APT17

China-based APT Mustang Panda might still have continued their attack activities against organizations in

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor China-based APT Mustang Panda might still have continued their attack activities against organizations in

FireEye, Microsoft wipe TechNet clean of malware hidden by hackers

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor FireEye, Microsoft wipe TechNet clean of malware hidden by hackers

Threat Spotlight: Group 72

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Threat Spotlight: Group 72

Accenture | Let there be change

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Accenture | Let there be change

Operation Ephemeral Hydra: IE Zero-Day Linked to DeputyDog Uses Diskless Method « Operation Ephemeral Hydra: IE Zero-Day Linked to DeputyDog Uses Diskless Method

date ORKL added it fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor Operation Ephemeral Hydra: IE Zero-Day Linked to DeputyDog Uses Diskless Method « Operation Ephemeral Hydra: IE Zero-Day Linked to DeputyDog Uses Diskless Method

Council on Foreign Relations

date ORKL added it fromORKL

The original link failed its last check. Original publisher Detailsfor Council on Foreign Relations

Definitive Dossier of Devilish Debug Details — Part One: PDB Paths and Malware | Mandiant

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Definitive Dossier of Devilish Debug Details — Part One: PDB Paths and Malware | Mandiant

Axiom, Group 72 - Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Axiom, Group 72 - Threat Group Cards: A Threat Actor Encyclopedia

Operation Aurora

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Operation Aurora

ZXShell (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor ZXShell (Malware Family)

Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia

Winnti Group, Wicked Panda - Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Winnti Group, Wicked Panda - Threat Group Cards: A Threat Actor Encyclopedia

Accenture | Let there be change

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Accenture | Let there be change

Burning Umbrella

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Burning Umbrella

PlugX : Mustang Panda APT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PlugX : Mustang Panda APT

PlugX Meeting Invitation via MSBuild and GDATA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PlugX Meeting Invitation via MSBuild and GDATA

новый модульный бэкдор в госсекторе — Анализ Solar 4RAYS

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor новый модульный бэкдор в госсекторе — Анализ Solar 4RAYS

The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor

UNC6384 Weaponizes ZDI-CAN-25373 Vulnerability to Deploy PlugX Against Hungarian and Belgian Diplomatic Entities - Arctic Wolf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UNC6384 Weaponizes ZDI-CAN-25373 Vulnerability to Deploy PlugX Against Hungarian and Belgian Diplomatic Entities - Arctic Wolf

The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns

PRC-Nexus Espionage Campaign Hijacks Web Traffic to Target Diplomats

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PRC-Nexus Espionage Campaign Hijacks Web Traffic to Target Diplomats

Follow the Smoke | China-nexus Threat Actors Hammer At the Doors of Top Tier Targets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Follow the Smoke | China-nexus Threat Actors Hammer At the Doors of Top Tier Targets

Hunt.io Insights: Gamaredon’s Flux-Like Infrastructure and a Look at Recent ShadowPad Activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hunt.io Insights: Gamaredon’s Flux-Like Infrastructure and a Look at Recent ShadowPad Activity

Operation FishMedley targeting governments, NGOs, and think tanks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation FishMedley targeting governments, NGOs, and think tanks

Updated Shadowpad Malware Leads to Ransomware Deployment

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Updated Shadowpad Malware Leads to Ransomware Deployment

Meet NailaoLocker: a ransomware distributed in Europe by ShadowPad and PlugX backdoors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Meet NailaoLocker: a ransomware distributed in Europe by ShadowPad and PlugX backdoors

Updated Shadowpad Malware Leads to Ransomware Deployment

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Updated Shadowpad Malware Leads to Ransomware Deployment

China-linked Espionage Tools Used in Ransomware Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-linked Espionage Tools Used in Ransomware Attacks

CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia

ScatterBrain: Unmasking the Shadow of PoisonPlug's Obfuscator

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ScatterBrain: Unmasking the Shadow of PoisonPlug's Obfuscator

JSAC2025_1_5_leon-chang_theo-chen_en.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor JSAC2025_1_5_leon-chang_theo-chen_en.pdf

Justice Department and FBI Conduct International Operation to Delete Malware Used by China-Backed Hackers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Justice Department and FBI Conduct International Operation to Delete Malware Used by China-Backed Hackers

