloud drives
6 April 2026

Identifying Rogue Cobalt Strike Servers: A Recorded Future Approach | Recorded Future

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Identifying Rogue Cobalt Strike Servers: A Recorded Future Approach | Recorded Future
6 April 2026

Azerbaijan blames Russian state hackers for cyberattacks on local media

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Azerbaijan blames Russian state hackers for cyberattacks on local media
6 April 2026

Kremlin-backed hacking group puts fresh emphasis on stealing credentials

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Kremlin-backed hacking group puts fresh emphasis on stealing credentials
6 April 2026

Threat Intelligence Query Examples - Real World Queries for Identifying Malware Infrastructure

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Threat Intelligence Query Examples - Real World Queries for Identifying Malware Infrastructure
17 March 2026

Operation GhostMail: Russian APT exploits Zimbra Webmail to Target Ukraine State Agency

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation GhostMail: Russian APT exploits Zimbra Webmail to Target Ukraine State Agency
26 February 2026

PlugX Meeting Invitation via MSBuild and GDATA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PlugX Meeting Invitation via MSBuild and GDATA
5 February 2026

The Shadow Campaigns: Uncovering Global Espionage

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Shadow Campaigns: Uncovering Global Espionage
3 February 2026

The Notepad++ supply chain attack — unnoticed execution chains and new IoCs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Notepad++ supply chain attack — unnoticed execution chains and new IoCs
26 January 2026

GOGITTER, GITSHELLPAD, and GOSHELL Analysis | ThreatLabz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GOGITTER, GITSHELLPAD, and GOSHELL Analysis | ThreatLabz
4 January 2026

From a New Year's surprise to a bag of coal - Analysis of mystery PowerShell

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From a New Year's surprise to a bag of coal - Analysis of mystery PowerShell
19 December 2025

Multiple Threat Actors Leveraging CVE-2025-55182 (React2Shell)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Multiple Threat Actors Leveraging CVE-2025-55182 (React2Shell)
20 November 2025

APT24's Pivot to Multi-Vector Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT24's Pivot to Multi-Vector Attacks
13 November 2025

Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 3)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 3)
30 October 2025

Is RuskiNet the Next Big Russian Hacktivist Group

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Is RuskiNet the Next Big Russian Hacktivist Group
22 October 2025

The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns
2 October 2025

UAT-8099: Chinese-speaking cybercrime group targets high-value IIS for SEO fraud

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UAT-8099: Chinese-speaking cybercrime group targets high-value IIS for SEO fraud
29 September 2025

From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion
24 September 2025

Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors
24 September 2025

Chinese Hackers RedNovember Target Global Governments Using Pantegana and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese Hackers RedNovember Target Global Governments Using Pantegana and Cobalt Strike
28 August 2025

TAOTH Campaign Exploits End-of-Support Software to Target Traditional Chinese Users and Dissidents

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TAOTH Campaign Exploits End-of-Support Software to Target Traditional Chinese Users and Dissidents
27 August 2025

ShadowSilk: A Cross-Border Binary Union for Data Exfiltration | Group-IB Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ShadowSilk: A Cross-Border Binary Union for Data Exfiltration | Group-IB Blog
21 July 2025

The SOC files: Rumble in the jungle or APT41’s new target in Africa

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The SOC files: Rumble in the jungle or APT41’s new target in Africa
17 July 2025

Dissecting the ClickFix User-Execution Attack and Its Sophisticated Persistence via ADS

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dissecting the ClickFix User-Execution Attack and Its Sophisticated Persistence via ADS
16 July 2025

Phish and Chips: China-Aligned Espionage Actors Ramp Up Taiwan Semiconductor Industry Targeting | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Phish and Chips: China-Aligned Espionage Actors Ramp Up Taiwan Semiconductor Industry Targeting | Proofpoint US
24 June 2025

Cyber%20Threat%20Intelligence%20Report%202025.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber%20Threat%20Intelligence%20Report%202025.pdf
23 June 2025

Threat Hunting Introduction: Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Hunting Introduction: Cobalt Strike
19 June 2025

Cobalt Strike Operators Leverage PowerShell Loaders Across Chinese, Russian, and Global Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Operators Leverage PowerShell Loaders Across Chinese, Russian, and Global Infrastructure
18 June 2025

What’s in an ASP? Creative Phishing Attack on Prominent Academics and Critics of Russia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What’s in an ASP? Creative Phishing Attack on Prominent Academics and Critics of Russia
15 June 2025

Team46 and TaxOff: two sides of the same coin

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Team46 and TaxOff: two sides of the same coin
27 May 2025

Earth Lamia Develops Custom Arsenal to Target Multiple Industries

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Lamia Develops Custom Arsenal to Target Multiple Industries
10 May 2025

Malware development trick 47: simple Windows clipboard hijacking. Simple C example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development trick 47: simple Windows clipboard hijacking. Simple C example.
29 April 2025

Nitrogen Dropping Cobalt Strike – A Combination of “Chemical Elements”

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Nitrogen Dropping Cobalt Strike – A Combination of “Chemical Elements”
24 April 2025

m-trends-2025-en.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor m-trends-2025-en.pdf
15 April 2025

Renewed APT29 Phishing Campaign Against European Diplomats - Check Point Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Renewed APT29 Phishing Campaign Against European Diplomats - Check Point Research
31 March 2025

Operation HollowQuill: Malware delivered into Russian R&D Networks via Research Decoy PDFs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation HollowQuill: Malware delivered into Russian R&D Networks via Research Decoy PDFs
31 March 2025

The Espionage Toolkit of Earth Alux A Closer Look at its Advanced Techniques

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Espionage Toolkit of Earth Alux A Closer Look at its Advanced Techniques
29 January 2025

CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia
23 January 2025

Unit42-timely-threat-intel/2025-01-17-IOCs-for-infrastructure-used-by-affiliate-of-Dark-Scorpius.txt at main · PaloAltoNetworks/Unit42-timely-threat-intel

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unit42-timely-threat-intel/2025-01-17-IOCs-for-infrastructure-used-by-affiliate-of-Dark-Scorpius.txt at main · PaloAltoNetworks/Unit42-timely-threat-intel
21 January 2025

JSAC2025_1_5_leon-chang_theo-chen_en.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor JSAC2025_1_5_leon-chang_theo-chen_en.pdf
10 January 2025

Jul-Dec%202024%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Jul-Dec%202024%20Botnet%20Threat%20Update.pdf
7 January 2025

Golang Beacons and VS Code Tunnels: Tracking a Cobalt Strike Server Leveraging Trusted Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Golang Beacons and VS Code Tunnels: Tracking a Cobalt Strike Server Leveraging Trusted Infrastructure
17 December 2024

Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks
4 December 2024

Black Basta Ransomware Campaign Drops Zbot, DarkGate, and Custom Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Black Basta Ransomware Campaign Drops Zbot, DarkGate, and Custom Malware
3 December 2024

Rare Watermark Links Cobalt Strike 4.10 Team Servers to Ongoing Suspicious Activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rare Watermark Links Cobalt Strike 4.10 Team Servers to Ongoing Suspicious Activity
2 December 2024

The Curious Case of an Egg-Cellent Resume

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor The Curious Case of an Egg-Cellent Resume
19 November 2024

Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella
12 November 2024

China-Nexus TAG-112 Compromises Tibetan Websites to Distribute Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-Nexus TAG-112 Compromises Tibetan Websites to Distribute Cobalt Strike
12 November 2024

China-Nexus TAG-112 Compromises Tibetan Websites to Distribute Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-Nexus TAG-112 Compromises Tibetan Websites to Distribute Cobalt Strike
31 October 2024

Tricks, Treats, and Threats: Cobalt Strike & the Goblin Lurking in Plain Sight

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tricks, Treats, and Threats: Cobalt Strike & the Goblin Lurking in Plain Sight
29 October 2024

Midnight Blizzard conducts large-scale spear-phishing campaign using RDP files

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Midnight Blizzard conducts large-scale spear-phishing campaign using RDP files
24 October 2024

Operation Cobalt Whisper: Threat Actor Targets Multiple Industries Across Hong Kong and Pakistan.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Cobalt Whisper: Threat Actor Targets Multiple Industries Across Hong Kong and Pakistan.
23 October 2024

Threat Spotlight: WarmCookie/BadSpace

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Spotlight: WarmCookie/BadSpace
23 October 2024

Highlighting TA866/Asylum Ambuscade Activity Since 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Highlighting TA866/Asylum Ambuscade Activity Since 2021
10 October 2024

Unmasking Adversary Infrastructure: How Certificates and Redirects Exposed Earth Baxia and PlugX Activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unmasking Adversary Infrastructure: How Certificates and Redirects Exposed Earth Baxia and PlugX Activity
9 October 2024

241010.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor 241010.pdf
24 September 2024

Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdf
22 September 2024

The Russian APT Tool Matrix

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Russian APT Tool Matrix
19 September 2024

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/earth-baxia-uses-spear-phishing-and-geoserver-exploit-to-target-apac/IOCs%20-%20Earth%20Baxia%20Uses%20Spear-Phishing%20and%20GeoServer%20Exploit%20to%20Target%20APAC.txt

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/earth-baxia-uses-spear-phishing-and-geoserver-exploit-to-target-apac/IOCs%20-%20Earth%20Baxia%20Uses%20Spear-Phishing%20and%20GeoServer%20Exploit%20to%20Target%20APAC.txt
19 September 2024

Earth Baxia Uses Spear-Phishing and GeoServer Exploit to Target APAC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Baxia Uses Spear-Phishing and GeoServer Exploit to Target APAC
29 August 2024

State-backed attackers and commercial surveillance vendors repeatedly use the same exploits

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor State-backed attackers and commercial surveillance vendors repeatedly use the same exploits
29 August 2024

From Cobalt Strike to Mimikatz: A Deep Dive into the SLOW#TEMPEST Campaign Targeting Chinese Users

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From Cobalt Strike to Mimikatz: A Deep Dive into the SLOW#TEMPEST Campaign Targeting Chinese Users
26 August 2024

BlackSuit Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor BlackSuit Ransomware
23 August 2024

Sailing_the_Seven_SEAs_Deep_Dive_into_Polaris_Arsenal_and_Intelligence_Insights.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sailing_the_Seven_SEAs_Deep_Dive_into_Polaris_Arsenal_and_Intelligence_Insights.pdf
23 August 2024

Pirates_of_The_Nang_Hai_Follow_the_Artifacts_of_Tropic_Trooper,_No_One_Knows.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Pirates_of_The_Nang_Hai_Follow_the_Artifacts_of_Tropic_Trooper,_No_One_Knows.pdf
22 August 2024

AppDomainManager Injectionを悪用したマルウェアによる攻撃について

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AppDomainManager Injectionを悪用したマルウェアによる攻撃について
21 August 2024

Chinese APT abuses MSC files with GrimResource vulnerability

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese APT abuses MSC files with GrimResource vulnerability
14 August 2024

Rivers of Phish: Sophisticated Phishing Targets Russia’s Perceived Enemies Around the Globe - The Citizen Lab

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rivers of Phish: Sophisticated Phishing Targets Russia’s Perceived Enemies Around the Globe - The Citizen Lab
12 August 2024

Ongoing Social Engineering Campaign Refreshes Payloads

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ongoing Social Engineering Campaign Refreshes Payloads
4 August 2024

Decoding a Cobalt Strike Downloader Script With CyberChef

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Decoding a Cobalt Strike Downloader Script With CyberChef
2 August 2024

Fighting Ursa Luring Targets With Car for Sale

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Fighting Ursa Luring Targets With Car for Sale
1 August 2024

APT41 likely compromised Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT41 likely compromised Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike
29 July 2024

UNC4393 Goes Gently into the SILENTNIGHT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UNC4393 Goes Gently into the SILENTNIGHT
25 July 2024

UAC-0057 Attack Detection: A Surge in Adversary Activity Distributing PICASSOLOADER and Cobalt Strike Beacon

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UAC-0057 Attack Detection: A Surge in Adversary Activity Distributing PICASSOLOADER and Cobalt Strike Beacon
24 July 2024

Stargazers Ghost Network - Check Point Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Stargazers Ghost Network - Check Point Research
22 July 2024

A Beginner's Guide to Hunting Malicious Open Directories - Censys

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Beginner's Guide to Hunting Malicious Open Directories - Censys
18 July 2024

APT41 Has Arisen From the DUST

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT41 Has Arisen From the DUST
16 July 2024

TAG-100 Uses Open-Source Tools in Suspected Global Espionage Campaign, Compromising Two Asia-Pacific Intergovernmental Bodies

Malpedia library date Insikt Group® by Recorded Future® fromORKL

Archived copy on ORKL Detailsfor TAG-100 Uses Open-Source Tools in Suspected Global Espionage Campaign, Compromising Two Asia-Pacific Intergovernmental Bodies
10 July 2024

DodgeBox | ThreatLabz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DodgeBox | ThreatLabz
9 July 2024

Jan-Jun%202024%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Jan-Jun%202024%20Botnet%20Threat%20Update.pdf
2 July 2024

Exposing FakeBat loader: distribution methods and adversary infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Exposing FakeBat loader: distribution methods and adversary infrastructure
27 June 2024

Threat Actor Groups Tracked by Palo Alto Networks Unit 42 (Updated Aug. 1, 2025)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Actor Groups Tracked by Palo Alto Networks Unit 42 (Updated Aug. 1, 2025)
21 June 2024

GrimResource - Microsoft Management Console for initial access and evasion

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GrimResource - Microsoft Management Console for initial access and evasion
19 June 2024

CERTFR-2024-CTI-006.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERTFR-2024-CTI-006.pdf
10 June 2024

IcedID Brings ScreenConnect and CSharp Streamer to ALPHV Ransomware Deployment

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor IcedID Brings ScreenConnect and CSharp Streamer to ALPHV Ransomware Deployment
3 June 2024

Binary Defense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Binary Defense
23 May 2024

Sharp Dragon Expands Towards Africa and The Caribbean - Check Point Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sharp Dragon Expands Towards Africa and The Caribbean - Check Point Research
23 May 2024

Chinese Espionage Campaign Expands to Target Africa and The Caribbean

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese Espionage Campaign Expands to Target Africa and The Caribbean
15 May 2024

Threat actors misusing Quick Assist in social engineering attacks leading to ransomware | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat actors misusing Quick Assist in social engineering attacks leading to ransomware | Microsoft Security Blog
14 May 2024

QakBot attacks with Windows zero-day (CVE-2024-30051)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor QakBot attacks with Windows zero-day (CVE-2024-30051)
10 May 2024

Ongoing Social Engineering Campaign Linked to Black Basta Ransomware Operators

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ongoing Social Engineering Campaign Linked to Black Basta Ransomware Operators
1 May 2024

Router Roulette: Cybercriminals and Nation-States Sharing Compromised Networks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Router Roulette: Cybercriminals and Nation-States Sharing Compromised Networks
25 April 2024

Poll Vaulting: Cyber Threats to Global Elections

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Poll Vaulting: Cyber Threats to Global Elections
24 April 2024

Securonix Threat Research Security Advisory: Analysis of Ongoing FROZEN#SHADOW Attack Campaign Leveraging SSLoad Malware and RMM Software for Domain Takeover

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Securonix Threat Research Security Advisory: Analysis of Ongoing FROZEN#SHADOW Attack Campaign Leveraging SSLoad Malware and RMM Software for Domain Takeover
22 April 2024

m-trends-2024.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor m-trends-2024.pdf
11 April 2024

Unit42-timely-threat-intel/2024-04-15-IOC-for-Contact-Forms-campaign-SSLoad-activity.txt at main · PaloAltoNetworks/Unit42-timely-threat-intel

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unit42-timely-threat-intel/2024-04-15-IOC-for-Contact-Forms-campaign-SSLoad-activity.txt at main · PaloAltoNetworks/Unit42-timely-threat-intel
2 April 2024

APT and financial attacks on industrial organizations in H2 2023 | Kaspersky ICS CERT EN

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT and financial attacks on industrial organizations in H2 2023 | Kaspersky ICS CERT EN
1 April 2024

From OneNote to RansomNote: An Ice Cold Intrusion

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor From OneNote to RansomNote: An Ice Cold Intrusion
22 March 2024

APT29 Uses WINELOADER to Target German Political Parties

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT29 Uses WINELOADER to Target German Political Parties
20 March 2024

Review of the Summer 2023 Microsoft Exchange Online Intrusion

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Review of the Summer 2023 Microsoft Exchange Online Intrusion
19 March 2024

Rewterz Threat Alert – China-Linked Earth Krahang APT Breached 70 Organizations in 23 Nations – Active IOCs - Rewterz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rewterz Threat Alert – China-Linked Earth Krahang APT Breached 70 Organizations in 23 Nations – Active IOCs - Rewterz
14 March 2024

Uncovering residential proxy providers: Risks and market insights

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Uncovering residential proxy providers: Risks and market insights
1 March 2024

Malware Analysis — Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Analysis — Cobalt Strike
27 February 2024

WINELOADER Analysis | ThreatLabz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor WINELOADER Analysis | ThreatLabz
23 February 2024

SVR cyber actors adapt tactics for initial cloud access

file creation date fromORKL

Archived copy on ORKL Detailsfor SVR cyber actors adapt tactics for initial cloud access
17 February 2024

Russia-Aligned TAG-70 Targets European Government and Military Mail Servers in New Espionage Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Russia-Aligned TAG-70 Targets European Government and Military Mail Servers in New Espionage Campaign
16 February 2024

CVE-2024-21412_ Water Hydra Targets Traders with Microsoft Defender SmartScreen Zero-Day

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor CVE-2024-21412_ Water Hydra Targets Traders with Microsoft Defender SmartScreen Zero-Day
13 February 2024

CVE-2024-21412: Water Hydra Targets Traders with Microsoft Defender SmartScreen Zero-Day

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CVE-2024-21412: Water Hydra Targets Traders with Microsoft Defender SmartScreen Zero-Day
9 February 2024

A Beginner's Guide to Tracking Malware Infrastructure - Censys

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Beginner's Guide to Tracking Malware Infrastructure - Censys
26 January 2024

JSAC2024_2_7_hara_shoji_higashi_vickie-su_nick-dai_en.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor JSAC2024_2_7_hara_shoji_higashi_vickie-su_nick-dai_en.pdf
25 January 2024

Midnight Blizzard: Guidance for responders on nation-state attack | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Midnight Blizzard: Guidance for responders on nation-state attack | Microsoft Security Blog
12 January 2024

Q4%202023%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Q4%202023%20Botnet%20Threat%20Update.pdf
9 January 2024

2023 Adversary Infrastructure Report

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023 Adversary Infrastructure Report
13 December 2023

Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally

file creation date CISA fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally
13 December 2023

Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally | CISA
13 December 2023

TeamCity Intrusion Saga: APT29 Suspected Among the Attackers Exploiting CVE-2023-42793 | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TeamCity Intrusion Saga: APT29 Suspected Among the Attackers Exploiting CVE-2023-42793 | FortiGuard Labs
10 December 2023

Malware development: persistence - part 23. LNK files. Simple Powershell example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development: persistence - part 23. LNK files. Simple Powershell example.
8 December 2023

How to Use Ghidra to Analyse Shellcode and Extract Cobalt Strike Command & Control Servers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How to Use Ghidra to Analyse Shellcode and Extract Cobalt Strike Command & Control Servers
4 December 2023

SQL Brute Force Leads to BlueSky Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor SQL Brute Force Leads to BlueSky Ransomware
19 November 2023

Combining Pivot Points to Identify Malware Infrastructure - Redline, Smokeloader and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Combining Pivot Points to Identify Malware Infrastructure - Redline, Smokeloader and Cobalt Strike
14 November 2023

HostingHunter Series: CHANG WAY TECHNOLOGIES CO. LIMITED

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor HostingHunter Series: CHANG WAY TECHNOLOGIES CO. LIMITED
14 November 2023

APT29 attacks Embassies using CVE-2023-38831 - report

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT29 attacks Embassies using CVE-2023-38831 - report
14 November 2023

APT29 attacks Embassies using CVE-2023-38831 - report en

date in the CCS '25 data RSA fromCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Detailsfor APT29 attacks Embassies using CVE-2023-38831 - report en
10 November 2023

The New APT Group DarkCasino and the Global Surge in WinRAR 0-Day Exploits - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.

