Naikon

PlugX Meeting Invitation via MSBuild and GDATA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PlugX Meeting Invitation via MSBuild and GDATA

A Deep Dive into Sagerunex – Securite360

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Deep Dive into Sagerunex – Securite360

The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor

APT and financial attacks on industrial organizations in Q3 2025 | Kaspersky ICS CERT EN

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT and financial attacks on industrial organizations in Q3 2025 | Kaspersky ICS CERT EN

UNC6384 Weaponizes ZDI-CAN-25373 Vulnerability to Deploy PlugX Against Hungarian and Belgian Diplomatic Entities - Arctic Wolf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UNC6384 Weaponizes ZDI-CAN-25373 Vulnerability to Deploy PlugX Against Hungarian and Belgian Diplomatic Entities - Arctic Wolf

PRC-Nexus Espionage Campaign Hijacks Web Traffic to Target Diplomats

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PRC-Nexus Espionage Campaign Hijacks Web Traffic to Target Diplomats

Updated Shadowpad Malware Leads to Ransomware Deployment

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Updated Shadowpad Malware Leads to Ransomware Deployment

Meet NailaoLocker: a ransomware distributed in Europe by ShadowPad and PlugX backdoors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Meet NailaoLocker: a ransomware distributed in Europe by ShadowPad and PlugX backdoors

Updated Shadowpad Malware Leads to Ransomware Deployment

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Updated Shadowpad Malware Leads to Ransomware Deployment

China-linked Espionage Tools Used in Ransomware Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-linked Espionage Tools Used in Ransomware Attacks

CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia

Justice Department and FBI Conduct International Operation to Delete Malware Used by China-Backed Hackers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Justice Department and FBI Conduct International Operation to Delete Malware Used by China-Backed Hackers

Chinese State-Sponsored RedDelta Targeted Taiwan, Mongolia, and Southeast Asia with Adapted PlugX Infection Chain

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese State-Sponsored RedDelta Targeted Taiwan, Mongolia, and Southeast Asia with Adapted PlugX Infection Chain

Unmasking Adversary Infrastructure: How Certificates and Redirects Exposed Earth Baxia and PlugX Activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unmasking Adversary Infrastructure: How Certificates and Redirects Exposed Earth Baxia and PlugX Activity

Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdf

DragonRank, a Chinese-speaking SEO manipulator service provider

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DragonRank, a Chinese-speaking SEO manipulator service provider

Sailing_the_Seven_SEAs_Deep_Dive_into_Polaris_Arsenal_and_Intelligence_Insights.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sailing_the_Seven_SEAs_Deep_Dive_into_Polaris_Arsenal_and_Intelligence_Insights.pdf

China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence

Operation Diplomatic Specter: An Active Chinese Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Diplomatic Specter: An Active Chinese Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia

Finding Malware: Detecting SOGU with Google Security Operations.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Finding Malware: Detecting SOGU with Google Security Operations.

Wirtschaftsspionage gegen Volkwagen: VW-Konzern wurde jahrelang ausge…

Malpedia library date fromORKL

The title opens archive.today, not the publisher’s page. Archived copy on ORKL Detailsfor Wirtschaftsspionage gegen Volkwagen: VW-Konzern wurde jahrelang ausge…

Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks

The Secret Life of RATs: connecting the dots by dissecting multiple backdoors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Secret Life of RATs: connecting the dots by dissecting multiple backdoors

PowerPoint 簡報

Malpedia library date TeamT5 fromORKL

Archived copy on ORKL Detailsfor PowerPoint 簡報

A Look into PlugX Kernel driver

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Look into PlugX Kernel driver

2023 Adversary Infrastructure Report

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023 Adversary Infrastructure Report

Unmasking the Enigma: A Historical Dive into the World of PlugX Malware | Splunk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unmasking the Enigma: A Historical Dive into the World of PlugX Malware | Splunk

Malware development trick - part 36: Enumerate process modules. Simple C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development trick - part 36: Enumerate process modules. Simple C++ example.