Chinese State-Sponsored RedDelta Targeted Taiwan, Mongolia, and Southeast Asia with Adapted PlugX Infection Chain

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese State-Sponsored RedDelta Targeted Taiwan, Mongolia, and Southeast Asia with Adapted PlugX Infection Chain

Unmasking Adversary Infrastructure: How Certificates and Redirects Exposed Earth Baxia and PlugX Activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unmasking Adversary Infrastructure: How Certificates and Redirects Exposed Earth Baxia and PlugX Activity

Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdf

DragonRank, a Chinese-speaking SEO manipulator service provider

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DragonRank, a Chinese-speaking SEO manipulator service provider

Sailing_the_Seven_SEAs_Deep_Dive_into_Polaris_Arsenal_and_Intelligence_Insights.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sailing_the_Seven_SEAs_Deep_Dive_into_Polaris_Arsenal_and_Intelligence_Insights.pdf

APT41 likely compromised Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT41 likely compromised Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike

Italian government agencies and companies in the target of a Chinese APT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Italian government agencies and companies in the target of a Chinese APT

China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence

Operation Diplomatic Specter: An Active Chinese Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Diplomatic Specter: An Active Chinese Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia

Malware Transmutation! - Unveiling the Hidden Traces of BloodAlchemy

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Transmutation! - Unveiling the Hidden Traces of BloodAlchemy

Finding Malware: Detecting SOGU with Google Security Operations.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Finding Malware: Detecting SOGU with Google Security Operations.

Wirtschaftsspionage gegen Volkwagen: VW-Konzern wurde jahrelang ausge…

Malpedia library date fromORKL

The title opens archive.today, not the publisher’s page. Archived copy on ORKL Detailsfor Wirtschaftsspionage gegen Volkwagen: VW-Konzern wurde jahrelang ausge…

Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks

Anxun and Chinese APT Activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Anxun and Chinese APT Activity

Inside The Lab - HarfangLab

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Inside The Lab - HarfangLab

Tracking ShadowPad Infrastructure Via Non-Standard Certificates

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tracking ShadowPad Infrastructure Via Non-Standard Certificates

The Secret Life of RATs: connecting the dots by dissecting multiple backdoors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Secret Life of RATs: connecting the dots by dissecting multiple backdoors

PowerPoint 簡報

Malpedia library date TeamT5 fromORKL

Archived copy on ORKL Detailsfor PowerPoint 簡報

A Look into PlugX Kernel driver

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Look into PlugX Kernel driver

2023 Adversary Infrastructure Report

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023 Adversary Infrastructure Report

Unmasking the Enigma: A Historical Dive into the World of PlugX Malware | Splunk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unmasking the Enigma: A Historical Dive into the World of PlugX Malware | Splunk

Possible supply chain attack targeting South Asian government delivers Shadowpad

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Possible supply chain attack targeting South Asian government delivers Shadowpad

Slides-Possible-supply-chain-attack-targeting-South-Asian-government-delivers-Shadowpad.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Slides-Possible-supply-chain-attack-targeting-South-Asian-government-delivers-Shadowpad.pdf

Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda

Redfly: Espionage Actors Continue to Target Critical Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Redfly: Espionage Actors Continue to Target Critical Infrastructure

Carderbee Targets Hong Kong in Supply Chain Attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Carderbee Targets Hong Kong in Supply Chain Attack

My Tea’s not cold. An overview of China’s cyber threat

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor My Tea’s not cold. An overview of China’s cyber threat

Carderbee: APT Group use Legit Software in Supply Chain Attack Targeting Orgs in Hong Kong

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Carderbee: APT Group use Legit Software in Supply Chain Attack Targeting Orgs in Hong Kong

RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale

Possible Supply Chain Attack Targeting Pakistani Government Delivers Shadowpad

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Possible Supply Chain Attack Targeting Pakistani Government Delivers Shadowpad

The Spies Who Loved You: Infected USB Drives to Steal Secrets | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Spies Who Loved You: Infected USB Drives to Steal Secrets | Mandiant

Chinese Threat Actors Targeting Europe in SmugX Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese Threat Actors Targeting Europe in SmugX Campaign