Malpedia library date NSFOCUS fromORKLCCS '25 data

Archived copy on ORKL Detailsfor The New APT Group DarkCasino and the Global Surge in WinRAR 0-Day Exploits - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.
7 November 2023

New Gootloader Variant “GootBot” Changes the Game in Malware Tactics

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Gootloader Variant “GootBot” Changes the Game in Malware Tactics
6 November 2023

Malware Unpacking With Hardware Breakpoints - Cobalt Strike Shellcode Loader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Unpacking With Hardware Breakpoints - Cobalt Strike Shellcode Loader
1 November 2023

Popping Blisters for research: An overview of past payloads and exploring recent developments

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Popping Blisters for research: An overview of past payloads and exploring recent developments
23 October 2023

Cobalt Strike .VBS Loader - Decoding with Advanced CyberChef and Emulation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike .VBS Loader - Decoding with Advanced CyberChef and Emulation
20 October 2023

Cobalt Strike Malware Analysis With CyberChef and Emulation - .HTA Loader Example

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Malware Analysis With CyberChef and Emulation - .HTA Loader Example
18 October 2023

Ghidra Tutorial - Using Entropy To Locate Cobalt Strike Decryption Functions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ghidra Tutorial - Using Entropy To Locate Cobalt Strike Decryption Functions
12 October 2023

Forensic Timeline of an IcedID Infection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Forensic Timeline of an IcedID Infection
12 October 2023

2023%20Q3%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023%20Q3%20Botnet%20Threat%20Update.pdf
10 October 2023

Grayling: Previously Unseen Threat Actor Targets Multiple Organizations in Taiwan

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Grayling: Previously Unseen Threat Actor Targets Multiple Organizations in Taiwan
29 September 2023

2023 State of The Threat – A Year in Review

Malpedia library date Secureworks fromORKL

Archived copy on ORKL Detailsfor 2023 State of The Threat – A Year in Review
29 September 2023

Lazarus luring employees with trojanized coding challenges: The case of a Spanish aerospace company

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lazarus luring employees with trojanized coding challenges: The case of a Spanish aerospace company
22 September 2023

Backchannel Diplomacy: APT29's Rapidly Evolving Diplomatic Phishing Operations | Mandiant

Malpedia library date Mandiant fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Backchannel Diplomacy: APT29's Rapidly Evolving Diplomatic Phishing Operations | Mandiant
22 September 2023

Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda
12 September 2023

Malware distributor Storm-0324 facilitates ransomware access | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware distributor Storm-0324 facilitates ransomware access | Microsoft Security Blog
12 September 2023

CERTFR-2023-CTI-007.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERTFR-2023-CTI-007.pdf
30 August 2023

IT threat evolution in Q2 2023

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor IT threat evolution in Q2 2023
30 August 2023

Earth Estries Targets Government, Tech for Cyberespionage

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Estries Targets Government, Tech for Cyberespionage
28 August 2023

HTML Smuggling Leads to Domain Wide Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor HTML Smuggling Leads to Domain Wide Ransomware
18 August 2023

Understanding Syscalls: Direct, Indirect, and Cobalt Strike Implementation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Understanding Syscalls: Direct, Indirect, and Cobalt Strike Implementation
18 August 2023

Unmasking CamoFei An In-depth Analysis of an Emerging APT Group Focused on Healthcare Sectors in East Asia

date in the CCS '25 data Team T5 fromCCS '25 data

Detailsfor Unmasking CamoFei An In-depth Analysis of an Emerging APT Group Focused on Healthcare Sectors in East Asia
17 August 2023

Chinese Entanglement | DLL Hijacking in the Asian Gambling Sector

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese Entanglement | DLL Hijacking in the Asian Gambling Sector
16 August 2023

Unmasking CamoFei

file creation date fromORKL

Archived copy on ORKL Detailsfor Unmasking CamoFei
10 August 2023

German Embassy Lure: Likely Part of Campaign Against NATO Aligned Ministries of Foreign Affairs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor German Embassy Lure: Likely Part of Campaign Against NATO Aligned Ministries of Foreign Affairs
7 August 2023

RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale
2 August 2023

Midnight Blizzard conducts targeted social engineering over Microsoft Teams | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Midnight Blizzard conducts targeted social engineering over Microsoft Teams | Microsoft Security Blog
29 July 2023

gcat_threathorizons_full_jul2023.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor gcat_threathorizons_full_jul2023.pdf
27 July 2023

BlueBravo Adapts to Target Diplomatic Entities with GraphicalProton Malware

Malpedia library date Recorded Future fromORKLCCS '25 data

Archived copy on ORKL Detailsfor BlueBravo Adapts to Target Diplomatic Entities with GraphicalProton Malware
26 July 2023

Malware development trick - part 35: Store payload in alternate data streams. Simple C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development trick - part 35: Store payload in alternate data streams. Simple C++ example.
12 July 2023

New invitation from APT29 to use CCleaner

Malpedia library date Lab52 fromORKLCCS '25 data

Archived copy on ORKL Detailsfor New invitation from APT29 to use CCleaner
12 July 2023

Diplomats Beware: Cloaked Ursa Phishing With a Twist

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Diplomats Beware: Cloaked Ursa Phishing With a Twist
11 July 2023

2023%20Q2%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023%20Q2%20Botnet%20Threat%20Update.pdf
7 July 2023

Beyond appearances: unknown actor using APT29’s TTP against Chinese users

Malpedia library date Lab52 fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Beyond appearances: unknown actor using APT29’s TTP against Chinese users
30 June 2023

Monthly news - July 2023

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Monthly news - July 2023
30 June 2023

Cobalt Strike’s Deployment with Hardware Breakpoint for AMSI Bypass

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike’s Deployment with Hardware Breakpoint for AMSI Bypass
16 June 2023

PicassoLoader and Cobalt Strike Beacon Detection: UAC-0057 aka GhostWriter Hacking Group Attacks the Ukrainian Leading Military Educational Institution

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PicassoLoader and Cobalt Strike Beacon Detection: UAC-0057 aka GhostWriter Hacking Group Attacks the Ukrainian Leading Military Educational Institution
15 June 2023

eSentire Threat Intelligence Malware Analysis: Resident Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eSentire Threat Intelligence Malware Analysis: Resident Campaign
8 June 2023

Threat Intelligence Query Examples - Real World Queries for Identifying Malware Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Intelligence Query Examples - Real World Queries for Identifying Malware Infrastructure
2 June 2023

Malware analysis report: SNOWYAMBER (+APT29 related malwares)

Malpedia library date MSSP Lab fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Malware analysis report: SNOWYAMBER (+APT29 related malwares)
25 May 2023

New tricks of APT29 - update on the CERT.PL report

date in the CCS '25 data Lab52 fromCCS '25 data

Detailsfor New tricks of APT29 - update on the CERT.PL report
11 May 2023

Malware development trick - part 28: Dump lsass.exe. Simple C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development trick - part 28: Dump lsass.exe. Simple C++ example.
28 April 2023

Unleashing the Power of Shimcache with Chainsaw

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Unleashing the Power of Shimcache with Chainsaw
24 April 2023

Tomiris called, they want their Turla malware back

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Tomiris called, they want their Turla malware back
24 April 2023

Tomiris called, they want their Turla malware back

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tomiris called, they want their Turla malware back
20 April 2023

m_trends_2023_report.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor m_trends_2023_report.pdf
20 April 2023

Malware-Analysis/Cobalt Strike/Indirect Syscalls.md at main · dodo-sec/Malware-Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware-Analysis/Cobalt Strike/Indirect Syscalls.md at main · dodo-sec/Malware-Analysis
16 April 2023

Tracking Bumblebee's Development

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tracking Bumblebee's Development
13 April 2023

Espionage campaign linked to Russian intelligence services

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Espionage campaign linked to Russian intelligence services
13 April 2023

CERT Polska i SKW ostrzegają przed działaniami rosyjskich szpiegów

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERT Polska i SKW ostrzegają przed działaniami rosyjskich szpiegów
13 April 2023

CERT Polska and SKW warn against the activities of Russian spies

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor CERT Polska and SKW warn against the activities of Russian spies
12 April 2023

2023%20Q1%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023%20Q1%20Botnet%20Threat%20Update.pdf
3 April 2023

Malicious ISO File Leads to Domain Wide Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Malicious ISO File Leads to Domain Wide Ransomware
30 March 2023

1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf
30 March 2023

With KEYPLUG, China’s RedGolf Spies On, Steals From Wide Field of Targets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor With KEYPLUG, China’s RedGolf Spies On, Steals From Wide Field of Targets
30 March 2023

eSentire Threat Intelligence Malware Analysis: BatLoader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eSentire Threat Intelligence Malware Analysis: BatLoader
28 March 2023

Mélofée: a new alien malware in the Panda's toolset targeting Linux hosts

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mélofée: a new alien malware in the Panda's toolset targeting Linux hosts
27 March 2023

gcat_threathorizons_full_apr2023.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor gcat_threathorizons_full_apr2023.pdf
20 March 2023

PwC Cyber Threats 2022: A Year in Retrospect.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor PwC Cyber Threats 2022: A Year in Retrospect.pdf
14 March 2023

NOBELIUM Uses Poland's Ambassador’s Visit to the U.S. to Target EU Governments Assisting Ukraine

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor NOBELIUM Uses Poland's Ambassador’s Visit to the U.S. to Target EU Governments Assisting Ukraine
14 March 2023

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog
10 March 2023

Sophisticated APT29 Campaign Abuses Notion API to Target the European Commission

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Sophisticated APT29 Campaign Abuses Notion API to Target the European Commission
10 March 2023

From Royal with Love

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From Royal with Love
10 March 2023

Sophisticated APT29 Campaign Abuses Notion API to Target the European Commission

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sophisticated APT29 Campaign Abuses Notion API to Target the European Commission
1 March 2023

OneNote | ThreatLabz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OneNote | ThreatLabz
23 February 2023

Technical Advisory: Various Threat Actors Targeting ManageEngine Exploit CVE-2022-47966

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Technical Advisory: Various Threat Actors Targeting ManageEngine Exploit CVE-2022-47966
22 February 2023

Hydrochasma: Previously Unknown Group Targets Medical and Shipping Organizations in Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hydrochasma: Previously Unknown Group Targets Medical and Shipping Organizations in Asia
21 February 2023

One Year After: The Cyber Implications of the Russo-Ukrainian War

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor One Year After: The Cyber Implications of the Russo-Ukrainian War
18 February 2023

MS_Suzuka_Cybercrime Blog_v3

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor MS_Suzuka_Cybercrime Blog_v3
16 February 2023

Invitation to a Secret Event- Uncovering Earth Yako’s Campaigns

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Invitation to a Secret Event- Uncovering Earth Yako’s Campaigns
16 February 2023

Invitation to a Secret Event: Uncovering Earth Yako’s Campaigns

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Invitation to a Secret Event: Uncovering Earth Yako’s Campaigns
15 February 2023

Hunting Cyber Evil Ratels: From the targeted attacks to the widespread usage of Brute Ratel - Yoroi

Malpedia library date fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor Hunting Cyber Evil Ratels: From the targeted attacks to the widespread usage of Brute Ratel - Yoroi
13 February 2023

Royal Ransomware Deep Dive

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Royal Ransomware Deep Dive
13 February 2023

Dalbit (m00nlight): Chinese Hacker Group's APT Attack Campaign - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dalbit (m00nlight): Chinese Hacker Group's APT Attack Campaign - ASEC
8 February 2023

Earth Zhulong Familiar Patterns Target Southeast Asian Firms

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Zhulong Familiar Patterns Target Southeast Asian Firms
2 February 2023

Hive Ransomware Technical Analysis and Initial Access Discovery

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hive Ransomware Technical Analysis and Initial Access Discovery
31 January 2023

eset_apt_activity_report_t32022.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eset_apt_activity_report_t32022.pdf
30 January 2023

Following the Scent of TrickGate: 6-Year-Old Packer Used to Deploy the Most Wanted Malware - Check Point Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Following the Scent of TrickGate: 6-Year-Old Packer Used to Deploy the Most Wanted Malware - Check Point Research
26 January 2023

BlueBravo Uses Ambassador Lure to Deploy GraphicalNeutrino Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BlueBravo Uses Ambassador Lure to Deploy GraphicalNeutrino Malware
24 January 2023

The Year of the Wiper | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Year of the Wiper | FortiGuard Labs
23 January 2023

Black Basta - Technical Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Black Basta - Technical Analysis
5 January 2023

Bluebottle: Campaign Hits Banks in French-speaking Countries in Africa

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bluebottle: Campaign Hits Banks in French-speaking Countries in Africa
15 December 2022

Trojanized Windows 10 Operating System Installers Targeted Ukrainian Government | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trojanized Windows 10 Operating System Installers Targeted Ukrainian Government | Mandiant
8 December 2022

Breaking the silence - Recent Truebot activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Breaking the silence - Recent Truebot activity
6 December 2022

Eu_Repo_C_APT_profile_Conti_Wizard_Spider_dc2a733e18.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Eu_Repo_C_APT_profile_Conti_Wizard_Spider_dc2a733e18.pdf
2 December 2022

Blowing Cobalt Strike Out of the Water With Memory Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Blowing Cobalt Strike Out of the Water With Memory Analysis
30 November 2022

奇安信威胁情报中心

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 奇安信威胁情报中心
30 November 2022

Analysis of APT29's attack activities against Italy

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Analysis of APT29's attack activities against Italy
29 November 2022

Suspected Russian Activity Targeting Government and Business Entities Around the Globe

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Suspected Russian Activity Targeting Government and Business Entities Around the Globe
29 November 2022

Suspected Russian Activity Targeting Government and Business Entities Around the Globe | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Suspected Russian Activity Targeting Government and Business Entities Around the Globe | Mandiant
15 November 2022

Somnia Malware Detection: UAC-0118 aka FRwL Launches Cyber Attacks Against Organizations in Ukraine Using Enhanced Malware Strains

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Somnia Malware Detection: UAC-0118 aka FRwL Launches Cyber Attacks Against Organizations in Ukraine Using Enhanced Malware Strains
9 November 2022

Hack the Real Box: APT41’s New Subgroup Earth Longzhi

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hack the Real Box: APT41’s New Subgroup Earth Longzhi
3 November 2022

Cobalt Strike Analysis and Tutorial: Identifying Beacon Team Servers in the Wild

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Analysis and Tutorial: Identifying Beacon Team Servers in the Wild
3 November 2022

French-speaking gang OPERA1ER APT in Africa | Group-IB Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor French-speaking gang OPERA1ER APT in Africa | Group-IB Blog
31 October 2022

Orion Threat Alert: Qakbot TTPs Arsenal and the Black Basta Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Orion Threat Alert: Qakbot TTPs Arsenal and the Black Basta Ransomware
25 October 2022

Conceptualizing a Continuum of Cyber Threat Attribution

date ORKL added it fromORKL

The original link failed its last check. Original publisher Detailsfor Conceptualizing a Continuum of Cyber Threat Attribution
20 October 2022

eset_threat_report_t22021.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor eset_threat_report_t22021.pdf
13 October 2022

2022%20Q3%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2022%20Q3%20Botnet%20Threat%20Update.pdf
13 October 2022

Microsoft Security Response Center Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Security Response Center Blog
12 October 2022

Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike
3 October 2022

Bumblebee: increasing its capacity and evolving its TTPs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bumblebee: increasing its capacity and evolving its TTPs
3 October 2022

Water Labbu Abuses Malicious DApps to Steal Cryptocurrency

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Water Labbu Abuses Malicious DApps to Steal Cryptocurrency
26 September 2022

BumbleBee: Round Two

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor BumbleBee: Round Two
21 September 2022

The art and science behind Microsoft threat hunting- Part 2

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The art and science behind Microsoft threat hunting- Part 2
21 September 2022

Native function and Assembly Code Invocation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Native function and Assembly Code Invocation
19 September 2022

Russia-Nexus UAC-0113 Emulating Telecommunication Providers in Ukraine

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Russia-Nexus UAC-0113 Emulating Telecommunication Providers in Ukraine
14 September 2022

2022OverWatchThreatHuntingReport.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor 2022OverWatchThreatHuntingReport.pdf
14 September 2022

DPRK Job Opportunity Phishing via WhatsApp | PuTTY Utility

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DPRK Job Opportunity Phishing via WhatsApp | PuTTY Utility
13 September 2022

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense
12 September 2022

Dead or Alive? An Emotet Story

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Dead or Alive? An Emotet Story
10 September 2022

Malware development: persistence - part 10. Using Image File Execution Options. Simple C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development: persistence - part 10. Using Image File Execution Options. Simple C++ example.
8 September 2022

What to Expect When You’re Electing- Preparing for Cyber Threats to the 2022 U.S. Midterm Elections

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor What to Expect When You’re Electing- Preparing for Cyber Threats to the 2022 U.S. Midterm Elections
8 September 2022

Russian Cyberwarfare- Unpacking the Kremlin’s Capabilities

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Russian Cyberwarfare- Unpacking the Kremlin’s Capabilities
7 September 2022

Cyble - Bumblebee Returns With New Infection Technique

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyble - Bumblebee Returns With New Infection Technique
7 September 2022

Initial access broker repurposing techniques in targeted attacks against Ukraine

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Initial access broker repurposing techniques in targeted attacks against Ukraine
6 September 2022

Estudio del análisis de Nobelium

file creation date fromORKL

Archived copy on ORKL Detailsfor Estudio del análisis de Nobelium
6 September 2022

incibe-cert_estudio_analisis_nobelium_2022_v1.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor incibe-cert_estudio_analisis_nobelium_2022_v1.pdf
6 September 2022

Malware development tricks: parent PID spoofing. Simple C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development tricks: parent PID spoofing. Simple C++ example.
6 September 2022

#StopRansomware: Vice Society | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor #StopRansomware: Vice Society | CISA
1 September 2022

Ransomware Spotlight: Black Basta

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware Spotlight: Black Basta
30 August 2022

Hacker Infrastructure Used in Cisco Breach Discovered Attacking a Top Workforce Management Corporation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hacker Infrastructure Used in Cisco Breach Discovered Attacking a Top Workforce Management Corporation
29 August 2022

CosmicDuke Malware Analysis Report

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor CosmicDuke Malware Analysis Report
29 August 2022

CosmicDuke Malware Analysis - CYFIRMA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CosmicDuke Malware Analysis - CYFIRMA
25 August 2022

BlueSky Ransomware | AD Lateral Movement, Evasion and Fast Encryption Put Threat on the Radar

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BlueSky Ransomware | AD Lateral Movement, Evasion and Fast Encryption Put Threat on the Radar
24 August 2022

MagicWeb: NOBELIUM’s post-compromise trick to authenticate as anyone | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MagicWeb: NOBELIUM’s post-compromise trick to authenticate as anyone | Microsoft Security Blog
24 August 2022

MagicWeb- NOBELIUM’s post-compromise trick to authenticate as anyone

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor MagicWeb- NOBELIUM’s post-compromise trick to authenticate as anyone
22 August 2022

A Cyber Threat Intelligence Self-Study Plan- Part 2

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor A Cyber Threat Intelligence Self-Study Plan- Part 2
19 August 2022

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research
18 August 2022

You Can’t Audit Me- APT29 Continues Targeting Microsoft 365

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor You Can’t Audit Me- APT29 Continues Targeting Microsoft 365
18 August 2022

Overview of the Cyber Weapons Used in the Ukraine - Russia War

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Overview of the Cyber Weapons Used in the Ukraine - Russia War
18 August 2022

新APT组织穆伦鲨(MurenShark) 调查报告：袭向土耳其海军的鱼雷 – 绿盟科技技术博客

Malpedia library date NSFOCUS fromORKLCCS '25 data

Archived copy on ORKL Detailsfor 新APT组织穆伦鲨(MurenShark) 调查报告：袭向土耳其海军的鱼雷 – 绿盟科技技术博客
18 August 2022

APT41 World Tour 2021 on a tight schedule

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT41 World Tour 2021 on a tight schedule
18 August 2022

Overview of the Cyber Weapons Used in the Ukraine - Russia War | Trustwave

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Overview of the Cyber Weapons Used in the Ukraine - Russia War | Trustwave
18 August 2022

remediation-hardening-strategies-for-m365-defend-against-apt29-white-paper.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor remediation-hardening-strategies-for-m365-defend-against-apt29-white-paper.pdf
17 August 2022

THREAT ANALYSIS REPORT: Bumblebee Loader – The High Road to Enterprise Domain Control

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor THREAT ANALYSIS REPORT: Bumblebee Loader – The High Road to Enterprise Domain Control
16 August 2022

SocGholish Malware: Script Injections, Domain Shadowing, IPs & Obfuscation Techniques

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SocGholish Malware: Script Injections, Domain Shadowing, IPs & Obfuscation Techniques
15 August 2022

SUNSPOT Malware A Technical Analysis

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor SUNSPOT Malware A Technical Analysis
12 August 2022

Monster Libra (TA551/Shathak) pushes IcedID (Bokbot) with Dark VNC and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Monster Libra (TA551/Shathak) pushes IcedID (Bokbot) with Dark VNC and Cobalt Strike
11 August 2022

The Increase in Ransomware Attacks on Local Governments - SecurityScorecard

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Increase in Ransomware Attacks on Local Governments - SecurityScorecard
11 August 2022

LNK forensic and config extraction of a cobalt strike beacon

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor LNK forensic and config extraction of a cobalt strike beacon
8 August 2022

BumbleBee Roasts Its Way to Domain Admin

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor BumbleBee Roasts Its Way to Domain Admin
3 August 2022

Flight of the Bumblebee: Email Lures and File Sharing Services Lead to Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Flight of the Bumblebee: Email Lures and File Sharing Services Lead to Malware
3 August 2022

PART 3- How I Met Your Beacon – Brute Ratel

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor PART 3- How I Met Your Beacon – Brute Ratel
2 August 2022

Manjusaka: A Chinese sibling of Sliver and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Manjusaka: A Chinese sibling of Sliver and Cobalt Strike
2 August 2022