Carderbee Targets Hong Kong in Supply Chain Attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Carderbee Targets Hong Kong in Supply Chain Attack

My Tea’s not cold. An overview of China’s cyber threat

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor My Tea’s not cold. An overview of China’s cyber threat

Carderbee: APT Group use Legit Software in Supply Chain Attack Targeting Orgs in Hong Kong

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Carderbee: APT Group use Legit Software in Supply Chain Attack Targeting Orgs in Hong Kong

RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale

The Spies Who Loved You: Infected USB Drives to Steal Secrets | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Spies Who Loved You: Infected USB Drives to Steal Secrets | Mandiant

Chinese Threat Actors Targeting Europe in SmugX Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese Threat Actors Targeting Europe in SmugX Campaign

Lancefly: Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lancefly: Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors

New Mustang Panda’s campaing against Australia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Mustang Panda’s campaing against Australia

Botconf2022-19-FaouCoteCyr.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Botconf2022-19-FaouCoteCyr.pdf

“PortDoor” Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor “PortDoor” Malware

With KEYPLUG, China’s RedGolf Spies On, Steals From Wide Field of Targets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor With KEYPLUG, China’s RedGolf Spies On, Steals From Wide Field of Targets

PlugX Malware Being Distributed via Vulnerability Exploitation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PlugX Malware Being Distributed via Vulnerability Exploitation

Investigating the PlugX Trojan Disguised as a Legitimate Windows Debugger Tool

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Investigating the PlugX Trojan Disguised as a Legitimate Windows Debugger Tool

The Approach of TA413 for Tibetan Targets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Approach of TA413 for Tibetan Targets

Mustang Panda APT Group Uses European Commission-Themed Lure to Deliver PlugX Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mustang Panda APT Group Uses European Commission-Themed Lure to Deliver PlugX Malware

Chinese PlugX Malware Hidden in Your USB Devices?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese PlugX Malware Hidden in Your USB Devices?

JSAC2023_2_LT4.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor JSAC2023_2_LT4.pdf

[QuickNote] Another nice PlugX sample

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor [QuickNote] Another nice PlugX sample

Diving into a PlugX sample of Mustang Panda group

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Diving into a PlugX sample of Mustang Panda group

RedDelta Targets European Government Organizations and Continues to Iterate Custom PlugX Variant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RedDelta Targets European Government Organizations and Continues to Iterate Custom PlugX Variant

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog

Hitching a ride with Mustang Panda

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hitching a ride with Mustang Panda

PlugXローダーの進化

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PlugXローダーの進化

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog

Witchetty: Group Uses Updated Toolset in Attacks on Governments in Middle East

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Witchetty: Group Uses Updated Toolset in Attacks on Governments in Middle East

Hunting for Unsigned DLLs to Find APTs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hunting for Unsigned DLLs to Find APTs

Chinese State-Sponsored Group TA413 Adopts New Capabilities in Pursuit of Tibetan Targets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese State-Sponsored Group TA413 Adopts New Capabilities in Pursuit of Tibetan Targets

Dissecting PlugX to Extract Its Crown Jewels

Malpedia library date Ido Naor fromORKL

Archived copy on ORKL Detailsfor Dissecting PlugX to Extract Its Crown Jewels

New Wave of Espionage Activity Targets Asian Governments

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Wave of Espionage Activity Targets Asian Governments

MustangPanda%20-%20Enemy%20at%20the%20gate_final.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor MustangPanda%20-%20Enemy%20at%20the%20gate_final.pdf

THREAT ANALYSIS REPORT: PlugX RAT Loader Evolution

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor THREAT ANALYSIS REPORT: PlugX RAT Loader Evolution

Targets of Interest | Russian Organizations Increasingly Under Attack By Chinese APTs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Targets of Interest | Russian Organizations Increasingly Under Attack By Chinese APTs

Attacks on industrial control systems using ShadowPad | Kaspersky ICS CERT EN

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attacks on industrial control systems using ShadowPad | Kaspersky ICS CERT EN

Operation Earth Berberoka: An Analysis of a Multivector and Multiplatform APT Campaign Targeting Online Gambling Sites