Lancefly: Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lancefly: Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors

Lancefly- Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Lancefly- Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors

New Mustang Panda’s campaing against Australia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Mustang Panda’s campaing against Australia

Botconf2022-19-FaouCoteCyr.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Botconf2022-19-FaouCoteCyr.pdf

With KEYPLUG, China’s RedGolf Spies On, Steals From Wide Field of Targets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor With KEYPLUG, China’s RedGolf Spies On, Steals From Wide Field of Targets

PlugX Malware Being Distributed via Vulnerability Exploitation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PlugX Malware Being Distributed via Vulnerability Exploitation

Investigating the PlugX Trojan Disguised as a Legitimate Windows Debugger Tool

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Investigating the PlugX Trojan Disguised as a Legitimate Windows Debugger Tool

Update to the REF2924 intrusion set and related campaigns

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Update to the REF2924 intrusion set and related campaigns

Mustang Panda APT Group Uses European Commission-Themed Lure to Deliver PlugX Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mustang Panda APT Group Uses European Commission-Themed Lure to Deliver PlugX Malware

Chinese PlugX Malware Hidden in Your USB Devices?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese PlugX Malware Hidden in Your USB Devices?

JSAC2023_2_LT4.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor JSAC2023_2_LT4.pdf

Security Response - Black Vine Cyberespionage Group.pdf

date ORKL added it fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Security Response - Black Vine Cyberespionage Group.pdf

[QuickNote] Another nice PlugX sample

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor [QuickNote] Another nice PlugX sample

Diving into a PlugX sample of Mustang Panda group

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Diving into a PlugX sample of Mustang Panda group

RedDelta Targets European Government Organizations and Continues to Iterate Custom PlugX Variant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RedDelta Targets European Government Organizations and Continues to Iterate Custom PlugX Variant

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog

Hitching a ride with Mustang Panda

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hitching a ride with Mustang Panda

PlugXローダーの進化

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PlugXローダーの進化

Threat Analysis: Active C2 Discovery Using Protocol Emulation Part3 (ShadowPad)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Analysis: Active C2 Discovery Using Protocol Emulation Part3 (ShadowPad)

VB2022-Tracking-the-entire-iceberg.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor VB2022-Tracking-the-entire-iceberg.pdf

Ruxcon%202015%20-%20McCormack.pdf

date ORKL added it fromORKL

The original link failed its last check. Original publisher Detailsfor Ruxcon%202015%20-%20McCormack.pdf

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research

Witchetty: Group Uses Updated Toolset in Attacks on Governments in Middle East

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Witchetty: Group Uses Updated Toolset in Attacks on Governments in Middle East

Hunting for Unsigned DLLs to Find APTs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hunting for Unsigned DLLs to Find APTs

Tracking the entire iceberg – long‑term APT malware C2 protocol emulation and scanning

Malpedia library date Virus Bulletin fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Tracking the entire iceberg – long‑term APT malware C2 protocol emulation and scanning

Webworm: Espionage Attackers Testing and Using Older Modified RATs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Webworm: Espionage Attackers Testing and Using Older Modified RATs

Dissecting PlugX to Extract Its Crown Jewels

Malpedia library date Ido Naor fromORKL

Archived copy on ORKL Detailsfor Dissecting PlugX to Extract Its Crown Jewels

New Wave of Espionage Activity Targets Asian Governments

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Wave of Espionage Activity Targets Asian Governments

MustangPanda%20-%20Enemy%20at%20the%20gate_final.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor MustangPanda%20-%20Enemy%20at%20the%20gate_final.pdf

THREAT ANALYSIS REPORT: PlugX RAT Loader Evolution

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor THREAT ANALYSIS REPORT: PlugX RAT Loader Evolution

Worok: The big picture

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Worok: The big picture

Attacks on industrial control systems using ShadowPad | Kaspersky ICS CERT EN

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attacks on industrial control systems using ShadowPad | Kaspersky ICS CERT EN

THALES%20THREAT%20HANDBOOK%202022%20Light%20Version_1.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor THALES%20THREAT%20HANDBOOK%202022%20Light%20Version_1.pdf

Operation Earth Berberoka: An Analysis of a Multivector and Multiplatform APT Campaign Targeting Online Gambling Sites