PowerPoint Presentation

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor PowerPoint Presentation
31 July 2022

Space Invaders- Cyber Threats That Are Out Of This World

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Space Invaders- Cyber Threats That Are Out Of This World
31 July 2022

Space Invaders: Cyber Threats That Are Out Of This World

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Space Invaders: Cyber Threats That Are Out Of This World
30 July 2022

Malware AV evasion - part 8. Encode payload via Z85 algorithm. C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware AV evasion - part 8. Encode payload via Z85 algorithm. C++ example.
28 July 2022

Living Off Windows Defender | LockBit Ransomware Sideloads Cobalt Strike Through Microsoft Security Tool

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Living Off Windows Defender | LockBit Ransomware Sideloads Cobalt Strike Through Microsoft Security Tool
27 July 2022

Cyble - Targeted Attacks Being Carried Out Via DLL SideLoading

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyble - Targeted Attacks Being Carried Out Via DLL SideLoading
27 July 2022

RL Blog | ReversingLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RL Blog | ReversingLabs
27 July 2022

Gootkit Loader’s Updated Tactics and Fileless Delivery of Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Gootkit Loader’s Updated Tactics and Fileless Delivery of Cobalt Strike
25 July 2022

Burned and Blinded - Escalation Risks of Intelligence Loss from Countercyber Operations in Crisis

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Burned and Blinded - Escalation Risks of Intelligence Loss from Countercyber Operations in Crisis
22 July 2022

Binary Ninja - Reverse Engineering a Cobalt Strike Dropper With Binary Ninja

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Binary Ninja - Reverse Engineering a Cobalt Strike Dropper With Binary Ninja
20 July 2022

Analysis of a trojanized jQuery script: GootLoader unleashed

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis of a trojanized jQuery script: GootLoader unleashed
20 July 2022

Evacuation and Humanitarian Documents used to Spear Phish Ukrainian Entities | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Evacuation and Humanitarian Documents used to Spear Phish Ukrainian Entities | Mandiant
20 July 2022

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense
20 July 2022

Abused Slack Service Analysis of APT29's Attack on Italy

date in the CCS '25 data Freebuf fromCCS '25 data

The original link failed its last check. Detailsfor Abused Slack Service Analysis of APT29's Attack on Italy
19 July 2022

Russian APT29 Hackers Use Online Storage Services, DropBox and Google Drive

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Russian APT29 Hackers Use Online Storage Services, DropBox and Google Drive
19 July 2022

Russian APT29 Hackers Use Online Storage Services, DropBox and Google Drive

Malpedia library date Palo Alto fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Russian APT29 Hackers Use Online Storage Services, DropBox and Google Drive
19 July 2022

A look into APT29's new early-stage Google Drive downloader

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor A look into APT29's new early-stage Google Drive downloader
18 July 2022

Russian Ransomware C2 Network Discovered in Censys Data

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Russian Ransomware C2 Network Discovered in Censys Data
13 July 2022

Cobalt Strikes again: UAC-0056 continues to target Ukraine in its latest campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strikes again: UAC-0056 continues to target Ukraine in its latest campaign
13 July 2022

Cobalt Strike Analysis and Tutorial: CS Metadata Encryption and Decryption

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Analysis and Tutorial: CS Metadata Encryption and Decryption
11 July 2022

CERT-UA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERT-UA
9 July 2022

Analyzing a Brute Ratel Badger

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Analyzing a Brute Ratel Badger
9 July 2022

Analyzing a Brute Ratel Badger

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing a Brute Ratel Badger
8 July 2022

Il malware EnvyScout (APT29) è stato veicolato anche in Italia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Il malware EnvyScout (APT29) è stato veicolato anche in Italia
8 July 2022

Il malware EnvyScout (APT29) è stato veicolato anche in Italia

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Il malware EnvyScout (APT29) è stato veicolato anche in Italia
7 July 2022

Brute Ratel Utilized By Threat Actors In New Ransomware Operations

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Brute Ratel Utilized By Threat Actors In New Ransomware Operations
7 July 2022

Emotet infection with Cobalt Strike - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet infection with Cobalt Strike - SANS ISC
7 July 2022

Brute Ratel Utilized By Threat Actors In New Ransomware Operations

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Brute Ratel Utilized By Threat Actors In New Ransomware Operations
6 July 2022

CERT-UA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERT-UA
5 July 2022

When Pentest Tools Go Brutal- Red-Teaming Tool Being Abused by Malicious Actors

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor When Pentest Tools Go Brutal- Red-Teaming Tool Being Abused by Malicious Actors
5 July 2022

When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors
30 June 2022

Black Basta Ransomware Operators Expand Their Attack Arsenal With QakBot Trojan and PrintNightmare Exploit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Black Basta Ransomware Operators Expand Their Attack Arsenal With QakBot Trojan and PrintNightmare Exploit
27 June 2022

Attacks on industrial control systems using ShadowPad | Kaspersky ICS CERT EN

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attacks on industrial control systems using ShadowPad | Kaspersky ICS CERT EN
27 June 2022

Overview of Russian GRU and SVR Cyberespionage Campaigns 1H 2022

date in the CCS '25 data Bushido Token fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Overview of Russian GRU and SVR Cyberespionage Campaigns 1H 2022
26 June 2022

Overview of Russian GRU and SVR Cyberespionage Campaigns 1H 2022

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Overview of Russian GRU and SVR Cyberespionage Campaigns 1H 2022
26 June 2022

Overview of Russian GRU and SVR Cyberespionage Campaigns 1H 2022

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Overview of Russian GRU and SVR Cyberespionage Campaigns 1H 2022
23 June 2022

Matanbuchus Loader Resurfaces - Cyble

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Matanbuchus Loader Resurfaces - Cyble
21 June 2022

Avos ransomware group expands with new attack arsenal

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Avos ransomware group expands with new attack arsenal
17 June 2022

GitHub - monoxgas/sRDI: Shellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GitHub - monoxgas/sRDI: Shellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode
17 June 2022

Malspam pushes Matanbuchus malware, leads to Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malspam pushes Matanbuchus malware, leads to Cobalt Strike
7 June 2022

Cyble - Bumblebee Loader On The Rise

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyble - Bumblebee Loader On The Rise
7 June 2022

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense
4 June 2022

[QuickNote] CobaltStrike SMB Beacon Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor [QuickNote] CobaltStrike SMB Beacon Analysis
3 June 2022

Attack Graph Response to US CERT AA22-152A: Karakurt Data Extortion Group

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attack Graph Response to US CERT AA22-152A: Karakurt Data Extortion Group
2 June 2022

To HADES and Back- UNC2165 Shifts to LOCKBIT to Evade Sanctions

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor To HADES and Back- UNC2165 Shifts to LOCKBIT to Evade Sanctions
2 June 2022

To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions | Mandiant
1 June 2022

CUBA Ransomware Campaign Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CUBA Ransomware Campaign Analysis
28 May 2022

2020-12 - Solarwinds Breach Resource Center

file creation date fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor 2020-12 - Solarwinds Breach Resource Center
25 May 2022

SocGholish Campaigns and Initial Access Kit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SocGholish Campaigns and Initial Access Kit
24 May 2022

Gamaredon Group Understanding the Russian APT

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Gamaredon Group Understanding the Russian APT
24 May 2022

Emotet Botnet Rises Again | Bitsight

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet Botnet Rises Again | Bitsight
24 May 2022

Malware Analysis: Trickbot

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Analysis: Trickbot
24 May 2022

Gamaredon Group: Understanding the Russian APT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Gamaredon Group: Understanding the Russian APT
20 May 2022

Why Remediation Alone Is Not Enough When Infected by Malware - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Why Remediation Alone Is Not Enough When Infected by Malware - ASEC
20 May 2022

Malicious 'pymafka' Package Drops Cobalt Strike | Sonatype

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malicious 'pymafka' Package Drops Cobalt Strike | Sonatype
20 May 2022

Malware Targets InfoSec: Fake PoC Delivers Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Targets InfoSec: Fake PoC Delivers Cobalt Strike
19 May 2022

Bumblebee Malware from TransferXL URLs - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bumblebee Malware from TransferXL URLs - SANS ISC
19 May 2022

Bumblebee Malware from TransferXL URLs - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bumblebee Malware from TransferXL URLs - SANS ISC
18 May 2022

WizardSpider

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor WizardSpider
17 May 2022

Ransomware Spotlight: RansomEXX

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware Spotlight: RansomEXX
16 May 2022

Malware-analysis-and-Reverse-engineering/APT29_C2-Client_Dropbox_Loader/APT29-DropboxLoader_analysis.md at main · Dump-GUY/Malware-analysis-and-Reverse-engineering

Malpedia library date Github (Dump-GUY) fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Malware-analysis-and-Reverse-engineering/APT29_C2-Client_Dropbox_Loader/APT29-DropboxLoader_analysis.md at main · Dump-GUY/Malware-analysis-and-Reverse-engineering
13 May 2022

Cozy Smuggled Into The Box- APT29 Abusing Legitimate Software For Targeted Operations In Europe

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Cozy Smuggled Into The Box- APT29 Abusing Legitimate Software For Targeted Operations In Europe
12 May 2022

What malware to look for if you want to prevent a ransomware attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What malware to look for if you want to prevent a ransomware attack
12 May 2022

AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf
12 May 2022

Gootloader.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Gootloader.pdf
12 May 2022

The Goot cause: Detecting Gootloader and its follow-on activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Goot cause: Detecting Gootloader and its follow-on activity
11 May 2022

Operation RestyLink- Targeted attack campaign targeting Japanese companies

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Operation RestyLink- Targeted attack campaign targeting Japanese companies
11 May 2022

Operation RestyLink: 日本企業を狙った標的型攻撃キャンペーン

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation RestyLink: 日本企業を狙った標的型攻撃キャンペーン
11 May 2022

TA578 using thread-hijacked emails to push ISO files for Bumblebee malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TA578 using thread-hijacked emails to push ISO files for Bumblebee malware
9 May 2022

Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself | Microsoft Security Blog
9 May 2022

Malware development: persistence - part 4. Windows services. Simple C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development: persistence - part 4. Windows services. Simple C++ example.
9 May 2022

Hiding in Plain Sight: Obscuring C2s by Abusing CDN Services

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hiding in Plain Sight: Obscuring C2s by Abusing CDN Services
9 May 2022

SEO Poisoning - A Gootloader Story

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor SEO Poisoning - A Gootloader Story
6 May 2022

Cobalt Strike Analysis and Tutorial: CS Metadata Encoding and Decoding

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Analysis and Tutorial: CS Metadata Encoding and Decoding
6 May 2022

Russian Cyber Attack campaigns and actors - NOBELIUM has struck again.pdf

file creation date fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Russian Cyber Attack campaigns and actors - NOBELIUM has struck again.pdf
6 May 2022

This New Fileless Malware Hides Shellcode in Windows Event Logs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor This New Fileless Malware Hides Shellcode in Windows Event Logs
6 May 2022

Russian cyber attack campaigns and actors.pdf

file creation date fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Russian cyber attack campaigns and actors.pdf
6 May 2022

How a secret Dutch mole aided the US-Israeli Stuxnet cyberattack on Iran.pdf

file creation date fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor How a secret Dutch mole aided the US-Israeli Stuxnet cyberattack on Iran.pdf
5 May 2022

Mustang Panda deploys a new wave of malware targeting Europe

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mustang Panda deploys a new wave of malware targeting Europe
4 May 2022

UNC3524: Eye Spy on Your Email

file creation date Mandiant fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor UNC3524: Eye Spy on Your Email
4 May 2022

A new secret stash for “fileless” malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A new secret stash for “fileless” malware
3 May 2022

SOLARDEFLECTION C2 Infrastructure Used by NOBELIUM in Company Brand Misuse

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SOLARDEFLECTION C2 Infrastructure Used by NOBELIUM in Company Brand Misuse
3 May 2022

SOLARDEFLECTION C2 Infrastructure Used by NOBELIUM in Company Brand Misuse

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor SOLARDEFLECTION C2 Infrastructure Used by NOBELIUM in Company Brand Misuse
2 May 2022

UNC3524- Eye Spy on Your Email

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor UNC3524- Eye Spy on Your Email
2 May 2022

UNC3524: Eye Spy on Your Email | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UNC3524: Eye Spy on Your Email | Mandiant
2 May 2022

UNC3524_ Eye Spy on Your Email _ Mandiant

date in the CCS '25 data Mandiant fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor UNC3524_ Eye Spy on Your Email _ Mandiant
2 May 2022

ショートカットとISOファイルを悪用する攻撃キャンペーン | セキュリティ研究センターブログ

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ショートカットとISOファイルを悪用する攻撃キャンペーン | セキュリティ研究センターブログ
29 April 2022

Tracking APT29 Phishing Campaigns | Atlassian Trello

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tracking APT29 Phishing Campaigns | Atlassian Trello
28 April 2022

Trello From the Other Side- Tracking APT29 Phishing Campaigns

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Trello From the Other Side- Tracking APT29 Phishing Campaigns
28 April 2022

yir-cyber-threats-annex-download.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor yir-cyber-threats-annex-download.pdf
28 April 2022

Tracking APT29 Phishing Campaigns | Atlassian Trello

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tracking APT29 Phishing Campaigns | Atlassian Trello
28 April 2022

yir-cyber-threats-report-download.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor yir-cyber-threats-report-download.pdf
27 April 2022

LockBit Ransomware Side-loads Cobalt Strike Beacon with Legitimate VMware Utility

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor LockBit Ransomware Side-loads Cobalt Strike Beacon with Legitimate VMware Utility
27 April 2022

20220427_NP_TLPWHITE_ANSSI_FIN7.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 20220427_NP_TLPWHITE_ANSSI_FIN7.pdf
27 April 2022

Botconf2022-40-LunghiHorejsi.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Botconf2022-40-LunghiHorejsi.pdf
27 April 2022

https://documents.trendmicro.com/assets/txt/earth-berberoka-windows-iocs-2.txt

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor https://documents.trendmicro.com/assets/txt/earth-berberoka-windows-iocs-2.txt
27 April 2022

UNC2452 Merged into APT29 | Russia-Based Espionage Group

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UNC2452 Merged into APT29 | Russia-Based Espionage Group
27 April 2022

Assembling the Russian Nesting Doll- UNC2452 Merged into APT29

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Assembling the Russian Nesting Doll- UNC2452 Merged into APT29
26 April 2022

How Cybercriminals Abuse Cloud Tunneling Services

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How Cybercriminals Abuse Cloud Tunneling Services
26 April 2022

Conti and Emotet: A constantly destructive duo

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti and Emotet: A constantly destructive duo
25 April 2022

New Core Impact Backdoor Delivered Via VMWare Vulnerability

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Core Impact Backdoor Delivered Via VMWare Vulnerability
25 April 2022

Quantum Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Quantum Ransomware
21 April 2022

Understanding Cobalt Strike Profiles - Updated for Cobalt Strike 4.6

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Understanding Cobalt Strike Profiles - Updated for Cobalt Strike 4.6
20 April 2022

Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure

file creation date CISA, NSA, FBI fromORKL

Archived copy on ORKL Detailsfor Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure
20 April 2022

Russian State-Sponsored and Criminal Cyber .pdf

file creation date fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Russian State-Sponsored and Criminal Cyber .pdf
20 April 2022

AA22-110A_Joint_CSA_Russian_State-Sponsored_and_Criminal_Cyber_Threats_to_Critical_Infrastructure_4_20_22_Final.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AA22-110A_Joint_CSA_Russian_State-Sponsored_and_Criminal_Cyber_Threats_to_Critical_Infrastructure_4_20_22_Final.pdf
20 April 2022

Alert (AA22-110A)- Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Alert (AA22-110A)- Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure
20 April 2022

Malware development: persistence - part 1. Registry run keys. C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development: persistence - part 1. Registry run keys. C++ example.
20 April 2022

Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure | CISA
19 April 2022

Hive Ransomware Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hive Ransomware Analysis
18 April 2022

Nobelium - Israeli Embassy Maldoc

date in the CCS '25 data Inquest fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Nobelium - Israeli Embassy Maldoc
18 April 2022

A blueprint for evading industry leading endpoint protection in 2022

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A blueprint for evading industry leading endpoint protection in 2022
18 April 2022

PYSA Ransomware: Technical Overview and Protection Strategies

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PYSA Ransomware: Technical Overview and Protection Strategies
18 April 2022

Nobelium - Israeli Embassy Maldoc

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Nobelium - Israeli Embassy Maldoc
18 April 2022

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense
14 April 2022

Orion Threat Alert: Flight of the BumbleBee

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Orion Threat Alert: Flight of the BumbleBee
13 April 2022

Dismantling ZLoader: How malicious ads led to disabled security tools and ransomware | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dismantling ZLoader: How malicious ads led to disabled security tools and ransomware | Microsoft Security Blog
13 April 2022

ESET takes part in global operation to disrupt Zloader botnets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET takes part in global operation to disrupt Zloader botnets
7 April 2022

You Bet Your Lsass: Hunting LSASS Access | Splunk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor You Bet Your Lsass: Hunting LSASS Access | Splunk
7 April 2022

Advanced Network Detection & Response - MetaDefender NDR - OPSWAT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Advanced Network Detection & Response - MetaDefender NDR - OPSWAT
6 April 2022

GitHub - infinitumitlabs/Karakurt-Hacking-Team-CTI: IOC Data Obtained From Karakurt Hacking Team's Internal Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GitHub - infinitumitlabs/Karakurt-Hacking-Team-CTI: IOC Data Obtained From Karakurt Hacking Team's Internal Infrastructure
5 April 2022

Russia's FSB malign activity: factsheet

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Russia's FSB malign activity: factsheet
4 April 2022

FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7 | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7 | Mandiant
31 March 2022

Conti Leaks- Examining the Panama Papers of Ransomware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Conti Leaks- Examining the Panama Papers of Ransomware
31 March 2022

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research
30 March 2022

Phishing campaign targets Russian govt dissidents with Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Phishing campaign targets Russian govt dissidents with Cobalt Strike
29 March 2022

From the Front Lines | Hive Ransomware Deploys Novel IPfuscation Technique To Avoid Detection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From the Front Lines | Hive Ransomware Deploys Novel IPfuscation Technique To Avoid Detection
29 March 2022

New spear phishing campaign targets Russian dissidents

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New spear phishing campaign targets Russian dissidents
28 March 2022

CobaltStrike UUID stager

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CobaltStrike UUID stager
25 March 2022

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research
22 March 2022

Cobalt Strike: Overview – Part 7

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike: Overview – Part 7
22 March 2022

2022_ThreatDetectionReport_RedCanary.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2022_ThreatDetectionReport_RedCanary.pdf
21 March 2022

Conti Ransomware V. 3, Including Decryptor, Leaked

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti Ransomware V. 3, Including Decryptor, Leaked
21 March 2022

Conti Affiliate Exposed: New Domain Names, IP Addresses and Email Addresses Uncovered by eSentire

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti Affiliate Exposed: New Domain Names, IP Addresses and Email Addresses Uncovered by eSentire
18 March 2022

Ghostwriter in the Shell: Expanding on Mandiant’s Attribution of UNC1151 to Belarus

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ghostwriter in the Shell: Expanding on Mandiant’s Attribution of UNC1151 to Belarus
17 March 2022

Exposing initial access broker with ties to Conti

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Exposing initial access broker with ties to Conti
16 March 2022

Cobalt Strike Analysis and Tutorial: How Malleable C2 Profiles Make Cobalt Strike Difficult to Detect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Analysis and Tutorial: How Malleable C2 Profiles Make Cobalt Strike Difficult to Detect
16 March 2022

Qakbot infection with Cobalt Strike and VNC activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Qakbot infection with Cobalt Strike and VNC activity
16 March 2022

Qakbot infection with Cobalt Strike and VNC activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Qakbot infection with Cobalt Strike and VNC activity
15 March 2022

Threat Actor UAC-0056 Targeting Ukraine with Fake Translation Software

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Actor UAC-0056 Targeting Ukraine with Fake Translation Software
14 March 2022

Fake antivirus updates used to deploy Cobalt Strike in Ukraine

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Fake antivirus updates used to deploy Cobalt Strike in Ukraine
12 March 2022

Analyzing Malware with Hooks, Stomps, and Return-addresses

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing Malware with Hooks, Stomps, and Return-addresses
11 March 2022

CERT-UA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERT-UA
9 March 2022

CISA updates Conti ransomware alert with nearly 100 domain names

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CISA updates Conti ransomware alert with nearly 100 domain names
8 March 2022

APT41 Targeting U.S. State Government Networks | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT41 Targeting U.S. State Government Networks | Mandiant
7 March 2022

2021 Year In Review

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor 2021 Year In Review
4 March 2022

Legitimate Sites used as Cobalt Strike C2s against Indian Government

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Legitimate Sites used as Cobalt Strike C2s against Indian Government
4 March 2022

Responses to Russia's Invasion of Ukraine Likely to Spur Retaliation | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Responses to Russia's Invasion of Ukraine Likely to Spur Retaliation | Mandiant
4 March 2022