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Earth Berberoka: An Analysis of a Multivector and Multiplatform APT Campaign Targeting Online Gambling Sites

China-based APT Mustang Panda might still have continued their attack activities against organizations in

Malpedia library date VinCSS fromORKLCCS '25 data

Archived copy on ORKL Detailsfor China-based APT Mustang Panda might still have continued their attack activities against organizations in

Space Pirates: analyzing the tools and connections of a new hacker group

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Space Pirates: analyzing the tools and connections of a new hacker group

HUI Loaderの分析 - JPCERT/CC Eyes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor HUI Loaderの分析 - JPCERT/CC Eyes

AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf

Mustang Panda deploys a new wave of malware targeting Europe

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mustang Panda deploys a new wave of malware targeting Europe

Chinese Naikon Group Back with New Espionage Attack

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Chinese Naikon Group Back with New Espionage Attack

Moshen Dragon’s Triad-and-Error Approach | Abusing Security Software to Sideload PlugX and ShadowPad

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Moshen Dragon’s Triad-and-Error Approach | Abusing Security Software to Sideload PlugX and ShadowPad

The LOTUS PANDA Is Awake, Again. Analysis Of Its Last Strike.

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The LOTUS PANDA Is Awake, Again. Analysis Of Its Last Strike.

Chinese APT Bronze President Mounts Spy Campaign on Russian Military

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese APT Bronze President Mounts Spy Campaign on Russian Military

yir-cyber-threats-annex-download.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor yir-cyber-threats-annex-download.pdf

Botconf2022-40-LunghiHorejsi.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Botconf2022-40-LunghiHorejsi.pdf

https://documents.trendmicro.com/assets/txt/earth-berberoka-windows-iocs-2.txt

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor https://documents.trendmicro.com/assets/txt/earth-berberoka-windows-iocs-2.txt

New APT Group Earth Berberoka Targets Gambling Websites With Old and New Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New APT Group Earth Berberoka Targets Gambling Websites With Old and New Malware

Hacking activity of SectorB Group in 2021 – Red Alert

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hacking activity of SectorB Group in 2021 – Red Alert

Ghidra script to handle stack strings – Max Kersten

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ghidra script to handle stack strings – Max Kersten

Mustang Panda's Hodur : Vieux trucs, nouvelle variante de Korplug

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mustang Panda's Hodur : Vieux trucs, nouvelle variante de Korplug

Chinese APT Combines Fresh Hodur RAT with Complex Anti-Detection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese APT Combines Fresh Hodur RAT with Complex Anti-Detection

New Mustang Panda hacking campaign targets diplomats, ISPs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Mustang Panda hacking campaign targets diplomats, ISPs

Mustang Panda’s Hodur: Old tricks, new Korplug variant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mustang Panda’s Hodur: Old tricks, new Korplug variant

TA416: Activity, Techniques, & Targeting Explained | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TA416: Activity, Techniques, & Targeting Explained | Proofpoint US

Adam Kozy Testimony

Malpedia library date Adam Kozy fromORKL

Archived copy on ORKL Detailsfor Adam Kozy Testimony

A “GULP” of PlugX

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A “GULP” of PlugX

Chinese State-Sponsored Cyber Espionage Activity Supports Expansion of Regional Power and Influence in Southeast Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese State-Sponsored Cyber Espionage Activity Supports Expansion of Regional Power and Influence in Southeast Asia

Threat Spotlight: BlackMatter, LockBit, and THOR - Cisco Umbrella

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Spotlight: BlackMatter, LockBit, and THOR - Cisco Umbrella

Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf

Malpedia library date Kaspersky fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf

Microsoft Word - exorcist whitepaper.docx

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Word - exorcist whitepaper.docx

Aria-Body Loader? Is that you?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Aria-Body Loader? Is that you?

