Equation

APT trends report Q2 2022

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q2 2022

Tricephalic_Hellkeeper.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tricephalic_Hellkeeper.pdf

A Fanny Equation - I am your father Stuxnet.pdf

file creation date fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor A Fanny Equation - I am your father Stuxnet.pdf

The_Bvp47_a_top-tier_backdoor_of_us_nsa_equation_group_ii.en.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor The_Bvp47_a_top-tier_backdoor_of_us_nsa_equation_group_ii.en.pdf

Quantum Attack System – NSA -APT-C-40- Hacking Organization High-end Cyber Attack Weapon Technical Analysis Report (I)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Quantum Attack System – NSA -APT-C-40- Hacking Organization High-end Cyber Attack Weapon Technical Analysis Report (I)

Chinese Experts Uncover Details of Equation Group's Bvp47 Covert Hacking Tool

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese Experts Uncover Details of Equation Group's Bvp47 Covert Hacking Tool

NSA-linked Bvp47 Linux backdoor widely undetected for 10 years

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor NSA-linked Bvp47 Linux backdoor widely undetected for 10 years

The Bvp47 - a Top-tier Backdoor of US NSA Equation Group

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Bvp47 - a Top-tier Backdoor of US NSA Equation Group

NSA-linked Bvp47 Linux backdoor widely undetected for 10 years

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor NSA-linked Bvp47 Linux backdoor widely undetected for 10 years

Chinese Experts Uncover Details of Equation Group's Bvp47 Covert Hacking Tool

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Chinese Experts Uncover Details of Equation Group's Bvp47 Covert Hacking Tool

The_Bvp47_a_top-tier_backdoor_of_us_nsa_equation_group.en

date in the CCS '25 data RSA fromCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Detailsfor The_Bvp47_a_top-tier_backdoor_of_us_nsa_equation_group.en

The_Bvp47_a_top-tier_backdoor_of_us_nsa_equation_group.en.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor The_Bvp47_a_top-tier_backdoor_of_us_nsa_equation_group.en.pdf

A Deep Dive into DoubleFeature, Equation Group’s Post-Exploitation Dashboard

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Deep Dive into DoubleFeature, Equation Group’s Post-Exploitation Dashboard

A Deep Dive into DoubleFeature, Equation Group’s Post-Exploitation Dashboard

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor A Deep Dive into DoubleFeature, Equation Group’s Post-Exploitation Dashboard

eset_jumping_the_air_gap_wp

Malpedia library date ESET fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor eset_jumping_the_air_gap_wp

SMB Worm “Indexsinas” Uses Lateral Movement to Infect Whole Networks

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor SMB Worm “Indexsinas” Uses Lateral Movement to Infect Whole Networks

BackdoorDiplomacy: Upgrading from Quarian to Turian

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BackdoorDiplomacy: Upgrading from Quarian to Turian

Glupteba back on track spreading via EternalBlue exploits

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Glupteba back on track spreading via EternalBlue exploits

Glupteba back on track spreading via EternalBlue exploits

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Glupteba back on track spreading via EternalBlue exploits

Sanctioned Firm Accused of Helping Russian Intelligence Was Part of Microsoft’s Early Vuln Access Program — MAPP

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Sanctioned Firm Accused of Helping Russian Intelligence Was Part of Microsoft’s Early Vuln Access Program — MAPP

The Story of Jian - How APT31 Stole and Used an Unknown Equation Group 0-Day - Check Point Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Story of Jian - How APT31 Stole and Used an Unknown Equation Group 0-Day - Check Point Research

research.checkpoint.com-The Story of Jian How APT31 Stole and Used an Unknown Equation Group 0-Day

date in the CCS '25 data Lockheed Martin fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor research.checkpoint.com-The Story of Jian How APT31 Stole and Used an Unknown Equation Group 0-Day

The Story of Jian – How APT31 Stole and Used an Unknown Equation Group 0-Day

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Story of Jian – How APT31 Stole and Used an Unknown Equation Group 0-Day

Voltron STA The curious case of 0xFancyFilter

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Voltron STA The curious case of 0xFancyFilter

China cyber attacks- the current threat landscape

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor China cyber attacks- the current threat landscape

An overview of targeted attacks and APTs on Linux

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor An overview of targeted attacks and APTs on Linux

An overview of targeted attacks and APTs on Linux

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor An overview of targeted attacks and APTs on Linux

Breaking-trust-Shades-of-crisis-across-an-insecure-software-supply-chain.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Breaking-trust-Shades-of-crisis-across-an-insecure-software-supply-chain.pdf

Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices

Lucifer- New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Lucifer- New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices

Nazar- Spirits of the Past

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Nazar- Spirits of the Past

Nazar: Spirits of the Past

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Nazar: Spirits of the Past

Nazar_ Spirits of the Past - Check Point Research

date in the CCS '25 data Check Point fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Nazar_ Spirits of the Past - Check Point Research

Quick look at Nazar's backdoor - Capabilities

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Quick look at Nazar's backdoor - Capabilities

Quick look at Nazar backdoor - Capabilities

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Quick look at Nazar backdoor - Capabilities

Nazar: A Lost Amulet — The Lost Reports

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Nazar: A Lost Amulet — The Lost Reports

Nazar- A Lost Amulet

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Nazar- A Lost Amulet

Microsoft Word - Threat Intelligence and the Limits of Malware Analysis_smc1.docx

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Word - Threat Intelligence and the Limits of Malware Analysis_smc1.docx

Drilling Deep: A Look at Cyberattacks on the Oil and Gas Industry

date in the CCS '25 data Trend Micro fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Drilling Deep: A Look at Cyberattacks on the Oil and Gas Industry

Wikipedia Entry on Equation Group

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Wikipedia Entry on Equation Group

Equation Group

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Equation Group

UPSynergy_ Chinese-American Spy vs. Spy Story

date in the CCS '25 data Check Point fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor UPSynergy_ Chinese-American Spy vs. Spy Story

Threat Group Cards: A Threat Actor Encyclopedia

file creation date ThaiCERT fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Threat Group Cards: A Threat Actor Encyclopedia

Threat Group Cards: A Threat Actor Encyclopedia

file creation date Martijn van der Heide fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia

Buckeye- Espionage Outfit Used Equation Group Tools Prior to Shadow Brokers Leak

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Buckeye- Espionage Outfit Used Equation Group Tools Prior to Shadow Brokers Leak

Buckeye: Espionage Outfit Used Equation Group Tools Prior to Shadow Brokers Leak

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Buckeye: Espionage Outfit Used Equation Group Tools Prior to Shadow Brokers Leak

Buckeye_ Espionage Outfit Used Equation Group Tools Prior to Shadow Brokers Leak

date in the CCS '25 data Symantec fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Buckeye_ Espionage Outfit Used Equation Group Tools Prior to Shadow Brokers Leak

APT Trends report Q2 2017

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT Trends report Q2 2017

Kaspersky’s ‘Slingshot’ report burned an ISIS-focused intelligence operation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Kaspersky’s ‘Slingshot’ report burned an ISIS-focused intelligence operation

Kaspersky's 'Slingshot' report burned an ISIS-focused intelligence operation

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Kaspersky's 'Slingshot' report burned an ISIS-focused intelligence operation

Penquins_Moonlit_Maze_PDF_eng.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Penquins_Moonlit_Maze_PDF_eng.pdf

ShadowBrokers are back demanding nearly $4m and offering 2 dumps per month

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ShadowBrokers are back demanding nearly $4m and offering 2 dumps per month

ShadowBrokers are back demanding nearly $4m and offering 2 dumps per month

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor ShadowBrokers are back demanding nearly $4m and offering 2 dumps per month

Guerrero-Saade-Raiu-VB2017.indd

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Guerrero-Saade-Raiu-VB2017.indd

APT Trends report Q2 2017

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT Trends report Q2 2017

WannaCry ransomware that infected Telefonica and NHS hospitals is spreading aggressively, with over 50,000 attacks so far today

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor WannaCry ransomware that infected Telefonica and NHS hospitals is spreading aggressively, with over 50,000 attacks so far today

WannaCry ransomware that infected Telefonica and NHS hospitals is spreading aggressively, with over 50,000 attacks so far today

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor WannaCry ransomware that infected Telefonica and NHS hospitals is spreading aggressively, with over 50,000 attacks so far today

GitHub - francisck/DanderSpritz_docs: The goal of this project is to examine, reverse, and document the different modules available in the Equation Group's DanderSpritz post-exploitation framework leaked by the ShadowBrokers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GitHub - francisck/DanderSpritz_docs: The goal of this project is to examine, reverse, and document the different modules available in the Equation Group's DanderSpritz post-exploitation framework leaked by the ShadowBrokers

ShadowBrokers Dump More Equation Group Hacks, Auction File Password

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor ShadowBrokers Dump More Equation Group Hacks, Auction File Password

ShadowBrokers Dump More Equation Group Hacks, Auction File Password

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ShadowBrokers Dump More Equation Group Hacks, Auction File Password