Legitimate Sites Used As Cobalt Strike C2s Against Indian Government

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Legitimate Sites Used As Cobalt Strike C2s Against Indian Government
4 March 2022

Responses to Russia's Invasion of Ukraine Likely to Spur Retaliation

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Responses to Russia's Invasion of Ukraine Likely to Spur Retaliation
3 March 2022

Cyberattacks are Prominent in the Russia-Ukraine Conflict

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyberattacks are Prominent in the Russia-Ukraine Conflict
1 March 2022

2021trends.pdf

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor 2021trends.pdf
24 February 2022

Nobelium Returns to the Political World Stage | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Nobelium Returns to the Political World Stage | FortiGuard Labs
24 February 2022

Nobelium Returns to the Political World Stage

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Nobelium Returns to the Political World Stage
24 February 2022

New Wave of Emotet - When Project X Turns Into Y

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Wave of Emotet - When Project X Turns Into Y
24 February 2022

Nobelium Returns to the Political World Stage

date in the CCS '25 data Fortinet fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Nobelium Returns to the Political World Stage
23 February 2022

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense
23 February 2022

What the Pack(er)? | cyber.wtf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What the Pack(er)? | cyber.wtf
22 February 2022

Vulnerable Microsoft SQL Servers targeted with Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Vulnerable Microsoft SQL Servers targeted with Cobalt Strike
22 February 2022

IcedID to Cobalt Strike In Under 20 Minutes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor IcedID to Cobalt Strike In Under 20 Minutes
21 February 2022

Cobalt Strike Being Distributed to Unsecured MS-SQL Servers - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Being Distributed to Unsecured MS-SQL Servers - ASEC
21 February 2022

Qbot and Zerologon Lead To Full Domain Compromise

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Qbot and Zerologon Lead To Full Domain Compromise
21 February 2022

Observations from the StellarParticle Campaign

file creation date crowdstrike fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Observations from the StellarParticle Campaign
20 February 2022

Detecting Cobalt Strike Beacons

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detecting Cobalt Strike Beacons
18 February 2022

Hackers No Hashing | Huntress

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hackers No Hashing | Huntress
16 February 2022

Quick Malware Analysis: Emotet Epoch 5 and Cobalt Strike pcap from 2022-02-08

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Quick Malware Analysis: Emotet Epoch 5 and Cobalt Strike pcap from 2022-02-08
16 February 2022

Report2022GTR.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Report2022GTR.pdf
15 February 2022

Increase in Emotet Activity and Cobalt Strike Deployment

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Increase in Emotet Activity and Cobalt Strike Deployment
14 February 2022

Report2022GTR

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Report2022GTR
10 February 2022

THREAT ANALYSIS: Cobalt Strike - IcedID, Emotet and QBot

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor THREAT ANALYSIS: Cobalt Strike - IcedID, Emotet and QBot
9 February 2022

eset_threat_report_t32021.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eset_threat_report_t32021.pdf
9 February 2022

VMware Exposing Malware In Linux Based Multi Cloud Environments

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor VMware Exposing Malware In Linux Based Multi Cloud Environments
8 February 2022

eset_threat_report_t32021

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor eset_threat_report_t32021
31 January 2022

Analyzing Malware with Hooks, Stomps and Return-addresses

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing Malware with Hooks, Stomps and Return-addresses
28 January 2022

Log4j Exploit Hits Again: Vulnerable Unifi Network Application (Ubiquiti) at Risk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Log4j Exploit Hits Again: Vulnerable Unifi Network Application (Ubiquiti) at Risk
27 January 2022

StellarParticle Campaign: Novel Tactics and Techniques | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor StellarParticle Campaign: Novel Tactics and Techniques | CrowdStrike
27 January 2022

Early Bird Catches the Wormhole- Observations from the StellarParticle Campaign

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Early Bird Catches the Wormhole- Observations from the StellarParticle Campaign
27 January 2022

Point of View: Russia's Biggest Threat Is Its Instability

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Point of View: Russia's Biggest Threat Is Its Instability
27 January 2022

APT29_StellarParticle-Campaing_CrowdStrike

date in the CCS '25 data CrowdStrike fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT29_StellarParticle-Campaing_CrowdStrike
27 January 2022

What We Can Do against the Chaotic A41APT Campaign（公開版）

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What We Can Do against the Chaotic A41APT Campaign（公開版）
26 January 2022

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog
25 January 2022

Threats Looming Over the Horizon

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threats Looming Over the Horizon
24 January 2022

Cobalt Strike, a Defender’s Guide - Part 2

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Cobalt Strike, a Defender’s Guide - Part 2
20 January 2022

Log4j Exploit Hits Again: Vulnerable VMWare Horizon Servers at Risk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Log4j Exploit Hits Again: Vulnerable VMWare Horizon Servers at Risk
20 January 2022

Anticipating Cyber Threats as the Ukraine Crisis Escalates | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Anticipating Cyber Threats as the Ukraine Crisis Escalates | Mandiant
20 January 2022

Anticipating Cyber Threats as the Ukraine Crisis Escalates

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Anticipating Cyber Threats as the Ukraine Crisis Escalates
19 January 2022

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog
18 January 2022

2021 Adversary Infrastructure Report

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2021 Adversary Infrastructure Report
16 January 2022

Analyzing a CACTUSTORCH HTA Leading to Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing a CACTUSTORCH HTA Leading to Cobalt Strike
15 January 2022

VMware Horizon Servers Actively Being Hit With Cobalt Strike | Huntress

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor VMware Horizon Servers Actively Being Hit With Cobalt Strike | Huntress
11 January 2022

Threat Analysis Report: DatopLoader Exploits ProxyShell to Deliver QBOT and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Analysis Report: DatopLoader Exploits ProxyShell to Deliver QBOT and Cobalt Strike
11 January 2022

Signed DLL campaigns as a service

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Signed DLL campaigns as a service
9 January 2022

Inspecting a PowerShell Cobalt Strike Beacon

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Inspecting a PowerShell Cobalt Strike Beacon
7 January 2022

Patchwork APT caught in its own web

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Patchwork APT caught in its own web
6 January 2022

NOBELIUM’s EnvyScout infection chain goes in the registry, targeting embassies

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor NOBELIUM’s EnvyScout infection chain goes in the registry, targeting embassies
6 January 2022

NOBELIUM’s EnvyScout infection chain goes in the registry, targeting embassies

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor NOBELIUM’s EnvyScout infection chain goes in the registry, targeting embassies
29 December 2021

Strategically Aged Domain Detection: Capture APT Attacks With DNS Traffic Trends

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Strategically Aged Domain Detection: Capture APT Attacks With DNS Traffic Trends
29 December 2021

AQUATIC PANDA in Possession of Log4Shell Exploit Tools | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AQUATIC PANDA in Possession of Log4Shell Exploit Tools | CrowdStrike
16 December 2021

Winnti is Coming - Evolution after Prosecution@HITCON2021

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Winnti is Coming - Evolution after Prosecution@HITCON2021
16 December 2021

Intelligence Insights: December 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Intelligence Insights: December 2021
15 December 2021

No Unaccompanied Miners- Supply Chain Compromises Through Node.js Packages (UNC3379)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor No Unaccompanied Miners- Supply Chain Compromises Through Node.js Packages (UNC3379)
15 December 2021

No Unaccompanied Miners: Supply Chain Compromises Through Node.js Packages | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor No Unaccompanied Miners: Supply Chain Compromises Through Node.js Packages | Mandiant
10 December 2021

What We Think | Business & Technology Insights

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What We Think | Business & Technology Insights
7 December 2021

Emotet now drops Cobalt Strike, fast forwards ransomware attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet now drops Cobalt Strike, fast forwards ransomware attacks
6 December 2021

Phishing campaigns by the Nobelium intrusion set

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Phishing campaigns by the Nobelium intrusion set
6 December 2021

Suspected Russian Activity Targeting Government and Business Entities Around the Globe (UNC2452)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Suspected Russian Activity Targeting Government and Business Entities Around the Globe (UNC2452)
6 December 2021

Suspected Russian Activity Targeting Government and Business Entities Around the Globe | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Suspected Russian Activity Targeting Government and Business Entities Around the Globe | Mandiant
2 December 2021

CERTFR-2021-CTI-011.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERTFR-2021-CTI-011.pdf
30 November 2021

Yanluowang: Further Insights on New Ransomware Threat

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Yanluowang: Further Insights on New Ransomware Threat
29 November 2021

CONTInuing the Bazar Ransomware Story

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor CONTInuing the Bazar Ransomware Story
29 November 2021

Kitten.gif: Meet the Sabbath Ransomware Affiliate Program, Again

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Kitten.gif: Meet the Sabbath Ransomware Affiliate Program, Again
19 November 2021

Squirrelwaffle Exploits ProxyShell and ProxyLogon to Hijack Email Chains

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Squirrelwaffle Exploits ProxyShell and ProxyLogon to Hijack Email Chains
17 November 2021

DNS Over HTTPS for Cobalt Strike - Black Hills Information Security, Inc.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DNS Over HTTPS for Cobalt Strike - Black Hills Information Security, Inc.
17 November 2021

Cobalt Strike: Decrypting Obfuscated Traffic – Part 4

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike: Decrypting Obfuscated Traffic – Part 4
17 November 2021

Analyzing ProxyShell-related Incidents via Trend Micro Managed XDR

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing ProxyShell-related Incidents via Trend Micro Managed XDR
16 November 2021

FINDING BEACONS IN THE DARK 1650728751599

Malpedia library date BlackBerry fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor FINDING BEACONS IN THE DARK 1650728751599
16 November 2021

Attackers use domain fronting technique to target Myanmar with Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attackers use domain fronting technique to target Myanmar with Cobalt Strike
15 November 2021

ProxyShell, QBot, and Conti ransomware combined in a series of cyber attacks - Truesec

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ProxyShell, QBot, and Conti ransomware combined in a series of cyber attacks - Truesec
13 November 2021

Threat Spotlight - Domain Fronting

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Spotlight - Domain Fronting
12 November 2021

A multi-stage PowerShell based attack targets Kazakhstan

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A multi-stage PowerShell based attack targets Kazakhstan
11 November 2021

HTML smuggling surges- Highly evasive loader technique increasingly used in banking malware, targeted attacks

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor HTML smuggling surges- Highly evasive loader technique increasingly used in banking malware, targeted attacks
11 November 2021

HTML smuggling surges: Highly evasive loader technique increasingly used in banking malware, targeted attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor HTML smuggling surges: Highly evasive loader technique increasingly used in banking malware, targeted attacks
11 November 2021

Quakbot Strikes with QuakNightmare Exploitation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Quakbot Strikes with QuakNightmare Exploitation
10 November 2021

Walking on APT31 infrastructure footprints

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Walking on APT31 infrastructure footprints
10 November 2021

The hunt for NOBELIUM, the most sophisticated nation-state attack in history

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The hunt for NOBELIUM, the most sophisticated nation-state attack in history
9 November 2021

THREAT ANALYSIS REPORT: From Shathak Emails to the Conti Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor THREAT ANALYSIS REPORT: From Shathak Emails to the Conti Ransomware
5 November 2021

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog
4 November 2021

Technical report Armagedon

Malpedia library date CrowdStrike fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Technical report Armagedon
3 November 2021

Cobalt Strike: Using Process Memory To Decrypt Traffic – Part 3

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike: Using Process Memory To Decrypt Traffic – Part 3
2 November 2021

Detecting CONTI CobaltStrike Lateral Movement Techniques - Part 2 | Cyb3rSn0rlax

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Detecting CONTI CobaltStrike Lateral Movement Techniques - Part 2 | Cyb3rSn0rlax
2 November 2021

Cybercrime underground flush with shipping companies’ credentials

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cybercrime underground flush with shipping companies’ credentials
1 November 2021

Accenture | Security Solutions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Accenture | Security Solutions
1 November 2021

From Zero to Domain Admin

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor From Zero to Domain Admin
29 October 2021

12 targeted for involvement in ransomware attacks against critical infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 12 targeted for involvement in ransomware attacks against critical infrastructure
29 October 2021

Національна поліція України

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Національна поліція України
27 October 2021

Cobalt Strike: Using Known Private Keys To Decrypt Traffic – Part 2

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike: Using Known Private Keys To Decrypt Traffic – Part 2
27 October 2021

Extracting type information from Go binaries

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Extracting type information from Go binaries
26 October 2021

Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf

Malpedia library date Kaspersky fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf
26 October 2021

SQUIRRELWAFFLE Leverages malspam to deliver Qakbot, Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SQUIRRELWAFFLE Leverages malspam to deliver Qakbot, Cobalt Strike
26 October 2021

Detecting CONTI CobaltStrike Lateral Movement Techniques - Part 1 | Cyb3rSn0rlax

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Detecting CONTI CobaltStrike Lateral Movement Techniques - Part 1 | Cyb3rSn0rlax
26 October 2021

APT trends report Q3 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q3 2021
26 October 2021

APT trends report Q3 2021

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT trends report Q3 2021
25 October 2021

NOBELIUM targeting delegated administrative privileges to facilitate broader attacks | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor NOBELIUM targeting delegated administrative privileges to facilitate broader attacks | Microsoft Security Blog
25 October 2021

NOBELIUM targeting delegated administrative privileges to facilitate broader attacks

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor NOBELIUM targeting delegated administrative privileges to facilitate broader attacks
24 October 2021

New activity from Russian actor Nobelium

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New activity from Russian actor Nobelium
21 October 2021

Stopping GRACEFUL SPIDER: Falcon Complete’s Fast Response to Recent SolarWinds Serv-U Exploit Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Stopping GRACEFUL SPIDER: Falcon Complete’s Fast Response to Recent SolarWinds Serv-U Exploit Campaign
21 October 2021

Cobalt Strike: Using Known Private Keys To Decrypt Traffic – Part 1

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike: Using Known Private Keys To Decrypt Traffic – Part 1
19 October 2021

The layered infrastructure operated by APT29

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The layered infrastructure operated by APT29
19 October 2021

The layered infrastructure operated by APT29

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The layered infrastructure operated by APT29
18 October 2021

Harvester: Nation-State-Backed Group Uses New Toolset to Target Victims in South Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Harvester: Nation-State-Backed Group Uses New Toolset to Target Victims in South Asia
18 October 2021

Case Study: From BazarLoader to Network Reconnaissance

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Case Study: From BazarLoader to Network Reconnaissance
18 October 2021

IcedID to XingLocker Ransomware in 24 hours

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor IcedID to XingLocker Ransomware in 24 hours
15 October 2021

Global_APT_Research_Report_for_the_first_half_of_2021-360

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Global_APT_Research_Report_for_the_first_half_of_2021-360
14 October 2021

Investigation into the state of NIM malware Part 2

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Investigation into the state of NIM malware Part 2
13 October 2021

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog
12 October 2021

Cobalt Strike | Defining Cobalt Strike Components & BEACON

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike | Defining Cobalt Strike Components & BEACON
11 October 2021

Secure AI Build Resilience & Accelerate Value with Accenture

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure AI Build Resilience & Accelerate Value with Accenture
8 October 2021

SQUIRRELWAFFLE – Analysing The Main Loader | 0ffset

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SQUIRRELWAFFLE – Analysing The Main Loader | 0ffset
7 October 2021

SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot
6 October 2021

sneak-peek-ch1-2-finding-beacons-in-the-dark.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor sneak-peek-ch1-2-finding-beacons-in-the-dark.pdf
5 October 2021

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog
4 October 2021

BazarLoader and the Conti Leaks

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor BazarLoader and the Conti Leaks
3 October 2021

PowerPoint-Präsentation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PowerPoint-Präsentation
1 October 2021

SQUIRRELWAFFLE – Analysing the Custom Packer | 0ffset

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SQUIRRELWAFFLE – Analysing the Custom Packer | 0ffset
30 September 2021

Masters of Mimicry: new APT group ChamelGang and its arsenal

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Masters of Mimicry: new APT group ChamelGang and its arsenal
30 September 2021

How CrowdStrike Threat Hunters Identified a Confluence Exploit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How CrowdStrike Threat Hunters Identified a Confluence Exploit
30 September 2021

Masters of Mimicry: new APT group ChamelGang and its arsenal

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Masters of Mimicry: new APT group ChamelGang and its arsenal
29 September 2021

How to defeat the Russian Dukes- A step-by-step analysis of MiniDuke used by APT29-Cozy Bear

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor How to defeat the Russian Dukes- A step-by-step analysis of MiniDuke used by APT29-Cozy Bear
29 September 2021

DarkHalo after SolarWinds: the Tomiris connection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DarkHalo after SolarWinds: the Tomiris connection
29 September 2021

DarkHalo after SolarWinds- the Tomiris connection (UNC2849)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor DarkHalo after SolarWinds- the Tomiris connection (UNC2849)
29 September 2021

How to defeat the Russian Dukes: A step-by-step analysis of MiniDuke used by APT29/Cozy Bear – CYBER GEEKS

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How to defeat the Russian Dukes: A step-by-step analysis of MiniDuke used by APT29/Cozy Bear – CYBER GEEKS
29 September 2021

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense
28 September 2021

The Squirrelwaffle: New Loader Delivers Cobalt Strikes |Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Squirrelwaffle: New Loader Delivers Cobalt Strikes |Blog
28 September 2021

Zircolite vs Defense Evasion & Nobellium FoggyWeb

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Zircolite vs Defense Evasion & Nobellium FoggyWeb
27 September 2021

FoggyWeb_ Targeted NOBELIUM malware leads to persistent backdoor _ Microsoft Security Blog

date in the CCS '25 data Microsoft fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor FoggyWeb_ Targeted NOBELIUM malware leads to persistent backdoor _ Microsoft Security Blog
27 September 2021

FoggyWeb- Targeted NOBELIUM malware leads to persistent backdoor

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor FoggyWeb- Targeted NOBELIUM malware leads to persistent backdoor
27 September 2021

A Virtual Baffle to Battle SquirrelWaffle

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Virtual Baffle to Battle SquirrelWaffle
27 September 2021

FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor | Microsoft Security Blog
26 September 2021

Insights into Ransomware Spread Using Exchange 1-Day Vulnerabilities 1-2 - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Insights into Ransomware Spread Using Exchange 1-Day Vulnerabilities 1-2 - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.
24 September 2021

Examining the Cring Ransomware Techniques

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Examining the Cring Ransomware Techniques
23 September 2021

eset_threat_report_t22021

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor eset_threat_report_t22021
21 September 2021

Ransomware Hackers Attack a Top Safety Testing Org. Using Tactics and Techniques Borrowed from Chinese Espionage Groups

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware Hackers Attack a Top Safety Testing Org. Using Tactics and Techniques Borrowed from Chinese Espionage Groups
21 September 2021

The Squirrel Strikes Back: Analysis of the newly emerged cobalt-strike loader “SquirrelWaffle”

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Squirrel Strikes Back: Analysis of the newly emerged cobalt-strike loader “SquirrelWaffle”
21 September 2021

A Ransomware Near Miss: ProxyShell, a RAT, and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Ransomware Near Miss: ProxyShell, a RAT, and Cobalt Strike
21 September 2021

Scanning VirusTotal's firehose | Sky Blueteam

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Scanning VirusTotal's firehose | Sky Blueteam
20 September 2021

Microsoft Digital Defense Report OCTOBER 2021

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Microsoft Digital Defense Report OCTOBER 2021
17 September 2021

4 Popular Defensive Evasion Techniques in 2021 | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 4 Popular Defensive Evasion Techniques in 2021 | CrowdStrike
17 September 2021

The default: 63 6f 62 61 6c 74 strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The default: 63 6f 62 61 6c 74 strike
16 September 2021

Pointer: Hunting Cobalt Strike globally

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Pointer: Hunting Cobalt Strike globally
15 September 2021

Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability | Microsoft Security Blog
14 September 2021

Full-Spectrum Cobalt Strike Detection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Full-Spectrum Cobalt Strike Detection
13 September 2021

BazarLoader to Conti Ransomware in 32 Hours

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor BazarLoader to Conti Ransomware in 32 Hours
11 September 2021

APT_trends_report_Q2_2021_Securelist

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT_trends_report_Q2_2021_Securelist
10 September 2021

Rendering Threats: A Network Perspective

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rendering Threats: A Network Perspective
9 September 2021

Remote Code Execution Zero-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Remote Code Execution Zero-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs
8 September 2021

Hook Heaps and Live Free

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hook Heaps and Live Free
6 September 2021

Quick analysis CobaltStrike loader and shellcode

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Quick analysis CobaltStrike loader and shellcode
3 September 2021

The State of SSL/TLS Certificate Usage in Malware C&C Communications

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The State of SSL/TLS Certificate Usage in Malware C&C Communications
2 September 2021

Autodesk reveals it was targeted by Russian SolarWinds hackers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Autodesk reveals it was targeted by Russian SolarWinds hackers
2 September 2021

Autodesk reveals it was targeted by Russian SolarWinds hackers

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Autodesk reveals it was targeted by Russian SolarWinds hackers
1 September 2021

Diving Deep into UNC1151’s Infrastructure- Ghostwriter and beyond

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Diving Deep into UNC1151’s Infrastructure- Ghostwriter and beyond
31 August 2021