4 Chinese APT Groups Identified Targeting Mail Server of Afghan Telecommunications Firm Roshan

date in the CCS '25 data Recorded Future fromCCS '25 data

The original link failed its last check. Detailsfor 4 Chinese APT Groups Identified Targeting Mail Server of Afghan Telecommunications Firm Roshan

APT_trends_report_Q2_2021_Securelist

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT_trends_report_Q2_2021_Securelist

Indonesian intelligence agency compromised in suspected Chinese hack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Indonesian intelligence agency compromised in suspected Chinese hack

D1T1%20-%20%20ShadowPad%20-%20A%20Masterpiece%20of%20Privately%20Sold%20Malware%20in%20Chinese%20Espionage%20-%20Yi-Jhen%20Hsieh%20&%20Joey%20Chen.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor D1T1%20-%20%20ShadowPad%20-%20A%20Masterpiece%20of%20Privately%20Sold%20Malware%20in%20Chinese%20Espionage%20-%20Yi-Jhen%20Hsieh%20&%20Joey%20Chen.pdf

DeadRinger_ Exposing Chinese Threat Actors Targeting Major Telcos

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor DeadRinger_ Exposing Chinese Threat Actors Targeting Major Telcos

DeadRinger- Exposing Chinese Threat Actors Targeting Major Telcos

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor DeadRinger- Exposing Chinese Threat Actors Targeting Major Telcos

DeadRinger: Exposing Chinese Threat Actors Targeting Major Telcos

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DeadRinger: Exposing Chinese Threat Actors Targeting Major Telcos

THOR: Previously Unseen PlugX Variant Deployed During Microsoft Exchange Server Attacks by PKPLUG Group

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor THOR: Previously Unseen PlugX Variant Deployed During Microsoft Exchange Server Attacks by PKPLUG Group

LuminousMoth – PlugX, File Exfiltration and Persistence Revisited

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor LuminousMoth – PlugX, File Exfiltration and Persistence Revisited

Threat Activity Group RedFoxtrot Linked to China’s PLA Unit 69010; Targets Bordering Asian Countries

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Activity Group RedFoxtrot Linked to China’s PLA Unit 69010; Targets Bordering Asian Countries

RedDelta PlugX Undergoing Changes and Overlapping Again with Mustang Panda PlugX Infrastructure

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedDelta PlugX Undergoing Changes and Overlapping Again with Mustang Panda PlugX Infrastructure

Mustang Panda PlugX - 45.251.240.55 Pivot

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Mustang Panda PlugX - 45.251.240.55 Pivot

PowerPoint 簡報

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PowerPoint 簡報

Chinese Cyberspies Target Military Organizations in Asia With New Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese Cyberspies Target Military Organizations in Asia With New Malware

Chinese Cyberspies Target Military Organizations in Asia With New Malware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Chinese Cyberspies Target Military Organizations in Asia With New Malware

Cyberspies target military organizations with new Nebulae backdoor

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Cyberspies target military organizations with new Nebulae backdoor

Cyberspies target military organizations with new Nebulae backdoor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyberspies target military organizations with new Nebulae backdoor

Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN

Malpedia library date Bitdefender fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN

RedEcho group parks domains after public exposure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RedEcho group parks domains after public exposure

Exchange servers under siege from at least 10 APT groups

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Exchange servers under siege from at least 10 APT groups

China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions

Cyber Threats 2020: A Year in Retrospect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Threats 2020: A Year in Retrospect

Report2021GTR.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Report2021GTR.pdf

Investigation into PlugX Uncovers Unique APT Technique

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Investigation into PlugX Uncovers Unique APT Technique

CRACKING A SOFT CELL IS HARDER THAN YOU THINK

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CRACKING A SOFT CELL IS HARDER THAN YOU THINK

Higaisa or Winnti? APT41 backdoors, old and new

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Higaisa or Winnti? APT41 backdoors, old and new

Microsoft Word - Global Perspective of the SideWinder APT (pre-release final).docx

Malpedia library date AlienVault fromORKLCCS '25 data

The original link failed its last check. Original publisher Detailsfor Microsoft Word - Global Perspective of the SideWinder APT (pre-release final).docx

nao-sec.org-Royal Road ReDive

date in the CCS '25 data nao_sec fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor nao-sec.org-Royal Road ReDive