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Earth Berberoka: An Analysis of a Multivector and Multiplatform APT Campaign Targeting Online Gambling Sites

China-based APT Mustang Panda might still have continued their attack activities against organizations in

Malpedia library date VinCSS fromORKLCCS '25 data

Archived copy on ORKL Detailsfor China-based APT Mustang Panda might still have continued their attack activities against organizations in

Space Pirates: analyzing the tools and connections of a new hacker group

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Space Pirates: analyzing the tools and connections of a new hacker group

HUI Loaderの分析 - JPCERT/CC Eyes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor HUI Loaderの分析 - JPCERT/CC Eyes

AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf

Mustang Panda deploys a new wave of malware targeting Europe

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mustang Panda deploys a new wave of malware targeting Europe

Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques

Operation CuckooBees: A Winnti Malware Arsenal Deep-Dive

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation CuckooBees: A Winnti Malware Arsenal Deep-Dive

Moshen Dragon’s Triad-and-Error Approach | Abusing Security Software to Sideload PlugX and ShadowPad

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Moshen Dragon’s Triad-and-Error Approach | Abusing Security Software to Sideload PlugX and ShadowPad

Gamer Cheater Hacker Spy

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Gamer Cheater Hacker Spy

Chinese APT Bronze President Mounts Spy Campaign on Russian Military

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese APT Bronze President Mounts Spy Campaign on Russian Military

yir-cyber-threats-annex-download.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor yir-cyber-threats-annex-download.pdf

Botconf2022-40-LunghiHorejsi.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Botconf2022-40-LunghiHorejsi.pdf

https://documents.trendmicro.com/assets/txt/earth-berberoka-windows-iocs-2.txt

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor https://documents.trendmicro.com/assets/txt/earth-berberoka-windows-iocs-2.txt

New APT Group Earth Berberoka Targets Gambling Websites With Old and New Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New APT Group Earth Berberoka Targets Gambling Websites With Old and New Malware

Hacking activity of SectorB Group in 2021 – Red Alert

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hacking activity of SectorB Group in 2021 – Red Alert

Ghidra script to handle stack strings – Max Kersten

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ghidra script to handle stack strings – Max Kersten

China accused of cyberattacks on Indian power grid

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China accused of cyberattacks on Indian power grid

China-Linked Group TAG-28 Targets India’s “The Times Group” and UIDAI (Aadhaar) Government Agency With Winnti Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-Linked Group TAG-28 Targets India’s “The Times Group” and UIDAI (Aadhaar) Government Agency With Winnti Malware

Unmasking China’s State Hackers

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Unmasking China’s State Hackers

Mustang Panda's Hodur : Vieux trucs, nouvelle variante de Korplug

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mustang Panda's Hodur : Vieux trucs, nouvelle variante de Korplug

Chinese APT Combines Fresh Hodur RAT with Complex Anti-Detection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese APT Combines Fresh Hodur RAT with Complex Anti-Detection

New Mustang Panda hacking campaign targets diplomats, ISPs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Mustang Panda hacking campaign targets diplomats, ISPs

Mustang Panda’s Hodur: Old tricks, new Korplug variant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mustang Panda’s Hodur: Old tricks, new Korplug variant

TA416: Activity, Techniques, & Targeting Explained | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TA416: Activity, Techniques, & Targeting Explained | Proofpoint US

A Realistic Analysis of the Stuxnet Cyber-attack.pdf

file creation date fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor A Realistic Analysis of the Stuxnet Cyber-attack.pdf

2021%20ICS%20OT%20Cybersecurity%20Year%20In%20Review%20-%20Dragos%202021.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2021%20ICS%20OT%20Cybersecurity%20Year%20In%20Review%20-%20Dragos%202021.pdf

rt-apt41-dual-operation.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor rt-apt41-dual-operation.pdf

Adam Kozy Testimony

Malpedia library date Adam Kozy fromORKL

Archived copy on ORKL Detailsfor Adam Kozy Testimony

Researchers Link ShadowPad Malware Attacks to Chinese Ministry and PLA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Researchers Link ShadowPad Malware Attacks to Chinese Ministry and PLA