Cobalt Strike and Ransomware – Tracking An Effective Ransomware Campaign - BreakPoint Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike and Ransomware – Tracking An Effective Ransomware Campaign - BreakPoint Labs
30 August 2021

奇安信威胁情报中心

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 奇安信威胁情报中心
29 August 2021

Cobalt Strike, a Defender's Guide

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Cobalt Strike, a Defender's Guide
29 August 2021

Cobalt Strike, a Defender’s Guide

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Cobalt Strike, a Defender’s Guide
27 August 2021

Blog Archive

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Blog Archive
27 August 2021

https://www.aon.com/cyber-solutions/aon_cyber_labs/cobalt-strike-configuration-extractor-and-parser/

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor https://www.aon.com/cyber-solutions/aon_cyber_labs/cobalt-strike-configuration-extractor-and-parser/
24 August 2021

The SideWalk may be as dangerous as the CROSSWALK

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The SideWalk may be as dangerous as the CROSSWALK
24 August 2021

Earth Baku Returns: Uncovering the Upgraded Toolset Behind the APT Group’s New Cyberespionage Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Baku Returns: Uncovering the Upgraded Toolset Behind the APT Group’s New Cyberespionage Campaign
23 August 2021

210823.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 210823.pdf
19 August 2021

An insider insights into Conti operations – Part Two

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor An insider insights into Conti operations – Part Two
19 August 2021

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog
18 August 2021

Cobalt Strike- Detect this Persistent Threat

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Cobalt Strike- Detect this Persistent Threat
18 August 2021

How to Detect Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How to Detect Cobalt Strike
17 August 2021

An insider insights into Conti operations – Part One

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor An insider insights into Conti operations – Part One
15 August 2021

The Ransomware Threat (White Paper)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Ransomware Threat (White Paper)
11 August 2021

Nationstate_ransomware_with_consecutive_endnotes.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Nationstate_ransomware_with_consecutive_endnotes.pdf
9 August 2021

APT Cobalt Strike Campaign targeting Slovakia (DEF CON talk)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT Cobalt Strike Campaign targeting Slovakia (DEF CON talk)
9 August 2021

APT Cobalt Strike Campaign targeting Slovakia (DEF CON talk)

Malpedia library date IstroSec fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT Cobalt Strike Campaign targeting Slovakia (DEF CON talk)
5 August 2021

Red Canary Intel: When Dridex and Cobalt Strike give you Grief

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Red Canary Intel: When Dridex and Cobalt Strike give you Grief
5 August 2021

Detecting Cobalt Strike Government-Sponsored Threat Groups (APT32)

date in the CCS '25 data SecureWorks fromCCS '25 data

Detailsfor Detecting Cobalt Strike Government-Sponsored Threat Groups (APT32)
4 August 2021

How PROPHET SPIDER Exploits Oracle WebLogic | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How PROPHET SPIDER Exploits Oracle WebLogic | CrowdStrike
4 August 2021

Hotcobalt - New Cobalt Strike DoS Vulnerability That Lets You Halt Operations - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hotcobalt - New Cobalt Strike DoS Vulnerability That Lets You Halt Operations - SentinelLabs
3 August 2021

DeadRinger: Exposing Chinese Threat Actors Targeting Major Telcos

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DeadRinger: Exposing Chinese Threat Actors Targeting Major Telcos
1 August 2021

BazarCall to Conti Ransomware via Trickbot and Cobalt Strike

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor BazarCall to Conti Ransomware via Trickbot and Cobalt Strike
30 July 2021

DOJ- SolarWinds hackers breached emails from 27 US Attorneys’ offices

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor DOJ- SolarWinds hackers breached emails from 27 US Attorneys’ offices
30 July 2021

ISOMorph Infection- In-Depth Analysis of a New HTML Smuggling Campaign

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor ISOMorph Infection- In-Depth Analysis of a New HTML Smuggling Campaign
30 July 2021

ISOMorph Infection: In-Depth Analysis of a New HTML Smuggling Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ISOMorph Infection: In-Depth Analysis of a New HTML Smuggling Campaign
29 July 2021

BazaCall: Phony call centers lead to exfiltration and ransomware | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BazaCall: Phony call centers lead to exfiltration and ransomware | Microsoft Security Blog
27 July 2021

Ghosts on the Wire: Expanding Conceptions of Network Anomalies

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ghosts on the Wire: Expanding Conceptions of Network Anomalies
27 July 2021

Ghosts on the Wire- Expanding Conceptions of Network Anomalies

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Ghosts on the Wire- Expanding Conceptions of Network Anomalies
27 July 2021

report-old-dogs-new-tricks.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor report-old-dogs-new-tricks.pdf
25 July 2021

Guide to Named Pipes and Hunting for Cobalt Strike Pipes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Guide to Named Pipes and Hunting for Cobalt Strike Pipes
22 July 2021

Cobalt Strike Hunting — simple PCAP and Beacon Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Hunting — simple PCAP and Beacon Analysis
19 July 2021

IcedID and Cobalt Strike vs Antivirus

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor IcedID and Cobalt Strike vs Antivirus
14 July 2021

LuminousMoth APT: Sweeping attacks for the chosen few

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor LuminousMoth APT: Sweeping attacks for the chosen few
14 July 2021

Investigating a Suspicious Service - MDSec

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Investigating a Suspicious Service - MDSec
14 July 2021

How we protect users from 0-day attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How we protect users from 0-day attacks
13 July 2021

Attacks Against the Government Sector (White Paper)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attacks Against the Government Sector (White Paper)
9 July 2021

Hancitor tries XLL as initial malware file - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hancitor tries XLL as initial malware file - SANS ISC
8 July 2021

Decoding Cobalt Strike: Understanding payloads

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Decoding Cobalt Strike: Understanding payloads
7 July 2021

https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/diving-deeper-into-the-kaseya-vsa-attack-revil-returns-and-other-hackers-are-riding-their-coattails/

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/diving-deeper-into-the-kaseya-vsa-attack-revil-returns-and-other-hackers-are-riding-their-coattails/
7 July 2021

BIOPASS RAT New Malware Sniffs Victims via Live Streaming

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BIOPASS RAT New Malware Sniffs Victims via Live Streaming
7 July 2021

Ryuk Ransomware Now Targeting Webservers

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Ryuk Ransomware Now Targeting Webservers
5 July 2021

Tracking Cobalt Strike: A Trend Micro Vision One Investigation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tracking Cobalt Strike: A Trend Micro Vision One Investigation
2 July 2021

Dridex Document to Cobalt Strike – Malware Book Reports

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dridex Document to Cobalt Strike – Malware Book Reports
1 July 2021

Backdoored client from Mongolian CA MonPass

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Backdoored client from Mongolian CA MonPass
1 July 2021

Mongolian certificate authority hacked eight times, compromised with malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mongolian certificate authority hacked eight times, compromised with malware
29 June 2021

Cobalt Strike: Favorite APT Tool to Crimeware | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike: Favorite APT Tool to Crimeware | Proofpoint US
29 June 2021

What We Think | Business & Technology Insights

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What We Think | Business & Technology Insights
29 June 2021

Cobalt Strike- Favorite Tool from APT to Crimeware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Cobalt Strike- Favorite Tool from APT to Crimeware
29 June 2021

Danmarks National Bank hacked as part of 'the world's most sophisticated hacker attack' (NOBELIUM)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Danmarks National Bank hacked as part of 'the world's most sophisticated hacker attack' (NOBELIUM)
28 June 2021

Hancitor Continues to Push Cobalt Strike

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Hancitor Continues to Push Cobalt Strike
25 June 2021

New Nobelium activity

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New Nobelium activity
24 June 2021

VB2021 paper: The Baffling Berserk Bear: A Decade’s Activity Targeting Critical Infrastructur

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor VB2021 paper: The Baffling Berserk Bear: A Decade’s Activity Targeting Critical Infrastructur
22 June 2021

Response When Minutes Matter: Falcon Complete Disrupts WIZARD SPIDER eCrime Operators

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Response When Minutes Matter: Falcon Complete Disrupts WIZARD SPIDER eCrime Operators
20 June 2021

From Word to Lateral Movement in 1 Hour

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor From Word to Lateral Movement in 1 Hour
18 June 2021

SecurityScorecard Finds USAID Hack Much Larger Than Initially Thought

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor SecurityScorecard Finds USAID Hack Much Larger Than Initially Thought
17 June 2021

Analysis of Hancitor – When Boring Begets Beacon

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis of Hancitor – When Boring Begets Beacon
16 June 2021

Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise
16 June 2021

Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise
16 June 2021

Національна поліція України

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Національна поліція України
16 June 2021

Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise
10 June 2021

CrowdStrike Falcon Protects Customers from Recent COZY BEAR Sophisticated Phishing Campaign

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor CrowdStrike Falcon Protects Customers from Recent COZY BEAR Sophisticated Phishing Campaign
9 June 2021

Russian hackers breached Dutch police systems in 2017

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Russian hackers breached Dutch police systems in 2017
9 June 2021

Russian hackers breached Dutch police systems in 2017

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Russian hackers breached Dutch police systems in 2017
4 June 2021

Fresh Phish: Colonial Pipeline Ransomware Hack Unleashes Flood of Related Phishing Attempts

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Fresh Phish: Colonial Pipeline Ransomware Hack Unleashes Flood of Related Phishing Attempts
2 June 2021

China-Linked Threat Group Targets Taiwan Critical Infrastructure, Smokescreen Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-Linked Threat Group Targets Taiwan Critical Infrastructure, Smokescreen Ransomware
1 June 2021

Backdoors, RATs, Loaders evasion techniques

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Backdoors, RATs, Loaders evasion techniques
1 June 2021

New sophisticated email-based attack from NOBELIUM | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New sophisticated email-based attack from NOBELIUM | Microsoft Security Blog
1 June 2021

New sophisticated email-based attack from NOBELIUM

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New sophisticated email-based attack from NOBELIUM
1 June 2021

Breaking down NOBELIUM’s latest early-stage toolset - Microsoft Security

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Breaking down NOBELIUM’s latest early-stage toolset - Microsoft Security
1 June 2021

Looks like the page you're looking for doesn't exist or has moved.

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Looks like the page you're looking for doesn't exist or has moved.
1 June 2021

NobleBaron - New Poisoned Installers Could Be Used In Supply Chain Attacks

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor NobleBaron - New Poisoned Installers Could Be Used In Supply Chain Attacks
1 June 2021

NobleBaron | New Poisoned Installers Could Be Used In Supply Chain Attacks - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor NobleBaron | New Poisoned Installers Could Be Used In Supply Chain Attacks - SentinelLabs
1 June 2021

Detecting Initial Access- HTML Smuggling and ISO Images — Part 1

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Detecting Initial Access- HTML Smuggling and ISO Images — Part 1
1 June 2021

Justice Department Announces Court-Authorized Seizure of Domain Names Used in Furtherance of Spear-Phishing Campaign Posing as U.S. Agency for International Development

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Justice Department Announces Court-Authorized Seizure of Domain Names Used in Furtherance of Spear-Phishing Campaign Posing as U.S. Agency for International Development
30 May 2021

Defend and deter

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Defend and deter
28 May 2021

Breaking down NOBELIUM’s latest early-stage toolset

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Breaking down NOBELIUM’s latest early-stage toolset
28 May 2021

Sophisticated Spearphishing Campaign Targets Government Organizations, IGOs, and NGOs | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sophisticated Spearphishing Campaign Targets Government Organizations, IGOs, and NGOs | CISA
28 May 2021

MAR 10339794-1.v1 – Cobalt Strike Beacon | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MAR 10339794-1.v1 – Cobalt Strike Beacon | CISA
28 May 2021

Alert (AA21-148A)- Sophisticated Spearphishing Campaign Targets Government Organizations, IGOs, and NGOs

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Alert (AA21-148A)- Sophisticated Spearphishing Campaign Targets Government Organizations, IGOs, and NGOs
28 May 2021

Breaking down NOBELIUM’s latest early-stage toolset | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Breaking down NOBELIUM’s latest early-stage toolset | Microsoft Security Blog
27 May 2021

Another Nobelium Cyberattack

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Another Nobelium Cyberattack
27 May 2021

Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns
27 May 2021

New sophisticated email-based attack from NOBELIUM - Microsoft Security

date in the CCS '25 data Microsoft fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor New sophisticated email-based attack from NOBELIUM - Microsoft Security
27 May 2021

Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns

Malpedia library date Volexity fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns
26 May 2021

A Deep Dive into Packing Software CryptOne

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Deep Dive into Packing Software CryptOne
26 May 2021

Elizabethan England has nothing on modern-day Russia

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Elizabethan England has nothing on modern-day Russia
25 May 2021

Cobalt Strikes Again: An Analysis of Obfuscated Malware | Huntress

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strikes Again: An Analysis of Obfuscated Malware | Huntress
21 May 2021

Microsoft社のデジタル署名を悪用した「Cobalt Strike loader」による標的型攻撃〜攻撃者グループAPT41 | LAC WATCH

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft社のデジタル署名を悪用した「Cobalt Strike loader」による標的型攻撃〜攻撃者グループAPT41 | LAC WATCH
21 May 2021

Leveraging Microsoft Teams to cover up Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Leveraging Microsoft Teams to cover up Cobalt Strike
19 May 2021

Enterprise Scale Threat Hunting: C2 Beacon Detection with Unsupervised ML and KQL — Part 2

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Enterprise Scale Threat Hunting: C2 Beacon Detection with Unsupervised ML and KQL — Part 2
19 May 2021

Look how many cybercriminals love Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Look how many cybercriminals love Cobalt Strike
17 May 2021

Case Study: Incident Response is a relationship-driven business

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Case Study: Incident Response is a relationship-driven business
16 May 2021

HSE Conti 40521 UPDATE

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor HSE Conti 40521 UPDATE
14 May 2021

Analysis Report (AR21-134A)- Eviction Guidance for Networks Affected by the SolarWinds and Active Directory-M365 Compromise

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Analysis Report (AR21-134A)- Eviction Guidance for Networks Affected by the SolarWinds and Active Directory-M365 Compromise
14 May 2021

From ZLoader to DarkSide: A Ransomware Story

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From ZLoader to DarkSide: A Ransomware Story
14 May 2021

Eviction Guidance for Networks Affected by the SolarWinds and Active Directory/M365 Compromise | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Eviction Guidance for Networks Affected by the SolarWinds and Active Directory/M365 Compromise | CISA
12 May 2021

Enterprise Scale Threat Hunting: C2 Beacon Detection with Unsupervised ML and KQL — Part 1

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Enterprise Scale Threat Hunting: C2 Beacon Detection with Unsupervised ML and KQL — Part 1
12 May 2021

Conti Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Conti Ransomware
11 May 2021

Campo, a New Attack Campaign Targeting Japan - Mal-Eats

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Campo, a New Attack Campaign Targeting Japan - Mal-Eats
11 May 2021

Shining a Light on DARKSIDE Ransomware Operations

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Shining a Light on DARKSIDE Ransomware Operations
10 May 2021

日本を狙う新たな攻撃キャンペーン Campo の全体像 - Mal-Eats

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 日本を狙う新たな攻撃キャンペーン Campo の全体像 - Mal-Eats
8 May 2021

SolarWinds says fewer than 100 customers were impacted by supply chain attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SolarWinds says fewer than 100 customers were impacted by supply chain attack
7 May 2021

Advisory Further TTPs associated with SVR cyber actors

Malpedia library date NCSC fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Advisory Further TTPs associated with SVR cyber actors
7 May 2021

Stats from Hunting Cobalt Strike Beacons

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Stats from Hunting Cobalt Strike Beacons
7 May 2021

PowerPoint 簡報

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PowerPoint 簡報
7 May 2021

Lemon Duck spreads its wings: Actors target Microsoft Exchange servers, incorporate new TTPs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lemon Duck spreads its wings: Actors target Microsoft Exchange servers, incorporate new TTPs
7 May 2021

Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf
6 May 2021

CTIR_casestudy_2.pdf

file creation date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor CTIR_casestudy_2.pdf
6 May 2021

Proxylogon: A Coinminer, a Ransomware, and a Botnet Join the Party

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Proxylogon: A Coinminer, a Ransomware, and a Botnet Join the Party
6 May 2021

CTIR_casestudy_1.pdf

file creation date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor CTIR_casestudy_1.pdf
5 May 2021

Are The Notorious Cyber Criminals Evil Corp actually Russian Spies-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Are The Notorious Cyber Criminals Evil Corp actually Russian Spies-
5 May 2021

Multi-Factor Authentication: Headache for Cyber Actors Inspires New Attack Techniques

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Multi-Factor Authentication: Headache for Cyber Actors Inspires New Attack Techniques
5 May 2021

Multi-Factor Authentication- Headache for Cyber Actors Inspires New Attack Techniques

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Multi-Factor Authentication- Headache for Cyber Actors Inspires New Attack Techniques
5 May 2021

Notorious Cybercriminals Evil Corp Actually Russian Spies? - Trulysuper

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Notorious Cybercriminals Evil Corp Actually Russian Spies? - Trulysuper
4 May 2021

Improving network-based detection of in-the-wild Cobalt Strike C2 servers while reducing the risk…

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Improving network-based detection of in-the-wild Cobalt Strike C2 servers while reducing the risk…
2 May 2021

Trickbot Brief: Creds and Beacons

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Trickbot Brief: Creds and Beacons
29 April 2021

the-operations-of-winnti-group.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor the-operations-of-winnti-group.pdf
29 April 2021

UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat | Mandiant
27 April 2021

Locked, Loaded, and in the Wrong Hands: Legitimate Tools Weaponized for Ransomware in 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Locked, Loaded, and in the Wrong Hands: Legitimate Tools Weaponized for Ransomware in 2021
27 April 2021

Hello Ransomware Uses Updated China Chopper Web Shell, SharePoint Vulnerability

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hello Ransomware Uses Updated China Chopper Web Shell, SharePoint Vulnerability
27 April 2021

Abusing Replication- Stealing AD FS Secrets Over the Network

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Abusing Replication- Stealing AD FS Secrets Over the Network
26 April 2021

Joint Cybersecurity Advisory - AA21-116A - Russian Foreign Intelligence Service (SVR) Cyber Operations

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Joint Cybersecurity Advisory - AA21-116A - Russian Foreign Intelligence Service (SVR) Cyber Operations
26 April 2021

Anatomy of Cobalt Strike’s DLL Stager

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Anatomy of Cobalt Strike’s DLL Stager
20 April 2021

CobaltStrike Stager Utilizing Floating Point Math

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CobaltStrike Stager Utilizing Floating Point Math
19 April 2021

Analysing a malware PCAP with IcedID and Cobalt Strike traffic

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysing a malware PCAP with IcedID and Cobalt Strike traffic
17 April 2021

SVR snaps back at Biden

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor SVR snaps back at Biden
15 April 2021

CSA_SVR_TARGETS_US_ALLIES_UOO13234021.PDF

file creation date fromORKL

Archived copy on ORKL Detailsfor CSA_SVR_TARGETS_US_ALLIES_UOO13234021.PDF
15 April 2021

Declaration by the High Representative on behalf of the European Union expressing solidarity with the United States on the impact of the SolarWinds cyber operation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Declaration by the High Representative on behalf of the European Union expressing solidarity with the United States on the impact of the SolarWinds cyber operation
15 April 2021

Malware Analysis Report (AR21-105A)- SUNSHUTTLE

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Malware Analysis Report (AR21-105A)- SUNSHUTTLE
15 April 2021

North Atlantic Council Statement following the announcement by the United States of actions with regard to Russia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor North Atlantic Council Statement following the announcement by the United States of actions with regard to Russia
15 April 2021

Statement on SolarWinds Cyber Compromise

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Statement on SolarWinds Cyber Compromise
15 April 2021

MAR-10327841-1.v1 – SUNSHUTTLE | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MAR-10327841-1.v1 – SUNSHUTTLE | CISA
15 April 2021

Russia: UK exposes Russian involvement in SolarWinds cyber compromise

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Russia: UK exposes Russian involvement in SolarWinds cyber compromise
15 April 2021

Russia: UK and US expose global campaign of malign activity by Russian intelligence services

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Russia: UK and US expose global campaign of malign activity by Russian intelligence services
15 April 2021

FACT SHEET- Imposing Costs for Harmful Foreign Activities by the Russian Government

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor FACT SHEET- Imposing Costs for Harmful Foreign Activities by the Russian Government
15 April 2021

Russia- UK exposes Russian involvement in SolarWinds cyber compromise

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Russia- UK exposes Russian involvement in SolarWinds cyber compromise
14 April 2021

April 2021 Forensic Quiz: Answers and Analysis - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor April 2021 Forensic Quiz: Answers and Analysis - SANS ISC
12 April 2021

A Different Kind of Zoombomb

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Different Kind of Zoombomb
12 April 2021

mtrends-2021

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor mtrends-2021
7 April 2021

Using Kaitai Struct to Parse Cobalt Strike Beacon Configs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Using Kaitai Struct to Parse Cobalt Strike Beacon Configs
5 April 2021

TrickBot Crews New CobaltStrike Loader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot Crews New CobaltStrike Loader
1 April 2021

Hancitor’s Use of Cobalt Strike and a Noisy Network Ping Tool

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hancitor’s Use of Cobalt Strike and a Noisy Network Ping Tool
1 April 2021

COVID-19 Phishing With a Side of Cobalt Strike - DomainTools | Start Here. Know Now.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor COVID-19 Phishing With a Side of Cobalt Strike - DomainTools | Start Here. Know Now.
31 March 2021

2021-Threat-Detection-Report.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2021-Threat-Detection-Report.pdf
30 March 2021

Yet Another Cobalt Strike Stager: GUID Edition

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Yet Another Cobalt Strike Stager: GUID Edition
30 March 2021

2021-Threat-Detection-Report

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 2021-Threat-Detection-Report
29 March 2021

Sodinokibi (aka REvil) Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Sodinokibi (aka REvil) Ransomware
21 March 2021

report-bb-2021-threat-report.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor report-bb-2021-threat-report.pdf
18 March 2021

GitHub - cisagov/CHIRP: A DFIR tool written in Python.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GitHub - cisagov/CHIRP: A DFIR tool written in Python.
18 March 2021

Cobalt Strike – Post-Exploitation Attackers Toolkit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike – Post-Exploitation Attackers Toolkit
18 March 2021

SilverFish_TLPWHITE

date in the CCS '25 data FireEye fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor SilverFish_TLPWHITE
18 March 2021

Detecting Post-Compromise Threat Activity Using the CHIRP IOC Detection Tool | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detecting Post-Compromise Threat Activity Using the CHIRP IOC Detection Tool | CISA
18 March 2021

SilverFish_TLPWHITE.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SilverFish_TLPWHITE.pdf
17 March 2021

wp-m-unc2452.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor wp-m-unc2452.pdf
16 March 2021

Detecting Cobalt Strike with memory signatures

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detecting Cobalt Strike with memory signatures
16 March 2021

Technical Analysis of Operation Diànxùn

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Technical Analysis of Operation Diànxùn
11 March 2021

Myanmar – Multi-stage malware attack targets elected lawmakers – Qurium Media Foundation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Myanmar – Multi-stage malware attack targets elected lawmakers – Qurium Media Foundation
11 March 2021

You Don't Know the HAFNIUM of it...