Royal Road! Re-Dive

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Royal Road! Re-Dive

China's APT hackers move to ransomware attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China's APT hackers move to ransomware attacks

nao-sec.org

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor nao-sec.org

Operation StealthyTrident: corporate software under attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation StealthyTrident: corporate software under attack

APT group targeting governmental agencies in East Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT group targeting governmental agencies in East Asia

Group-IB_Hi-Tech_Crime_Trends_2020-2021_en

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Group-IB_Hi-Tech_Crime_Trends_2020-2021_en

TA416's Golang PlugX Malware Loader | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TA416's Golang PlugX Malware Loader | Proofpoint US

Weaponizing Open Source Software for Targeted Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Weaponizing Open Source Software for Targeted Attacks

APT trends report Q3 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q3 2020

APT41: Indictments Put Chinese Espionage Group in the Spotlight

Malpedia library date Symantec fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT41: Indictments Put Chinese Espionage Group in the Spotlight

Back Despite Disruption: RedDelta Resumes Operations

Malpedia library date Insikt Group® fromORKL

Archived copy on ORKL Detailsfor Back Despite Disruption: RedDelta Resumes Operations

Research Roundup: Activity on Previously Identified APT33 Domains | ThreatConnect

Malpedia library date ThreatConnect fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Research Roundup: Activity on Previously Identified APT33 Domains | ThreatConnect

IT threat evolution Q2 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor IT threat evolution Q2 2020

IT threat evolution Q2 2020

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor IT threat evolution Q2 2020

ESET_Threat_Report_Q22020.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET_Threat_Report_Q22020.pdf

APT trends report Q2 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q2 2020

What even is Winnti? - Risky Business Media

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What even is Winnti? - Risky Business Media

Chinese state hackers target Hong Kong Catholic Church

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese state hackers target Hong Kong Catholic Church

Accenture | Let there be change

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Accenture | Let there be change

Cycldek: Bridging the (air) gap

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cycldek: Bridging the (air) gap

Mustang Panda Recent Activity: Dll-Sideloading trojans with temporal C2 servers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mustang Panda Recent Activity: Dll-Sideloading trojans with temporal C2 servers

Suspected Naikon DGA Domains

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Suspected Naikon DGA Domains

The energy reserves in the Eastern Mediterranean Sea and a malicious campaign of APT10 against Turkey

Malpedia library date Lab52 fromORKLCCS '25 data

Archived copy on ORKL Detailsfor The energy reserves in the Eastern Mediterranean Sea and a malicious campaign of APT10 against Turkey

Naikon’s Aria

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Naikon’s Aria

Naikon’s Aria

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Naikon’s Aria

Naikon APT_ Cyber Espionage Reloaded - Check Point Research

date in the CCS '25 data Check Point fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Naikon APT_ Cyber Espionage Reloaded - Check Point Research

Naikon APT: Cyber Espionage Reloaded

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Naikon APT: Cyber Espionage Reloaded

Naikon APT- Cyber Espionage Reloaded

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Naikon APT- Cyber Espionage Reloaded

COVID-19 Themes Are Being Utilized by Threat Actors of Varying Sophistication

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor COVID-19 Themes Are Being Utilized by Threat Actors of Varying Sophistication

On the Royal Road

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor On the Royal Road

New version of chinoxy backdoor using COVID19 alerts document lure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New version of chinoxy backdoor using COVID19 alerts document lure

Phân tích mã độc lợi dụng dịch Covid-19 để phát tán giả mạo “Chỉ thị của thủ tướng Nguyễn Xuân Phúc” - Phần

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Phân tích mã độc lợi dụng dịch Covid-19 để phát tán giả mạo “Chỉ thị của thủ tướng Nguyễn Xuân Phúc” - Phần

Is APT 27 Abusing COVID-19 To Attack People !

date in the CCS '25 data Yoroi fromCCS '25 data

The original link failed its last check. Detailsfor Is APT 27 Abusing COVID-19 To Attack People !