EquationDrug rootkit analysis (mstcp32.sys)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor EquationDrug rootkit analysis (mstcp32.sys)

EquationDrug rootkit analysis (mstcp32.sys)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor EquationDrug rootkit analysis (mstcp32.sys)

Kaspersky Security Bulletin 2016. Review of the year. Overall statistics for 2016

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Kaspersky Security Bulletin 2016. Review of the year. Overall statistics for 2016

FROM_EQUATION_TO_EQUATIONS.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor FROM_EQUATION_TO_EQUATIONS.pdf

Remsec driver analysis

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Remsec driver analysis

‘Shadow Brokers’ Whine That Nobody Is Buying Their Hacked NSA Files

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor ‘Shadow Brokers’ Whine That Nobody Is Buying Their Hacked NSA Files

‘Shadow Brokers’ Whine That Nobody Is Buying Their Hacked NSA Files

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ‘Shadow Brokers’ Whine That Nobody Is Buying Their Hacked NSA Files

SECONDDATE in action

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor SECONDDATE in action

A few notes on SECONDDATE's C&C protocol

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor A few notes on SECONDDATE's C&C protocol

Bartholomew-GuerreroSaade-VB2016.indd

Malpedia library date Kaspersky fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Bartholomew-GuerreroSaade-VB2016.indd

TADAQUEOUS moments

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor TADAQUEOUS moments

FEINTCLOUD

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor FEINTCLOUD

BLATSTING FUNKSPIEL

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor BLATSTING FUNKSPIEL

The Shadow Brokers

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Shadow Brokers

The Shadow Brokers

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor The Shadow Brokers

Equation Group firewall operations catalogue

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Equation Group firewall operations catalogue

Know Your Enemies 2.0: A Primer on Advanced Persistent Threat Groups

file creation date ICIT fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Know Your Enemies 2.0: A Primer on Advanced Persistent Threat Groups

ENISA - Threat Landscape - 2015.pdf

file creation date fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor ENISA - Threat Landscape - 2015.pdf

2015年中国高持续性威胁（APT）研究报告

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 2015年中国高持续性威胁（APT）研究报告

Kaspersky - Duqu2 FAQ.pdf

file creation date fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Kaspersky - Duqu2 FAQ.pdf

The_Mystery_of_Duqu_2_0_a_sophisticated_cyberespionage_actor_returns

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The_Mystery_of_Duqu_2_0_a_sophisticated_cyberespionage_actor_returns

Inside the EquationDrug Espionage Platform

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Inside the EquationDrug Espionage Platform

Inside The Equationdrug Espionage Platform

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Inside The Equationdrug Espionage Platform

Inside the EquationDrug Espionage Platform

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Inside the EquationDrug Espionage Platform

Ali Baba, the APT group from the Middle East

Malpedia library date SecurityAffairs fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Ali Baba, the APT group from the Middle East

Ali Baba, the APT group from the Middle East

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Ali Baba, the APT group from the Middle East

A_Fanny_Equation

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor A_Fanny_Equation

Equation: The Death Star of Malware Galaxy

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Equation: The Death Star of Malware Galaxy

blog_equation-the-death-star

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor blog_equation-the-death-star

Equation: The Death Star of Malware Galaxy

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Equation: The Death Star of Malware Galaxy

Equation- The Death Star of Malware Galaxy

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Equation- The Death Star of Malware Galaxy

How “omnipotent” hackers tied to NSA hid for 14 years—and were found at last

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor How “omnipotent” hackers tied to NSA hid for 14 years—and were found at last

How “omnipotent” hackers tied to NSA hid for 14 years—and were found at last

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How “omnipotent” hackers tied to NSA hid for 14 years—and were found at last

Equation Group: Questions And Answers

Malpedia library date Kaspersky fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Equation Group: Questions And Answers

Stuxnet/Duqu: The Evolution of Drivers - Securelist

file creation date Kaspersky fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Stuxnet/Duqu: The Evolution of Drivers - Securelist

A quick analysis of the latest Shadow Brokers dump

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A quick analysis of the latest Shadow Brokers dump

A quick analysis of the latest Shadow Brokers dump

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor A quick analysis of the latest Shadow Brokers dump

stuxnet_0_5_the_missing_link

file creation date Symantec fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor stuxnet_0_5_the_missing_link

The Flame: Questions and Answers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Flame: Questions and Answers

The Flame- Questions and Answers

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Flame- Questions and Answers

Stuxnet

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Stuxnet