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor You Don't Know the HAFNIUM of it...
10 March 2021

Remediating Networks Affected by the SolarWinds and Active Directory-M365 Compromise

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Remediating Networks Affected by the SolarWinds and Active Directory-M365 Compromise
10 March 2021

Remediating Networks Affected by the SolarWinds and Active Directory/M365 Compromise | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Remediating Networks Affected by the SolarWinds and Active Directory/M365 Compromise | CISA
10 March 2021

NimzaLoader: TA800’s New Initial Access Malware | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor NimzaLoader: TA800’s New Initial Access Malware | Proofpoint US
10 March 2021

Monitoring the Software Supply Chain with Azure Sentinel

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Monitoring the Software Supply Chain with Azure Sentinel
9 March 2021

Cloud Federated Credential Abuse & Cobalt Strike: Threat Research February 2021 | Splunk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cloud Federated Credential Abuse & Cobalt Strike: Threat Research February 2021 | Splunk
8 March 2021

Bazar Drops the Anchor

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Bazar Drops the Anchor
4 March 2021

GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence | Microsoft Security Blog
4 March 2021

New SUNSHUTTLE Second-Stage Backdoor Uncovered Targeting U.S.-Based Entity; Possible Connection to UNC2452 | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New SUNSHUTTLE Second-Stage Backdoor Uncovered Targeting U.S.-Based Entity; Possible Connection to UNC2452 | Mandiant
4 March 2021

GoldMax, GoldFinder, and Sibot- Analyzing NOBELIUM’s layered persistence

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor GoldMax, GoldFinder, and Sibot- Analyzing NOBELIUM’s layered persistence
4 March 2021

New SUNSHUTTLE Second-Stage Backdoor Uncovered Targeting U.S.-Based Entity; Possible Connection to UNC2452

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New SUNSHUTTLE Second-Stage Backdoor Uncovered Targeting U.S.-Based Entity; Possible Connection to UNC2452
1 March 2021

Nimar Loader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Nimar Loader
1 March 2021

Investigation into the state of Nim malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Investigation into the state of Nim malware
28 February 2021

Cyber Threats 2020: A Year in Retrospect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Threats 2020: A Year in Retrospect
26 February 2021

New Ransomware Tactic: Adversaries Target ESXi Servers | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Ransomware Tactic: Adversaries Target ESXi Servers | CrowdStrike
25 February 2021

So Unchill: Melting UNC2198 ICEDID to Ransomware Operations | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor So Unchill: Melting UNC2198 ICEDID to Ransomware Operations | Mandiant
25 February 2021

Intezer-2020-Go-Malware-Round-Up.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Intezer-2020-Go-Malware-Round-Up.pdf
25 February 2021

File not found · github/codeql

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor File not found · github/codeql
25 February 2021

Microsoft open sources CodeQL queries used to hunt for Solorigate activity

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Microsoft open sources CodeQL queries used to hunt for Solorigate activity
25 February 2021

Microsoft open sources CodeQL queries used to hunt for Solorigate activity | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft open sources CodeQL queries used to hunt for Solorigate activity | Microsoft Security Blog
24 February 2021

investigations/2021-02-24_vietnam at master · AmnestyTech/investigations

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor investigations/2021-02-24_vietnam at master · AmnestyTech/investigations
24 February 2021

c2fs_jsac2021_submit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor c2fs_jsac2021_submit
24 February 2021

NASA and the FAA were also breached by the SolarWinds hackers

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor NASA and the FAA were also breached by the SolarWinds hackers
24 February 2021

NASA and the FAA were also breached by the SolarWinds hackers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor NASA and the FAA were also breached by the SolarWinds hackers
23 February 2021

Report2021GTR.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Report2021GTR.pdf
23 February 2021

The_CrowdStrike_2021_Global_Threat_Report

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The_CrowdStrike_2021_Global_Threat_Report
19 February 2021

Cyber Attribution Is More Art Than Science. This Researcher Has a Plan to Change That

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Cyber Attribution Is More Art Than Science. This Researcher Has a Plan to Change That
19 February 2021

Behind the Scenes of the SUNBURST Attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Behind the Scenes of the SUNBURST Attack
17 February 2021

Detect and prevent the SolarWinds build-time code injection attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detect and prevent the SolarWinds build-time code injection attack
17 February 2021

Supply Chain Attacks: Cyber Criminals Target the Weakest Link (White Paper)

file creation date fromORKL

Archived copy on ORKL Detailsfor Supply Chain Attacks: Cyber Criminals Target the Weakest Link (White Paper)
17 February 2021

Targeting Process for the SolarWinds Backdoor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Targeting Process for the SolarWinds Backdoor
9 February 2021

Extracting the Cobalt Strike Config from a TEARDROP Loader | Securehat

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Extracting the Cobalt Strike Config from a TEARDROP Loader | Securehat
8 February 2021

MAR-10318845-1.v1 - SUNBURST | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MAR-10318845-1.v1 - SUNBURST | CISA
8 February 2021

MAR-10320115-1.v1 - TEARDROP | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MAR-10320115-1.v1 - TEARDROP | CISA
3 February 2021

Excel spreadsheets push SystemBC malware - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Excel spreadsheets push SystemBC malware - SANS ISC
2 February 2021

How Vietnam-based hacking operation OceanLotus targets journalists - Committee to Protect Journalists

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How Vietnam-based hacking operation OceanLotus targets journalists - Committee to Protect Journalists
1 February 2021

Relay Attacks via Cobalt Strike Beacons

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Relay Attacks via Cobalt Strike Beacons
1 February 2021

BlueCrab 랜섬웨어, 기업 환경에서는 CobaltStrike 해킹툴 설치 - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BlueCrab 랜섬웨어, 기업 환경에서는 CobaltStrike 해킹툴 설치 - ASEC
31 January 2021

Bazar, No Ryuk?

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Bazar, No Ryuk?
29 January 2021

https://www.aon.com/cyber-solutions/aon_cyber_labs/cloudy-with-a-chance-of-persistent-email-access/

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor https://www.aon.com/cyber-solutions/aon_cyber_labs/cloudy-with-a-chance-of-persistent-email-access/
29 January 2021

Cloudy with a Chance of Persistent Email Access

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Cloudy with a Chance of Persistent Email Access
28 January 2021

Deep into the SunBurst Attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Deep into the SunBurst Attack
28 January 2021

지속적으로 탐지 우회를 시도 중인 BlueCrab 랜섬웨어 - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 지속적으로 탐지 우회를 시도 중인 BlueCrab 랜섬웨어 - ASEC
28 January 2021

Tailoring Cobalt Strike on Target

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tailoring Cobalt Strike on Target
26 January 2021

Mimecast links security breach to SolarWinds hackers

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Mimecast links security breach to SolarWinds hackers
26 January 2021

Ongoing Analysis of SolarWinds Impacts

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ongoing Analysis of SolarWinds Impacts
26 January 2021

Mimecast links security breach to SolarWinds hackers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mimecast links security breach to SolarWinds hackers
26 January 2021

SunBurst industrial victims | Kaspersky ICS CERT EN

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SunBurst industrial victims | Kaspersky ICS CERT EN
25 January 2021

Twenty-three SUNBURST Targets Identified

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Twenty-three SUNBURST Targets Identified
25 January 2021

Ungilded Secrets: A New Paradigm for Key Security

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ungilded Secrets: A New Paradigm for Key Security
25 January 2021

On attribution- APT28, APT29…Turla- No, they are NOT the same

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor On attribution- APT28, APT29…Turla- No, they are NOT the same
24 January 2021

Finding SUNBURST victims and targets by using passive DNS, OSINT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Finding SUNBURST victims and targets by using passive DNS, OSINT
22 January 2021

SolarWinds: How Sunburst Sends Data Back to the Attackers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SolarWinds: How Sunburst Sends Data Back to the Attackers
22 January 2021

SUNBURST Indicators: A Shift in Threat Utility

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SUNBURST Indicators: A Shift in Threat Utility
21 January 2021

SolarWinds Attack: Sunburst's DLL Technical Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SolarWinds Attack: Sunburst's DLL Technical Analysis
20 January 2021

Deep dive into the Solorigate second-stage activation- From SUNBURST to TEARDROP and Raindrop

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Deep dive into the Solorigate second-stage activation- From SUNBURST to TEARDROP and Raindrop
20 January 2021

Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop
19 January 2021

GitHub - mandiant/Mandiant-Azure-AD-Investigator

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GitHub - mandiant/Mandiant-Azure-AD-Investigator
19 January 2021

Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452
19 January 2021

Mandiant Azure AD Investigator- Focusing on UNC2452 TTPs

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Mandiant Azure AD Investigator- Focusing on UNC2452 TTPs
18 January 2021

Raindrop: New Malware Discovered in SolarWinds Investigation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Raindrop: New Malware Discovered in SolarWinds Investigation
17 January 2021

Backdooring MSBuild

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Backdooring MSBuild
15 January 2021

SolarWinds: Insights into Attacker Command and Control Process

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SolarWinds: Insights into Attacker Command and Control Process
15 January 2021

Detecting Malicious C2 Activity -SpawnAs & SMB Lateral Movement in CobaltStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detecting Malicious C2 Activity -SpawnAs & SMB Lateral Movement in CobaltStrike
14 January 2021

Increasing resilience against Solorigate and other sophisticated attacks with Microsoft Defender

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Increasing resilience against Solorigate and other sophisticated attacks with Microsoft Defender
14 January 2021

Increasing resilience against Solorigate and other sophisticated attacks with Microsoft Defender

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Increasing resilience against Solorigate and other sophisticated attacks with Microsoft Defender
14 January 2021

The Devil’s in the Details- SUNBURST Attribution

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Devil’s in the Details- SUNBURST Attribution
14 January 2021

Higaisa or Winnti? APT41 backdoors, old and new

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Higaisa or Winnti? APT41 backdoors, old and new
14 January 2021

The Devil’s in the Details: SUNBURST Attribution - DomainTools | Start Here. Know Now.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Devil’s in the Details: SUNBURST Attribution - DomainTools | Start Here. Know Now.
12 January 2021

UNC2452- What We Know So Far

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor UNC2452- What We Know So Far
11 January 2021

crowdstrike.com-SUNSPOT An Implant in the Build Process

date in the CCS '25 data CrowdStrike fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor crowdstrike.com-SUNSPOT An Implant in the Build Process
11 January 2021

Sunburst backdoor - code overlaps with Kazuar

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sunburst backdoor - code overlaps with Kazuar
11 January 2021

Sunburst backdoor – code overlaps with Kazuar

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Sunburst backdoor – code overlaps with Kazuar
11 January 2021

SUNSPOT- An Implant in the Build Process

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor SUNSPOT- An Implant in the Build Process
11 January 2021

SUNSPOT Malware: A Technical Analysis | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SUNSPOT Malware: A Technical Analysis | CrowdStrike
11 January 2021

Trickbot Still Alive and Well

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Trickbot Still Alive and Well
11 January 2021

securelist.com-Sunburst backdoor code overlaps with Kazuar

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor securelist.com-Sunburst backdoor code overlaps with Kazuar
11 January 2021

Robust Indicators of Compromise for SUNBURST

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Robust Indicators of Compromise for SUNBURST
11 January 2021

Robust Indicators of Compromise for SUNBURST

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Robust Indicators of Compromise for SUNBURST
10 January 2021

MAN1, Moskal, Hancitor and a side of Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MAN1, Moskal, Hancitor and a side of Ransomware
9 January 2021

Malware Development: Leveraging Beacon Object Files for Remote Process Injection via Thread Hijacking

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Development: Leveraging Beacon Object Files for Remote Process Injection via Thread Hijacking
8 January 2021

Detecting Post-Compromise Threat Activity in Microsoft Cloud Environments | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detecting Post-Compromise Threat Activity in Microsoft Cloud Environments | CISA
8 January 2021

A Golden SAML Journey: SolarWinds Continued | Splunk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Golden SAML Journey: SolarWinds Continued | Splunk
7 January 2021

Adversary Infrustructure Report 2020 - A Defender's View

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Adversary Infrustructure Report 2020 - A Defender's View
7 January 2021

SolarWinds: How a Rare DGA Helped Attacker Communications Fly Under the Radar

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SolarWinds: How a Rare DGA Helped Attacker Communications Fly Under the Radar
6 January 2021

Hunting for GetSystem commands in offensive security tools

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hunting for GetSystem commands in offensive security tools
6 January 2021

Supply Chain Compromise

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Supply Chain Compromise
6 January 2021

Supply Chain Compromise | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Supply Chain Compromise | CISA
5 January 2021

红队视角看Sunburst后门中的TTPs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 红队视角看Sunburst后门中的TTPs
5 January 2021

Joint Statement by the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the Office of the Director of National Intelligence (ODNI), and the National Security Agency (NSA) | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Joint Statement by the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the Office of the Director of National Intelligence (ODNI), and the National Security Agency (NSA) | CISA
5 January 2021

Earth Wendigo Injects JavaScript Backdoor for Mailbox Exfiltration

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Wendigo Injects JavaScript Backdoor for Mailbox Exfiltration
4 January 2021

Finding Targeted SUNBURST Victims with pDNS

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Finding Targeted SUNBURST Victims with pDNS
4 January 2021

Malleable C2 Profiles and You

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malleable C2 Profiles and You
4 January 2021

Finding Targeted SUNBURST Victims with pDNS

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Finding Targeted SUNBURST Victims with pDNS
31 December 2020

SolarWinds_SUNBURST- Behavioral analytics and Collective Defense in action

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor SolarWinds_SUNBURST- Behavioral analytics and Collective Defense in action
31 December 2020

Microsoft Internal Solorigate Investigation Update

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Internal Solorigate Investigation Update
30 December 2020

SolarWinds Attribution: Are We Getting Ahead of Ourselves?

Malpedia library date RecordedFuture fromORKL

Archived copy on ORKL Detailsfor SolarWinds Attribution: Are We Getting Ahead of Ourselves?
29 December 2020

Extracting Security Products from SUNBURST DNS Beacons

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Extracting Security Products from SUNBURST DNS Beacons
29 December 2020

Golden SAML Revisited: The Solorigate Connection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Golden SAML Revisited: The Solorigate Connection
29 December 2020

Golden SAML Revisited- The Solorigate Connection

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Golden SAML Revisited- The Solorigate Connection
28 December 2020

Using Microsoft 365 Defender to protect against Solorigate

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Using Microsoft 365 Defender to protect against Solorigate
28 December 2020

Using Microsoft 365 Defender to protect against Solorigate | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Using Microsoft 365 Defender to protect against Solorigate | Microsoft Security Blog
26 December 2020

Spoofing JARM signatures. I am the Cobalt Strike server now!

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Spoofing JARM signatures. I am the Cobalt Strike server now!
25 December 2020

SUNBURST & Memory Analysis

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor SUNBURST & Memory Analysis
24 December 2020

SUNBURST Additional Technical Details | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SUNBURST Additional Technical Details | Mandiant
24 December 2020

SUNBURST Additional Technical Details

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor SUNBURST Additional Technical Details
23 December 2020

SolarStorm Supply Chain Attack Timeline

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor SolarStorm Supply Chain Attack Timeline
23 December 2020

SolarStorm Supply Chain Attack Timeline

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor SolarStorm Supply Chain Attack Timeline
23 December 2020

CrowdStrike Launches Free Tool to Identify & Mitigate Risks in Azure Active Directory | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CrowdStrike Launches Free Tool to Identify & Mitigate Risks in Azure Active Directory | CrowdStrike
22 December 2020

The Hitchhiker’s Guide to SolarWinds Incident Response | Zscaler

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Hitchhiker’s Guide to SolarWinds Incident Response | Zscaler
22 December 2020

Identifying UNC2452-Related Techniques for ATT&CK

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Identifying UNC2452-Related Techniques for ATT&CK
22 December 2020

Identifying UNC2452-Related Techniques for ATT&CK

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Identifying UNC2452-Related Techniques for ATT&CK
22 December 2020

SolarWinds Attacks: Stealthy Attackers Attempted To Evade Detection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SolarWinds Attacks: Stealthy Attackers Attempted To Evade Detection
22 December 2020

Azure AD workbook to help you assess Solorigate risk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Azure AD workbook to help you assess Solorigate risk
22 December 2020

SUNBURST, TEARDROP and the NetSec New Normal - Check Point Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SUNBURST, TEARDROP and the NetSec New Normal - Check Point Research
21 December 2020

How A Device to Cloud Architecture Defends Against the SolarWinds Supply Chain Compromise

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor How A Device to Cloud Architecture Defends Against the SolarWinds Supply Chain Compromise
21 December 2020

Top Linux Cloud Threats of 2020

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Top Linux Cloud Threats of 2020
21 December 2020

Understanding "Solorigate"'s Identity IOCs - for Identity Vendors and their customers.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Understanding "Solorigate"'s Identity IOCs - for Identity Vendors and their customers.
21 December 2020

Nobelium Resource Center - updated March 4, 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Nobelium Resource Center - updated March 4, 2021
21 December 2020

Top Linux Cloud Threats of 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Top Linux Cloud Threats of 2020
21 December 2020

Russian cyber attack campaigns and actors

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Russian cyber attack campaigns and actors
21 December 2020

Solorigate Resource Center

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Solorigate Resource Center
21 December 2020

What We Have Learned So Far about the “Sunburst”/SolarWinds Hack | FortiGuard labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What We Have Learned So Far about the “Sunburst”/SolarWinds Hack | FortiGuard labs
20 December 2020

A Look into SUNBURST’s DGA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Look into SUNBURST’s DGA
19 December 2020

The SolarWinds cyberattack: The hack, the victims, and what we know

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The SolarWinds cyberattack: The hack, the victims, and what we know
18 December 2020

High Value Malicious Domains.