Vicious Panda: The COVID Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Vicious Panda: The COVID Campaign

using RTF object dimensions to track APT phishing weaponizers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor using RTF object dimensions to track APT phishing weaponizers

Phân tích mã độc lợi dụng dịch Covid-19 để phát tán giả mạo “Chỉ thị của thủ tướng Nguyễn Xuân Phúc” - Phần 1 - VinCSS Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Phân tích mã độc lợi dụng dịch Covid-19 để phát tán giả mạo “Chỉ thị của thủ tướng Nguyễn Xuân Phúc” - Phần 1 - VinCSS Blog

the adversary playbook for the long-standing espionage activity of a Chinese nation-state adversary

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor the adversary playbook for the long-standing espionage activity of a Chinese nation-state adversary

Operation DRBControl: Uncovering a Cyberespionage Campaign Targeting Gambling Companies in Southeast Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation DRBControl: Uncovering a Cyberespionage Campaign Targeting Gambling Companies in Southeast Asia

CLAMBLING - A New Backdoor Base On Dropbox (EN)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CLAMBLING - A New Backdoor Base On Dropbox (EN)

02/12/2020 - Goblin Panda APT: Recent infrastructure and RAT analysis

Malpedia library date MeltX0R Security fromORKLCCS '25 data

Archived copy on ORKL Detailsfor 02/12/2020 - Goblin Panda APT: Recent infrastructure and RAT analysis

nao-sec.org

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor nao-sec.org

An Overhead View of the Royal Road

file creation date fromORKL

Archived copy on ORKL Detailsfor An Overhead View of the Royal Road

Microsoft Word - Threat Intelligence and the Limits of Malware Analysis_smc1.docx

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Word - Threat Intelligence and the Limits of Malware Analysis_smc1.docx

cds19-executive-s08-achievement-unlocked.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor cds19-executive-s08-achievement-unlocked.pdf

Fresh PlugX October 2019

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Fresh PlugX October 2019

APT cases exploiting vulnerabilities in region‑specific software

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT cases exploiting vulnerabilities in region‑specific software

Analytics

Malpedia library date Positive Technologies fromORKLCCS '25 data

The original link failed its last check. Original publisher Detailsfor Analytics

New threat group behind Airbus cyber attacks, claim researchers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New threat group behind Airbus cyber attacks, claim researchers

PKPLUG: Chinese Cyber Espionage Group Attacking Southeast Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PKPLUG: Chinese Cyber Espionage Group Attacking Southeast Asia

Rancor: The Year of The Phish

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rancor: The Year of The Phish

Chinese APT Uses Poison Ivy Malware to Target Government | Proofpoint US

Malpedia library date Proofpoint fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Chinese APT Uses Poison Ivy Malware to Target Government | Proofpoint US

Into the Fog - The Return of ICEFOG APT

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Into the Fog - The Return of ICEFOG APT

Uncovering New Activity By APT10 | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Uncovering New Activity By APT10 | FortiGuard Labs

Goblin Panda continues to target Vietnam

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Goblin Panda continues to target Vietnam

SectorM04 Targeting Singapore – An Analysis – Red Alert

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SectorM04 Targeting Singapore – An Analysis – Red Alert

Accenture Strategy Templates

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Accenture Strategy Templates

Another malicious document with CVE-2017–11882

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Another malicious document with CVE-2017–11882

Là 1937CN hay OceanLotus hay Lazarus …

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Là 1937CN hay OceanLotus hay Lazarus …

Operation Red Signature Targets South Korean Companies

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Red Signature Targets South Korean Companies

Goblin Panda against the Bears

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Goblin Panda against the Bears

Malicious document targets Vietnamese officials

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malicious document targets Vietnamese officials

Malicious document targets Vietnamese officials

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malicious document targets Vietnamese officials

LuckyMouse hits national data center to organize country-level waterholing campaign - Securelist

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor LuckyMouse hits national data center to organize country-level waterholing campaign - Securelist

Malware Analysis – PlugX – Part 2

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Analysis – PlugX – Part 2

Time of death? A therapeutic postmortem of connected medicine

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Time of death? A therapeutic postmortem of connected medicine

Malware Analysis – PlugX

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Analysis – PlugX

PlugXと攻撃者グループ "DragonOK"の関連性 | LAC WATCH

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PlugXと攻撃者グループ "DragonOK"の関連性 | LAC WATCH