A “GULP” of PlugX

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A “GULP” of PlugX

Microsoft Word - FLASH TLP WHITE CVE Zoho Desktop Servers v1.4 Updated template

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Microsoft Word - FLASH TLP WHITE CVE Zoho Desktop Servers v1.4 Updated template

Winnti is Coming - Evolution after Prosecution@HITCON2021

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Winnti is Coming - Evolution after Prosecution@HITCON2021

Chasing Shadows: A deep dive into the latest obfuscation methods being used by ShadowPad

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chasing Shadows: A deep dive into the latest obfuscation methods being used by ShadowPad

It’s a BEE! It’s a… no, it’s ShadowPad.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor It’s a BEE! It’s a… no, it’s ShadowPad.

Threat Spotlight: BlackMatter, LockBit, and THOR - Cisco Umbrella

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Spotlight: BlackMatter, LockBit, and THOR - Cisco Umbrella

Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf

Malpedia library date Kaspersky fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf

Microsoft Word - exorcist whitepaper.docx

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Word - exorcist whitepaper.docx

4 Chinese APT Groups Identified Targeting Mail Server of Afghan Telecommunications Firm Roshan

date in the CCS '25 data Recorded Future fromCCS '25 data

The original link failed its last check. Detailsfor 4 Chinese APT Groups Identified Targeting Mail Server of Afghan Telecommunications Firm Roshan

China-Linked Group TAG-28 Targets India’s “The Times Group” and UIDAI (Aadhaar) Government Agency With Winnti Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-Linked Group TAG-28 Targets India’s “The Times Group” and UIDAI (Aadhaar) Government Agency With Winnti Malware

The many tentacles of Magecart Group 8

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The many tentacles of Magecart Group 8

The many tentacles of Magecart Group 8

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The many tentacles of Magecart Group 8

Indonesian intelligence agency compromised in suspected Chinese hack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Indonesian intelligence agency compromised in suspected Chinese hack

D1T1%20-%20%20ShadowPad%20-%20A%20Masterpiece%20of%20Privately%20Sold%20Malware%20in%20Chinese%20Espionage%20-%20Yi-Jhen%20Hsieh%20&%20Joey%20Chen.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor D1T1%20-%20%20ShadowPad%20-%20A%20Masterpiece%20of%20Privately%20Sold%20Malware%20in%20Chinese%20Espionage%20-%20Yi-Jhen%20Hsieh%20&%20Joey%20Chen.pdf

ShadowPad | A Masterpiece of Privately Sold Malware in Chinese Espionage - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ShadowPad | A Masterpiece of Privately Sold Malware in Chinese Espionage - SentinelLabs

us-21-Anatomy-Of-Native-Iis-Malware-wp.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor us-21-Anatomy-Of-Native-Iis-Malware-wp.pdf

THOR: Previously Unseen PlugX Variant Deployed During Microsoft Exchange Server Attacks by PKPLUG Group

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor THOR: Previously Unseen PlugX Variant Deployed During Microsoft Exchange Server Attacks by PKPLUG Group

LuminousMoth – PlugX, File Exfiltration and Persistence Revisited

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor LuminousMoth – PlugX, File Exfiltration and Persistence Revisited

Chinese State-Sponsored Activity Group TAG-22 Targets Nepal, the Philippines, and Taiwan Using Winnti and Other Tooling

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Chinese State-Sponsored Activity Group TAG-22 Targets Nepal, the Philippines, and Taiwan Using Winnti and Other Tooling

Презентация PowerPoint

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Презентация PowerPoint

BIOPASS RAT New Malware Sniffs Victims via Live Streaming

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BIOPASS RAT New Malware Sniffs Victims via Live Streaming

Threat Activity Group RedFoxtrot Linked to China’s PLA Unit 69010; Targets Bordering Asian Countries

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Activity Group RedFoxtrot Linked to China’s PLA Unit 69010; Targets Bordering Asian Countries

Prevailion Blog

Malpedia library date fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor Prevailion Blog

RedDelta PlugX Undergoing Changes and Overlapping Again with Mustang Panda PlugX Infrastructure

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedDelta PlugX Undergoing Changes and Overlapping Again with Mustang Panda PlugX Infrastructure