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor High Value Malicious Domains.
18 December 2020

Sunburst- connecting the dots in the DNS requests

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Sunburst- connecting the dots in the DNS requests
18 December 2020

Tracking Sunburst-Related Activity with ThreatConnect Dashboards | ThreatConnect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tracking Sunburst-Related Activity with ThreatConnect Dashboards | ThreatConnect
18 December 2020

SolarWinds Incident: Deeper Analysis of the Breach

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SolarWinds Incident: Deeper Analysis of the Breach
18 December 2020

Sunburst: connecting the dots in the DNS requests

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sunburst: connecting the dots in the DNS requests
18 December 2020

Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers
18 December 2020

SolarWinds SUNBURST Backdoor: Inside the APT Campaign - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SolarWinds SUNBURST Backdoor: Inside the APT Campaign - SentinelLabs
18 December 2020

Combining supervised and unsupervised machine learning for DGA detection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Combining supervised and unsupervised machine learning for DGA detection
18 December 2020

SUNBURST indicator detection in QRadar

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SUNBURST indicator detection in QRadar
18 December 2020

Tracking Sunburst-Related Activity with ThreatConnect Dashboards

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Tracking Sunburst-Related Activity with ThreatConnect Dashboards
18 December 2020

Continuous Eruption- Further Analysis of the SolarWinds Supply Chain Incident

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Continuous Eruption- Further Analysis of the SolarWinds Supply Chain Incident
18 December 2020

The Strategic Implications of SolarWinds

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Strategic Implications of SolarWinds
18 December 2020

A quirk in the SUNBURST DGA algorithm

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A quirk in the SUNBURST DGA algorithm
18 December 2020

Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers | Microsoft Security Blog
17 December 2020

DebUNCing Attribution How Mandiant Tracks Uncategorized Threat Actors

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor DebUNCing Attribution How Mandiant Tracks Uncategorized Threat Actors
17 December 2020

SUPERNOVA: A Novel .NET Webshell

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor SUPERNOVA: A Novel .NET Webshell
17 December 2020

SUPERNOVA- SolarStorm’s Novel .NET Webshell

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor SUPERNOVA- SolarStorm’s Novel .NET Webshell
17 December 2020

SolarWinds Backdoor (Sunburst) Incident Response Playbook

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SolarWinds Backdoor (Sunburst) Incident Response Playbook
17 December 2020

Reassembling Victim Domain Fragments from SUNBURST DNS

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Reassembling Victim Domain Fragments from SUNBURST DNS
17 December 2020

Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations | CISA
17 December 2020

The SolarWinds Orion SUNBURST supply-chain Attack

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The SolarWinds Orion SUNBURST supply-chain Attack
17 December 2020

A moment of reckoning: the need for a strong and global cybersecurity response - Microsoft On the Issues

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A moment of reckoning: the need for a strong and global cybersecurity response - Microsoft On the Issues
17 December 2020

The SolarWinds Orion SUNBURST Supply-chain Attack - Trulysuper

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The SolarWinds Orion SUNBURST Supply-chain Attack - Trulysuper
17 December 2020

SUPERNOVA SolarWinds .NET Webshell Analysis

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor SUPERNOVA SolarWinds .NET Webshell Analysis
16 December 2020

SUNBURST: SolarWinds' Supply-Chain Attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SUNBURST: SolarWinds' Supply-Chain Attack
16 December 2020

subdomain & #DGA domain names , #SolarWinds, attacked by #UNC2452 @0xrb - Pastebin.com

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor subdomain & #DGA domain names , #SolarWinds, attacked by #UNC2452 @0xrb - Pastebin.com
16 December 2020

Trend data on the SolarWinds Orion compromise

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trend data on the SolarWinds Orion compromise
16 December 2020

RL Blog | ReversingLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RL Blog | ReversingLabs
16 December 2020

FireEye, Microsoft create kill switch for SolarWinds backdoor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor FireEye, Microsoft create kill switch for SolarWinds backdoor
16 December 2020

List of domain infrastructure including DGA domain used by UNC2452

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor List of domain infrastructure including DGA domain used by UNC2452
16 December 2020

SolarWinds Post-Compromise Hunting with Azure Sentinel

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SolarWinds Post-Compromise Hunting with Azure Sentinel
15 December 2020

Detect SUNBURST Backdoor Attack With Corelight & Zeek | Corelight

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detect SUNBURST Backdoor Attack With Corelight & Zeek | Corelight
15 December 2020

Sunburst Malware: Inside the SolarWinds Supply Chain Breach

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sunburst Malware: Inside the SolarWinds Supply Chain Breach
15 December 2020

Tactics, Techniques, and Procedures (TTPs) Used in the SolarWinds Breach

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tactics, Techniques, and Procedures (TTPs) Used in the SolarWinds Breach
15 December 2020

Intel 471

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Intel 471
15 December 2020

Threat Hunt Deep Dives- SolarWinds Supply Chain Compromise (Solorigate - SUNBURST Backdoor)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Threat Hunt Deep Dives- SolarWinds Supply Chain Compromise (Solorigate - SUNBURST Backdoor)
15 December 2020

A quick note from Nick Carr on COSMICGALE and SUPERNOVA that those are unrelated to UC2452 intrusion campaign

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor A quick note from Nick Carr on COSMICGALE and SUPERNOVA that those are unrelated to UC2452 intrusion campaign
14 December 2020

Dark Halo Leverages SolarWinds Compromise to Breach Organizations

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dark Halo Leverages SolarWinds Compromise to Breach Organizations
14 December 2020

Dark Halo Leverages SolarWinds Compromise to Breach Organizations

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Dark Halo Leverages SolarWinds Compromise to Breach Organizations
14 December 2020

SolarWinds Orion and UNC2452 - Summary and Recommendations

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SolarWinds Orion and UNC2452 - Summary and Recommendations
14 December 2020

Threat Advisory: SolarWinds supply chain attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Advisory: SolarWinds supply chain attack
14 December 2020

Threat Brief: SolarStorm and SUNBURST Customer Coverage

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Brief: SolarStorm and SUNBURST Customer Coverage
14 December 2020

Solve Cloud Forensics at Scale

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Solve Cloud Forensics at Scale
14 December 2020

SolarWinds: Tracing the Network Infrastructure Behind It

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SolarWinds: Tracing the Network Infrastructure Behind It
14 December 2020

Sunburst: Supply Chain Attack Targets SolarWinds Users

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sunburst: Supply Chain Attack Targets SolarWinds Users
14 December 2020

Threat Brief SolarStorm and SUNBURST Customer Coverage

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Threat Brief SolarStorm and SUNBURST Customer Coverage
14 December 2020

Using Splunk to Detect Sunburst Backdoor | Splunk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Using Splunk to Detect Sunburst Backdoor | Splunk
14 December 2020

SolarWinds Orion and UNC2452 – Summary and Recommendations

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor SolarWinds Orion and UNC2452 – Summary and Recommendations
13 December 2020

Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor
13 December 2020

Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor

date in the CCS '25 data FireEye fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor
13 December 2020

SolarWinds Supply Chain Attack Uses SUNBURST Backdoor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SolarWinds Supply Chain Attack Uses SUNBURST Backdoor
13 December 2020

Trojan-MSIL-Solorigate.B!dha

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Trojan-MSIL-Solorigate.B!dha
13 December 2020

SUNBURST Countermeasures

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor SUNBURST Countermeasures
11 December 2020

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog
10 December 2020

Threat Brief: FireEye Red Team Tool Breach

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Brief: FireEye Red Team Tool Breach
10 December 2020

Tactics, Techniques and Procedures (TTPs) Utilized by FireEye’s Red Team Tools

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Tactics, Techniques and Procedures (TTPs) Utilized by FireEye’s Red Team Tools
10 December 2020

No pandas, just people: The current state of China’s cybercrime underground

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor No pandas, just people: The current state of China’s cybercrime underground
9 December 2020

Recent Qakbot (Qbot) activity - SANS Internet Storm Center

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Recent Qakbot (Qbot) activity - SANS Internet Storm Center
9 December 2020

Microsoft Word - eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations-wp.docx

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Word - eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations-wp.docx
9 December 2020

Quarterly Report: Incident Response trends from Fall 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Quarterly Report: Incident Response trends from Fall 2020
7 December 2020

Advanced Persistent Infrastructure Tracking - Censys

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Advanced Persistent Infrastructure Tracking - Censys
7 December 2020

Advanced Persistent Infrastructure Tracking

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Advanced Persistent Infrastructure Tracking
3 December 2020

APT annual review: What the world’s threat actors got up to in 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT annual review: What the world’s threat actors got up to in 2020
1 December 2020

Mandiant Cybersecurity Consulting

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mandiant Cybersecurity Consulting
30 November 2020

Threat actor leverages coin miner techniques to stay under the radar – here’s how to spot them | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat actor leverages coin miner techniques to stay under the radar – here’s how to spot them | Microsoft Security Blog
30 November 2020

eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations.pdf
26 November 2020

Cybereason vs. Egregor Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cybereason vs. Egregor Ransomware
25 November 2020

Egregor RaaS Continues the Chaos with Cobalt Strike and Rclone - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Egregor RaaS Continues the Chaos with Cobalt Strike and Rclone - SentinelLabs
23 November 2020

Genetic Analysis of CryptoWall Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Genetic Analysis of CryptoWall Ransomware
23 November 2020

Genetic Analysis of CryptoWall Ransomware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Genetic Analysis of CryptoWall Ransomware
20 November 2020

The malware that usually installs ransomware and you need to remove right away

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The malware that usually installs ransomware and you need to remove right away
17 November 2020

Easily Identify Malicious Servers on the Internet with JARM - Salesforce Engineering Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Easily Identify Malicious Servers on the Internet with JARM - Salesforce Engineering Blog
17 November 2020

Ukraine’s Top Cyber Cop on Defending Against Disinformation and Russian Hackers

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Ukraine’s Top Cyber Cop on Defending Against Disinformation and Russian Hackers
15 November 2020

From virus alert to PowerShell Encrypted Loader – Trustnet

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From virus alert to PowerShell Encrypted Loader – Trustnet
9 November 2020

Fake Microsoft Teams updates lead to Cobalt Strike deployment

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Fake Microsoft Teams updates lead to Cobalt Strike deployment
6 November 2020

When Threat Actors Fly Under the Radar: Vatet, PyXie and Defray777

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor When Threat Actors Fly Under the Radar: Vatet, PyXie and Defray777
6 November 2020

OceanLotus: Extending Cyber Espionage Operations Through Fake Websites

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OceanLotus: Extending Cyber Espionage Operations Through Fake Websites
5 November 2020

Ryuk Speed Run, 2 Hours to Ransom

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Ryuk Speed Run, 2 Hours to Ransom
4 November 2020

Trick or Threat: Ryuk Ransomware Targets Health Care Industry

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trick or Threat: Ryuk Ransomware Targets Health Care Industry
4 November 2020

APT_trends_report_Q3_2020_Securelist

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT_trends_report_Q3_2020_Securelist
4 November 2020

The Enigmatic Energetic Bear

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Enigmatic Energetic Bear
4 November 2020

The Enigmatic Energetic Bear

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Enigmatic Energetic Bear
3 November 2020

APT trends report Q3 2020

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT trends report Q3 2020
3 November 2020

APT trends report Q3 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q3 2020
3 November 2020

Attackers Exploiting WebLogic Servers via CVE-2020-14882 to install Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attackers Exploiting WebLogic Servers via CVE-2020-14882 to install Cobalt Strike
30 October 2020

research-team/IOCs/WizardSpider-UNC1878-Ryuk.csv at master · ThreatConnect-Inc/research-team

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor research-team/IOCs/WizardSpider-UNC1878-Ryuk.csv at master · ThreatConnect-Inc/research-team
29 October 2020

A Bazar start: How one hospital thwarted a Ryuk ransomware outbreak

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Bazar start: How one hospital thwarted a Ryuk ransomware outbreak
28 October 2020

Unhappy Hour Special: KEGTAP and SINGLEMALT With a Ransomware Chaser | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unhappy Hour Special: KEGTAP and SINGLEMALT With a Ransomware Chaser | Mandiant
20 October 2020

Chinese State-Sponsored Actors Exploit Publicly Known Vulnerabilitie

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese State-Sponsored Actors Exploit Publicly Known Vulnerabilitie
18 October 2020

Ryuk in 5 Hours

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Ryuk in 5 Hours
11 October 2020

CyberThreatIntel/China/APT/Chimera/Analysis.md at master · StrangerealIntel/CyberThreatIntel

Malpedia library date Github (StrangerealIntel) fromORKLCCS '25 data

Archived copy on ORKL Detailsfor CyberThreatIntel/China/APT/Chimera/Analysis.md at master · StrangerealIntel/CyberThreatIntel
8 October 2020

Ryuk's Return

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Ryuk's Return
8 October 2020

Lined up in the sights of Vietnamese hackers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lined up in the sights of Vietnamese hackers
2 October 2020

bazarloader.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor bazarloader.pdf
1 October 2020

Potential for China Cyber Response to Heightened U.S.–China Tensions | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Potential for China Cyber Response to Heightened U.S.–China Tensions | CISA
29 September 2020

FY20 Microsoft Digital Defense Report

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor FY20 Microsoft Digital Defense Report
29 September 2020

Getting the Bacon from Cobalt Strike's Beacon | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Getting the Bacon from Cobalt Strike's Beacon | CrowdStrike
29 September 2020

GitHub - Apr4h/CobaltStrikeScan: Scan files or process memory for CobaltStrike beacons and parse their configuration

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GitHub - Apr4h/CobaltStrikeScan: Scan files or process memory for CobaltStrike beacons and parse their configuration
24 September 2020

Federal Agency Compromised by Malicious Cyber Actor | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Federal Agency Compromised by Malicious Cyber Actor | CISA
22 September 2020

Detecting Threats in Real-time With Active C2 Information

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detecting Threats in Real-time With Active C2 Information
18 September 2020

U.S. Justice Department Charges APT41 Hackers over Global Cyberattacks

Malpedia library date Trend Micro fromORKLCCS '25 data

Archived copy on ORKL Detailsfor U.S. Justice Department Charges APT41 Hackers over Global Cyberattacks
17 September 2020

Insights

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Insights
10 September 2020

An overview of targeted attacks and APTs on Linux

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor An overview of targeted attacks and APTs on Linux
10 September 2020

An overview of targeted attacks and APTs on Linux

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor An overview of targeted attacks and APTs on Linux
7 September 2020

tweets/2020-09-07-Dridex-IOCs.txt at master · pan-unit42/tweets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor tweets/2020-09-07-Dridex-IOCs.txt at master · pan-unit42/tweets
1 September 2020

Quarterly Report: Incident Response trends in Summer 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Quarterly Report: Incident Response trends in Summer 2020
31 August 2020

NetWalker Ransomware in 1 Hour

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor NetWalker Ransomware in 1 Hour
19 August 2020

調查局 08/19 公布中國對台灣政府機關駭侵事件說明

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 調查局 08/19 公布中國對台灣政府機關駭侵事件說明
17 August 2020

WellMess malware- analysis of its Command and Control (C2) server

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor WellMess malware- analysis of its Command and Control (C2) server
13 August 2020

Attribution- A Puzzle

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Attribution- A Puzzle
13 August 2020

Attribution: A Puzzle

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attribution: A Puzzle
4 August 2020

us-20-Chen-Operation-Chimera-APT-Operation-Targets-Semiconductor-Vendors.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor us-20-Chen-Operation-Chimera-APT-Operation-Targets-Semiconductor-Vendors.pdf
29 July 2020

APT trends report Q2 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q2 2020
26 July 2020

In-Memory shellcode decoding to evade AVs/EDRs

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor In-Memory shellcode decoding to evade AVs/EDRs
23 July 2020

Who is behind APT29- What we know about this nation-state cybercrime group

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Who is behind APT29- What we know about this nation-state cybercrime group
16 July 2020

US, UK, and Canada’s COVID-19 research targeted by APT29

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor US, UK, and Canada’s COVID-19 research targeted by APT29
16 July 2020

Malware Analysis Report (AR20-198C)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Malware Analysis Report (AR20-198C)
16 July 2020

MAR-10296782-3.v1 – WELLMAIL | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MAR-10296782-3.v1 – WELLMAIL | CISA
16 July 2020

MAR-10296782-1.v1 – SOREFANG | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MAR-10296782-1.v1 – SOREFANG | CISA
16 July 2020

Malware Analysis Report (AR20-198A)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Malware Analysis Report (AR20-198A)
16 July 2020

MAR-10296782-2.v1 – WELLMESS | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MAR-10296782-2.v1 – WELLMESS | CISA
16 July 2020

Advisory-APT29-targets-COVID-19-vaccine-development-V1-1.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor Advisory-APT29-targets-COVID-19-vaccine-development-V1-1.pdf
16 July 2020

How WellMess malware has been used to target Covid-19 vaccines

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor How WellMess malware has been used to target Covid-19 vaccines
16 July 2020

Malware Analysis Report (AR20-198B)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Malware Analysis Report (AR20-198B)
16 July 2020

Advisory-APT29-targets-COVID-19-vaccine-development

Malpedia library date NCSC fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Advisory-APT29-targets-COVID-19-vaccine-development
14 July 2020

Turla / Venomous Bear updates its arsenal: "NewPass" appears on the APT threat scene - Telsy

Malpedia library date Telsy fromORKLCCS '25 data

The original link failed its last check. Original publisher Detailsfor Turla / Venomous Bear updates its arsenal: "NewPass" appears on the APT threat scene - Telsy
14 July 2020

Intel 471

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Intel 471
7 July 2020

Cobalt Strike stagers used by FIN6 :: MWLab — Ladislav's Malware Lab

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike stagers used by FIN6 :: MWLab — Ladislav's Malware Lab
1 July 2020

Accenture | Let there be change

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Accenture | Let there be change
23 June 2020

Sodinokibi: Ransomware Attackers also Scanning for PoS Software, Leveraging Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sodinokibi: Ransomware Attackers also Scanning for PoS Software, Leveraging Cobalt Strike
23 June 2020

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research
22 June 2020

IndigoDrop spreads via military-themed lures to deliver Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor IndigoDrop spreads via military-themed lures to deliver Cobalt Strike
22 June 2020

Inside a TrickBot Cobalt Strike Attack Server - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Inside a TrickBot Cobalt Strike Attack Server - SentinelLabs
19 June 2020

Targeted Attack Leverages India-China Border Dispute

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Targeted Attack Leverages India-China Border Dispute
15 June 2020

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research
1 June 2020

Russian Cyber Attack Campaigns and Actors - Threat Research

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Russian Cyber Attack Campaigns and Actors - Threat Research
26 May 2020

Alert (AA21-116A)- Russian Foreign Intelligence Service (SVR) Cyber Operations- Trends and Best Practices for Network Defenders

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Alert (AA21-116A)- Russian Foreign Intelligence Service (SVR) Cyber Operations- Trends and Best Practices for Network Defenders
26 May 2020

Russian Foreign Intelligence Service (SVR) Cyber Operations: Trends and Best Practices for Network Defenders | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Russian Foreign Intelligence Service (SVR) Cyber Operations: Trends and Best Practices for Network Defenders | CISA
18 May 2020

Looking Back at LiteDuke – One Night in Norfolk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Looking Back at LiteDuke – One Night in Norfolk
18 May 2020

Looking Back at LiteDuke

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Looking Back at LiteDuke
14 May 2020

The energy reserves in the Eastern Mediterranean Sea and a malicious campaign of APT10 against Turkey

Malpedia library date Lab52 fromORKLCCS '25 data

Archived copy on ORKL Detailsfor The energy reserves in the Eastern Mediterranean Sea and a malicious campaign of APT10 against Turkey
11 May 2020

The Anatomy of an APT Attack and CobaltStrike Beacon’s Encoded Configuration - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Anatomy of an APT Attack and CobaltStrike Beacon’s Encoded Configuration - SentinelLabs
6 May 2020

039- Deconstructing the Dukes- A Researcher’s Retrospective of APT29

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor 039- Deconstructing the Dukes- A Researcher’s Retrospective of APT29
6 May 2020

039 Deconstructing the Dukes A Researcher's Retrospective of APT29

date in the CCS '25 data F-Secure fromCCS '25 data

Detailsfor 039 Deconstructing the Dukes A Researcher's Retrospective of APT29
24 April 2020

Ursnif via LOLbins

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Ursnif via LOLbins
2 April 2020

Catching APT41 exploiting a zero-day vulnerability

date in the CCS '25 data Darktrace fromCCS '25 data

The original link failed its last check. Detailsfor Catching APT41 exploiting a zero-day vulnerability
25 March 2020

APT41 Initiates Intrusion Campaign Using Multiple Exploits

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT41 Initiates Intrusion Campaign Using Multiple Exploits
25 March 2020

Trickbot to Ryuk in Two Hours

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trickbot to Ryuk in Two Hours
22 March 2020

Mustang Panda joins the COVID-19 bandwagon

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mustang Panda joins the COVID-19 bandwagon
20 March 2020

Analysis Of Exploitation: CVE-2020-10189

Malpedia library date RECON InfoSec fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Analysis Of Exploitation: CVE-2020-10189
3 March 2020

Cyber Threats 2019: A Year in Retrospect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Threats 2019: A Year in Retrospect
18 February 2020

Operation DRBControl: Uncovering a Cyberespionage Campaign Targeting Gambling Companies in Southeast Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation DRBControl: Uncovering a Cyberespionage Campaign Targeting Gambling Companies in Southeast Asia
18 February 2020

Building a bypass with MSBuild

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Building a bypass with MSBuild
13 February 2020

2020.02.22_APT_threat_report_2019_CN_version

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 2020.02.22_APT_threat_report_2019_CN_version
12 December 2019

[CB19] Cyber Threat Landscape in Japan – Revealing Threat in the Shadow by Chi En Shen (Ashley) Oleg Bondarenko

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor [CB19] Cyber Threat Landscape in Japan – Revealing Threat in the Shadow by Chi En Shen (Ashley) Oleg Bondarenko
9 December 2019

Group-IB_Hi-Tech_Crime_Trends_2019-2020_en

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Group-IB_Hi-Tech_Crime_Trends_2019-2020_en
29 November 2019

Group-IB_Hi-Tech_Crime_Trends_2019-2020

date in the CCS '25 data Group-IB fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Group-IB_Hi-Tech_Crime_Trends_2019-2020
29 November 2019