JadeRAT mobile surveillanceware spikes in espionage activity

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor JadeRAT mobile surveillanceware spikes in espionage activity

Rehashed RAT Used in APT Campaign Against Vietnamese Organizations

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rehashed RAT Used in APT Campaign Against Vietnamese Organizations

Naikon Targeted Attacks

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Naikon Targeted Attacks

Paranoid PlugX

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Paranoid PlugX

Intrusions Affecting Multiple Victims Across Multiple Sectors | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Intrusions Affecting Multiple Victims Across Multiple Sectors | CISA

RedLeaves - Malware Based on Open Source RAT - JPCERT/CC Eyes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RedLeaves - Malware Based on Open Source RAT - JPCERT/CC Eyes

Unpacking the spyware disguised as antivirus | Malwarebytes Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unpacking the spyware disguised as antivirus | Malwarebytes Labs

ICIT-Brief-China-Espionage-Dynasty

date in the CCS '25 data Debra Obyrne fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ICIT-Brief-China-Espionage-Dynasty

security_report_20160613.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor security_report_20160613.pdf

The Anthem Hack_ All Roads Lead to China - ThreatConnect _ Enterprise Threat Intelligence Platform

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The Anthem Hack_ All Roads Lead to China - ThreatConnect _ Enterprise Threat Intelligence Platform

Know Your Enemies 2.0: A Primer on Advanced Persistent Threat Groups

file creation date ICIT fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Know Your Enemies 2.0: A Primer on Advanced Persistent Threat Groups

Project_CAMERASHY_ThreatConnect_Copyright_2015

date in the CCS '25 data ThreatConnect fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Project_CAMERASHY_ThreatConnect_Copyright_2015

Targeted Attack Distributes PlugX in Russia | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Targeted Attack Distributes PlugX in Russia | Proofpoint US

Uncovering the Seven Pointed Dagger

Malpedia library date Arbor Networks fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Uncovering the Seven Pointed Dagger

The Msnmm Campaigns: The Earliest Naikon APT Campaigns

Malpedia library date Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The Msnmm Campaigns: The Earliest Naikon APT Campaigns

The Naikon APT

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Naikon APT

The Naikon APT

Malpedia library date Kaspersky fromORKLCCS '25 data

Archived copy on ORKL Detailsfor The Naikon APT

The Naikon APT

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The Naikon APT

2015-05-29 -The MsnMM Campaigns - The Earliest Naikon APT Campaigns

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 2015-05-29 -The MsnMM Campaigns - The Earliest Naikon APT Campaigns

The Chronicles of the Hellsing APT: the Empire Strikes Back

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Chronicles of the Hellsing APT: the Empire Strikes Back

The Chronicles Of The Hellsing APT: The Empire Strikes Back

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The Chronicles Of The Hellsing APT: The Empire Strikes Back

The Chronicles of the Hellsing APT- the Empire Strikes Back

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Chronicles of the Hellsing APT- the Empire Strikes Back

Hellsing Indicators Of Compromise

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Hellsing Indicators Of Compromise

Elite cyber crime group strikes back after attack by rival APT gang

Malpedia library date Ars Technica fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Elite cyber crime group strikes back after attack by rival APT gang

The Chronicles of the Hellsing APT_the Empire Strikes Back

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Chronicles of the Hellsing APT_the Empire Strikes Back

Elite cyber crime group strikes back after attack by rival APT gang

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Elite cyber crime group strikes back after attack by rival APT gang

Global Threat Intel Report

Malpedia library date Crowdstrike fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Global Threat Intel Report

Spear Phishing the News Cycle- APT Actors Leverage Interest in the Disappearance of Malaysian Flight MH 370

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Spear Phishing the News Cycle- APT Actors Leverage Interest in the Disappearance of Malaysian Flight MH 370

BKDR_RARSTONE: New RAT to Watch Out For - TrendLabs Security Intelligence Blog

Malpedia library date fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor BKDR_RARSTONE: New RAT to Watch Out For - TrendLabs Security Intelligence Blog