Aarhus_miniseminar_291118.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Aarhus_miniseminar_291118.pdf
5 November 2019

CobaltStrike - beacon.dll : Your No Ordinary MZ Header

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CobaltStrike - beacon.dll : Your No Ordinary MZ Header
17 October 2019

Operation Ghost- The Dukes aren’t back – they never left

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Operation Ghost- The Dukes aren’t back – they never left
17 October 2019

Operation Ghost: The Dukes aren’t back – they never left

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Ghost: The Dukes aren’t back – they never left
17 October 2019

Operation Ghost

Malpedia library date ESET fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation Ghost
16 October 2019

LNKR- More than Just a Browser Extension

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor LNKR- More than Just a Browser Extension
1 October 2019

Mapping the connections inside Russia APT Ecosystem

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Mapping the connections inside Russia APT Ecosystem
22 September 2019

Rancor: The Year of The Phish

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rancor: The Year of The Phish
2 September 2019

Revealed: How a secret Dutch mole aided the U.S.-Israeli Stuxnet cyberattack on Iran

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Revealed: How a secret Dutch mole aided the U.S.-Israeli Stuxnet cyberattack on Iran
2 September 2019

Revealed- How a secret Dutch mole aided the U.S.-Israeli Stuxnet cyberattack on Iran

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Revealed- How a secret Dutch mole aided the U.S.-Israeli Stuxnet cyberattack on Iran
24 June 2019

APT-Attacks-eng.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor APT-Attacks-eng.pdf
24 June 2019

Threat Group Cards: A Threat Actor Encyclopedia

file creation date ThaiCERT fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Threat Group Cards: A Threat Actor Encyclopedia
13 June 2019

Hunting and detecting Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hunting and detecting Cobalt Strike
13 June 2019

Hunting and detecting Cobalt Strike

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Hunting and detecting Cobalt Strike
12 June 2019

Threat Group Cards: A Threat Actor Encyclopedia

file creation date Martijn van der Heide fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia
4 June 2019

An APT Blueprint Gaining New Visibility into Financial Threats

date in the CCS '25 data Bitdefender fromCCS '25 data

Detailsfor An APT Blueprint Gaining New Visibility into Financial Threats
8 May 2019

2019-data-breach-investigations-report.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2019-data-breach-investigations-report.pdf
24 April 2019

Sea Lotus APT organization's attack techniques against China in the first quarter of 2019 revealed

date in the CCS '25 data Weixin fromCCS '25 data

The original link failed its last check. Detailsfor Sea Lotus APT organization's attack techniques against China in the first quarter of 2019 revealed
15 April 2019

Cobalt Strike. Walkthrough for Red Teamers | Pen Test Partners

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike. Walkthrough for Red Teamers | Pen Test Partners
12 April 2019

Blog Archive - SpamTitan Email Security

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Blog Archive - SpamTitan Email Security
1 April 2019

mpressioncss_ta_report_2019.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor mpressioncss_ta_report_2019.pdf
24 March 2019

An OceanLotus (APT32) Backdoor – One Night in Norfolk

Malpedia library date One Night in Norfolk fromORKLCCS '25 data

Archived copy on ORKL Detailsfor An OceanLotus (APT32) Backdoor – One Night in Norfolk
27 February 2019

New Global Cyber Attack on Point of Sale Systems

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Global Cyber Attack on Point of Sale Systems
26 February 2019

Identifying Cobalt Strike team servers in the wild

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Identifying Cobalt Strike team servers in the wild
12 February 2019

2019.01.03.Tencent_APT_Summary_report_2018_CN_Version

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 2019.01.03.Tencent_APT_Summary_report_2018_CN_Version
12 February 2019

2018 APT Summary Report CN version

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 2018 APT Summary Report CN version
12 February 2019

2018 Master Table

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 2018 Master Table
5 December 2018

APT review of the year

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT review of the year
3 December 2018

Analysis of cyberattack on U.S. think tanks, non-profits, public sector by unidentified attackers | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis of cyberattack on U.S. think tanks, non-profits, public sector by unidentified attackers | Microsoft Security Blog
3 December 2018

Analysis of cyberattack on U.S. think tanks, non-profits, public sector by unidentified attackers

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Analysis of cyberattack on U.S. think tanks, non-profits, public sector by unidentified attackers
1 December 2018

2018-Y-Ishikawa-S-Nagano-Lets-go-with-a-Go-RAT-_final.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2018-Y-Ishikawa-S-Nagano-Lets-go-with-a-Go-RAT-_final.pdf
20 November 2018

Not So Cozy: An Uncomfortable Examination of a Suspected APT29 Phishing Campaign

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Not So Cozy: An Uncomfortable Examination of a Suspected APT29 Phishing Campaign
19 November 2018

Not So Cozy- An Uncomfortable Examination of a Suspected APT29 Phishing Campaign

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Not So Cozy- An Uncomfortable Examination of a Suspected APT29 Phishing Campaign
19 November 2018

Not So Cozy: An Uncomfortable Examination of a Suspected APT29 Phishing Campaign | Mandiant

Malpedia library date FireEye fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Not So Cozy: An Uncomfortable Examination of a Suspected APT29 Phishing Campaign | Mandiant
18 November 2018

CozyBear – In from the Cold?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CozyBear – In from the Cold?
18 November 2018

CozyBear – In from the Cold-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor CozyBear – In from the Cold-
1 October 2018

CDS2018-Technical-S5-ATT&CKing FIN7_The Value of Using Frameworks for Threat Intelligence-FINAL_clean

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor CDS2018-Technical-S5-ATT&CKing FIN7_The Value of Using Frameworks for Threat Intelligence-FINAL_clean
26 August 2018

Remember Fancy Bear?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Remember Fancy Bear?
26 August 2018

Remember Fancy Bear-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Remember Fancy Bear-
3 August 2018

Volatility Plugin for Detecting Cobalt Strike Beacon - JPCERT/CC Eyes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Volatility Plugin for Detecting Cobalt Strike Beacon - JPCERT/CC Eyes
6 July 2018

Malware “WellMess” Targeting Linux and Windows - JPCERT/CC Eyes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware “WellMess” Targeting Linux and Windows - JPCERT/CC Eyes
21 May 2018

APT攻撃者グループ menuPass(APT10) による新たな攻撃を確認 | LAC WATCH

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT攻撃者グループ menuPass(APT10) による新たな攻撃を確認 | LAC WATCH
3 May 2018

Burning Umbrella: An Intelligence Report on the Winnti Umbrella and Associated State-Sponsored Attackers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Burning Umbrella: An Intelligence Report on the Winnti Umbrella and Associated State-Sponsored Attackers
1 May 2018

M-Trends Overview

Malpedia library date Marco Rottigni fromORKL

Archived copy on ORKL Detailsfor M-Trends Overview
20 February 2018

A Slice of 2017 Sofacy Activity - Securelist

date in the CCS '25 data NATO fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor A Slice of 2017 Sofacy Activity - Securelist
2 November 2017

russian-federation-country-profile.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor russian-federation-country-profile.pdf
6 June 2017

Privileges and Credentials: Phished at the Request of Counsel | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Privileges and Credentials: Phished at the Request of Counsel | Mandiant
6 June 2017

Privileges and Credentials: Phished at the Request of Counsel | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Privileges and Credentials: Phished at the Request of Counsel | Mandiant
31 May 2017

APT29

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT29
3 May 2017

Snake: Coming soon in Mac OS X flavour

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Snake: Coming soon in Mac OS X flavour
3 May 2017

Snake- Coming soon in Mac OS X flavour

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Snake- Coming soon in Mac OS X flavour
20 April 2017

2017%20FireEye%20M-Trends%20Report.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2017%20FireEye%20M-Trends%20Report.pdf
4 April 2017

POSHSPY backdoor code

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor POSHSPY backdoor code
3 April 2017

Dissecting One of APT29's Fileless WMI and PowerShell Backdoors (POSHSPY) | Mandiant

Malpedia library date FireEye fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Dissecting One of APT29's Fileless WMI and PowerShell Backdoors (POSHSPY) | Mandiant
3 April 2017

Dissecting One of APT29’s Fileless WMI and PowerShell Backdoors (POSHSPY)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Dissecting One of APT29’s Fileless WMI and PowerShell Backdoors (POSHSPY)
27 March 2017

APT29 Domain Fronting With TOR

date in the CCS '25 data FireEye fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor APT29 Domain Fronting With TOR
23 February 2017

Bear Spotting Vol. 1: Russian Nation State Targeting of Government and Military Interests

file creation date tr1adx fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Bear Spotting Vol. 1: Russian Nation State Targeting of Government and Military Interests
20 February 2017

Part I. Russian APT - APT28 collection of samples including OSX XAgent

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Part I. Russian APT - APT28 collection of samples including OSX XAgent
20 February 2017

Part I. Russian APT - APT28 collection of samples including OSX XAgent

Malpedia library date Contagio Dump fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Part I. Russian APT - APT28 collection of samples including OSX XAgent
10 February 2017

AR-17-20045 Enhanced Analysis of GRIZZLY STEPPE Activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AR-17-20045 Enhanced Analysis of GRIZZLY STEPPE Activity
10 February 2017

Enhanced Analysis of GRIZZLY STEPPE Activity

file creation date US-CERT fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Enhanced Analysis of GRIZZLY STEPPE Activity
15 January 2017

[tr1adx]_ Intel

date in the CCS '25 data tr1adx fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor [tr1adx]_ Intel
10 January 2017

APT28-Center-of-Storm-2017.pdf

Malpedia library date FireEye fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT28-Center-of-Storm-2017.pdf
10 January 2017

At the Center of the Storm: Russia's APT28 Strategically Evolves its Cyber Operations

file creation date FireEye fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor At the Center of the Storm: Russia's APT28 Strategically Evolves its Cyber Operations
29 December 2016

GRIZZLY STEPPE - Russian Malicious Cyber Activity

date in the CCS '25 data US-CERT fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor GRIZZLY STEPPE - Russian Malicious Cyber Activity
29 December 2016

JAR-16-20296A: GRIZZLY STEPPE – Russian Malicious Cyber Activity

file creation date fromORKL

Archived copy on ORKL Detailsfor JAR-16-20296A: GRIZZLY STEPPE – Russian Malicious Cyber Activity
9 November 2016

PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs

date in the CCS '25 data Volexity fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs
9 November 2016

PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs
9 August 2016

Running for Office_ Russian APT Toolkits Revealed

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Running for Office_ Russian APT Toolkits Revealed
26 July 2016

Bears in the Midst_ Intrusion into the Democratic National Committee »

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Bears in the Midst_ Intrusion into the Democratic National Committee »
21 July 2016

Please Read

date in the CCS '25 data FireEye and Microsoft fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Please Read
30 June 2016

Russian government hackers penetrated DNC, stole opposition research on Trump - The Washington Post

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Russian government hackers penetrated DNC, stole opposition research on Trump - The Washington Post
30 June 2016

Findings from Analysis of DNC Intrusion Malware

file creation date Fidelis fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Findings from Analysis of DNC Intrusion Malware
15 June 2016

CrowdStrike’s work with the Democratic National Committee: Setting the record straight

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CrowdStrike’s work with the Democratic National Committee: Setting the record straight
15 June 2016

Bears in the Midst- Intrusion into the Democratic National Committee

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Bears in the Midst- Intrusion into the Democratic National Committee
4 June 2016

Bears in the Midst: Intrusion into the Democratic National Committee

date in the CCS '25 data Crowdstrike fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Bears in the Midst: Intrusion into the Democratic National Committee
15 April 2016

PowerPoint Presentation

date in the CCS '25 data CrowdStrike fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor PowerPoint Presentation
25 February 2016

rpt-mtrends-2016.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor rpt-mtrends-2016.pdf
4 February 2016

15GlobalThreatReport.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor 15GlobalThreatReport.pdf
1 February 2016

Know Your Enemies 2.0: A Primer on Advanced Persistent Threat Groups

file creation date ICIT fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Know Your Enemies 2.0: A Primer on Advanced Persistent Threat Groups
24 November 2015

Cyber war in perspective: Russian aggression against Ukraine

file creation date NATO fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Cyber war in perspective: Russian aggression against Ukraine
17 September 2015

The Dukes- 7 Years Of Russian Cyber-Espionage

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Dukes- 7 Years Of Russian Cyber-Espionage
15 September 2015

The Dukes: 7 years of Russian cyberespionage

file creation date F-Secure fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The Dukes: 7 years of Russian cyberespionage
1 September 2015

F-Secure_Dukes_Whitepaper.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor F-Secure_Dukes_Whitepaper.pdf
1 September 2015

Fancy Bear

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Fancy Bear
1 September 2015

Fancy Bear

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Fancy Bear
1 September 2015

Fancy Bear

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Fancy Bear
17 August 2015

dukes_whitepaper.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor dukes_whitepaper.pdf
28 July 2015

rpt-apt29-hammertoss-stealthy-tactics-define-en.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor rpt-apt29-hammertoss-stealthy-tactics-define-en.pdf
27 July 2015

Hammertoss: Stealthy Tactics Define A Russian Cyber Threat Group

date in the CCS '25 data FireEye fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Hammertoss: Stealthy Tactics Define A Russian Cyber Threat Group
22 July 2015

Duke APT group's latest tools: cloud services and Linux support - F-Secure Weblog : News from the Lab

date in the CCS '25 data F-Secure fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Duke APT group's latest tools: cloud services and Linux support - F-Secure Weblog : News from the Lab
22 July 2015

Duke APT group's latest tools- cloud services and Linux support

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Duke APT group's latest tools- cloud services and Linux support
14 July 2015

Tracking MiniDionis: CozyCar’s New Ride Is Related to Seaduke - Palo Alto Networks BlogPalo Alto Networks Blog

date in the CCS '25 data Palo Alto fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Tracking MiniDionis: CozyCar’s New Ride Is Related to Seaduke - Palo Alto Networks BlogPalo Alto Networks Blog
13 July 2015

"Forkmeiamfamous": Seaduke, latest weapon in the Duke armory

date in the CCS '25 data Symantec fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor "Forkmeiamfamous": Seaduke, latest weapon in the Duke armory
13 July 2015

Endpoint Protection - Symantec Enterprise

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Endpoint Protection - Symantec Enterprise
13 July 2015

“Forkmeiamfamous”- Seaduke, latest weapon in the Duke armory

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor “Forkmeiamfamous”- Seaduke, latest weapon in the Duke armory
1 July 2015

rpt-apt29-hammertoss.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor rpt-apt29-hammertoss.pdf
22 April 2015

CozyDuke: Malware Analysis

date in the CCS '25 data F-Secure fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor CozyDuke: Malware Analysis
21 April 2015

The Cozyduke APT

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The Cozyduke APT
15 November 2014

OnionDuke samples

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OnionDuke samples
14 November 2014

OnionDuke APT Attacks Via the Tor Network

date in the CCS '25 data F-Secure fromCCS '25 data

The original link failed its last check. Detailsfor OnionDuke APT Attacks Via the Tor Network
15 July 2014

Unit 42 Technical Analysis: Seaduke

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unit 42 Technical Analysis: Seaduke

Newest first. Details opens the report in Explore.

Names and who uses them

APT29 from AT MI MA Microsoft
UNC2452 from AT MI ET MA Microsoft
Midnight Blizzard from AT MI ET MA Microsoft
NOBELIUM from AT MI MA Microsoft
The Dukes from AT MI ET MA
UNC3524 from AT MI ET MA
IRON HEMLOCK from AT MI MA
YTTRIUM from AT MI MA
Cozy Bear from AT ET MA
Blue Kitsune from AT MI MA
Group 100 from MI ET MA
Minidionis from MI ET MA
ITG11 from MI ET MA
Grizzly Steppe from MI ET MA

Show all 43 names Show fewer

StellarParticle from MI ET MA
SilverFish from MI ET MA
Nobelium from MI ET MA
Cloaked Ursa from MI ET MA
BlueBravo from MI ET MA
Solar Phoenix from MI ET MA
COZY BEAR from MI MA Microsoft
NobleBaron from AT ET
Dark Halo from AT ET
SolarStorm from AT ET
SeaDuke from MI MA
ATK7 from MI MA
TA421 from MI MA
UAC-0029 from MI MA
ICECAP from MI MA
ICE RELIC from MI MA
DarkHalo from MI MA
IRON RITUAL from AT
CozyDuke from AT
APT 29 from ET
Yttrium from ET
Iron Hemlock from ET
CloudLook from ET
ATK 7 from ET
Iron Ritual from ET
Cranefly from ET
TEMP.Monkeys from ET
Blue Dev 5 from ET
Earth Koshchei from ET

AT ATT&CK
MI MISP
ET ETDA
MA Malpedia

Origin and Motivation

Origin: Russia fromMISP ETDA Malpedia Microsoft
Motivation: Information theft and espionage fromETDA

Claimed targets (actor-level, per source)

Sources give these for the actor as a whole, not for a report or campaign.

Countries: Australia fromETDA
Azerbaijan fromETDA
Belarus fromETDA
Belgium fromETDA
Brazil fromETDA
Bulgaria fromETDA
Canada fromETDA
Chile fromETDA
China fromETDA
Cyprus fromETDA
Denmark fromETDA
France fromETDA

Show all 48 countries Show fewer

Georgia fromETDA
Germany fromETDA
Hungary fromETDA
India fromETDA
Ireland fromETDA
Israel fromETDA
Italy fromETDA
Japan fromETDA
Kazakhstan fromETDA
Kyrgyzstan fromETDA
Latvia fromETDA
Lebanon fromETDA
Lithuania fromETDA
Luxembourg fromETDA
Mexico fromETDA
Montenegro fromETDA
Netherlands fromETDA
New Zealand fromETDA
Poland fromETDA
Portugal fromETDA
Romania fromETDA
Russia fromETDA
Singapore fromETDA
Slovakia fromETDA
Slovenia fromETDA
Spain fromETDA
South Korea fromETDA
Switzerland fromETDA
Thailand fromETDA
Türkiye fromETDA
Uganda fromETDA
United Arab Emirates fromETDA
United Kingdom fromETDA
Ukraine fromETDA
United States fromETDA
Uzbekistan fromETDA
Sectors: Think Tanks fromMISP ETDA Malpedia
Government, Administration fromMISP Malpedia
Aerospace fromETDA
Defense fromETDA
Education fromETDA
Embassies fromETDA
Energy fromETDA
Financial fromETDA
Government fromETDA
Healthcare fromETDA
Law enforcement fromETDA
Media fromETDA

Show all 17 sectors Show fewer

NGOs fromETDA
Pharmaceutical fromETDA
Telecommunications fromETDA
Transportation fromETDA
Imagery fromETDA

Malware and Tools

AADInternals fromATT&CK
AdFind fromATT&CK
BloodHound fromATT&CK
BoomBox fromATT&CK
CloudDuke fromATT&CK Malpedia
Cobalt Strike fromATT&CK Malpedia
CosmicDuke fromATT&CK Malpedia
CozyCar fromATT&CK
EnvyScout fromATT&CK
FatDuke fromATT&CK Malpedia
FoggyWeb fromATT&CK
GeminiDuke fromATT&CK

Show all 69 malware and tools Show fewer

GoldFinder fromATT&CK
GoldMax fromATT&CK Malpedia
HAMMERTOSS fromATT&CK
Impacket fromATT&CK
LiteDuke fromATT&CK Malpedia
Mimikatz fromATT&CK
MiniDuke fromATT&CK Malpedia
NativeZone fromATT&CK
Net fromATT&CK
OnionDuke fromATT&CK Malpedia
POSHSPY fromATT&CK
PinchDuke fromATT&CK Malpedia
PolyglotDuke fromATT&CK Malpedia
PowerDuke fromATT&CK
PsExec fromATT&CK
QUIETEXIT fromATT&CK
ROADTools fromATT&CK
Raindrop fromATT&CK Malpedia
RegDuke fromATT&CK
SDelete fromATT&CK
SUNBURST fromATT&CK Malpedia
SUNSPOT fromATT&CK
SeaDuke fromATT&CK
Sibot fromATT&CK
Sliver fromATT&CK
SoreFang fromATT&CK
Systeminfo fromATT&CK
TEARDROP fromATT&CK Malpedia
Tasklist fromATT&CK
Tor fromATT&CK
TrailBlazer fromATT&CK
VaporRage fromATT&CK Malpedia
WellMail fromATT&CK
WellMess fromATT&CK
ipconfig fromATT&CK
meek fromATT&CK
reGeorg fromATT&CK
ANDROSNATCH fromMalpedia
BEATDROP fromMalpedia
BOOMBOX fromMalpedia
COOKIESNATCH fromMalpedia
COZYDUKE fromMalpedia
ChocoShell fromMalpedia
CornFlake fromMalpedia
GRAPELOADER fromMalpedia
Gdrive fromMalpedia
GraphDrop fromMalpedia
GraphicalNeutrino fromMalpedia
HALFRIG fromMalpedia
NewPass fromMalpedia
QUARTERRIG fromMalpedia
SEADADDY fromMalpedia
VALIDVICTOR fromMalpedia
WINELOADER fromMalpedia
sRDI fromMalpedia
tDiscoverer fromMalpedia
CEELOADER fromMalpedia