Mustang Panda PlugX - 45.251.240.55 Pivot

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Mustang Panda PlugX - 45.251.240.55 Pivot

PowerPoint 簡報

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PowerPoint 簡報

the-operations-of-winnti-group.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor the-operations-of-winnti-group.pdf

RedEcho group parks domains after public exposure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RedEcho group parks domains after public exposure

Exchange servers under siege from at least 10 APT groups

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Exchange servers under siege from at least 10 APT groups

China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions

Cyber Threats 2020: A Year in Retrospect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Threats 2020: A Year in Retrospect

Report2021GTR.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Report2021GTR.pdf

Investigation into PlugX Uncovers Unique APT Technique

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Investigation into PlugX Uncovers Unique APT Technique

CRACKING A SOFT CELL IS HARDER THAN YOU THINK

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CRACKING A SOFT CELL IS HARDER THAN YOU THINK

Higaisa or Winnti? APT41 backdoors, old and new

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Higaisa or Winnti? APT41 backdoors, old and new

China's APT hackers move to ransomware attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China's APT hackers move to ransomware attacks

Analyzing APT19 malware using a step-by-step method – CYBER GEEKS

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing APT19 malware using a step-by-step method – CYBER GEEKS

Operation StealthyTrident: corporate software under attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation StealthyTrident: corporate software under attack

APT group targeting governmental agencies in East Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT group targeting governmental agencies in East Asia

TA416's Golang PlugX Malware Loader | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TA416's Golang PlugX Malware Loader | Proofpoint US

Weaponizing Open Source Software for Targeted Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Weaponizing Open Source Software for Targeted Attacks

APT trends report Q3 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q3 2020

Winnti APT group docks in Sri Lanka for new campaign - Malwarebytes Threat Intelligence Report

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Winnti APT group docks in Sri Lanka for new campaign - Malwarebytes Threat Intelligence Report

Palmerworm_ Espionage Gang Targets the Media, Finance, and Other Sectors _ Symantec Blogs

date in the CCS '25 data Symantec fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Palmerworm_ Espionage Gang Targets the Media, Finance, and Other Sectors _ Symantec Blogs

Detecting Threats in Real-time With Active C2 Information

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detecting Threats in Real-time With Active C2 Information

winnti-2020-rus.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor winnti-2020-rus.pdf

APT41: Indictments Put Chinese Espionage Group in the Spotlight

Malpedia library date Symantec fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT41: Indictments Put Chinese Espionage Group in the Spotlight

Back Despite Disruption: RedDelta Resumes Operations

Malpedia library date Insikt Group® fromORKL

Archived copy on ORKL Detailsfor Back Despite Disruption: RedDelta Resumes Operations

Research Roundup: Activity on Previously Identified APT33 Domains | ThreatConnect

Malpedia library date ThreatConnect fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Research Roundup: Activity on Previously Identified APT33 Domains | ThreatConnect

us-20-Chen-Operation-Chimera-APT-Operation-Targets-Semiconductor-Vendors.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor us-20-Chen-Operation-Chimera-APT-Operation-Targets-Semiconductor-Vendors.pdf

ESET_Threat_Report_Q22020.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET_Threat_Report_Q22020.pdf

APT trends report Q2 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q2 2020

What even is Winnti? - Risky Business Media

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What even is Winnti? - Risky Business Media

Chinese state hackers target Hong Kong Catholic Church

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese state hackers target Hong Kong Catholic Church

The Manufacturing Threat Landscape in 2020 | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Manufacturing Threat Landscape in 2020 | CrowdStrike

Accenture | Let there be change

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Accenture | Let there be change

BackDoor.ShadowPad.1 — Dr.Web Malware description library

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BackDoor.ShadowPad.1 — Dr.Web Malware description library

Cycldek: Bridging the (air) gap

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cycldek: Bridging the (air) gap

Mustang Panda Recent Activity: Dll-Sideloading trojans with temporal C2 servers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mustang Panda Recent Activity: Dll-Sideloading trojans with temporal C2 servers

The energy reserves in the Eastern Mediterranean Sea and a malicious campaign of APT10 against Turkey

Malpedia library date Lab52 fromORKLCCS '25 data

Archived copy on ORKL Detailsfor The energy reserves in the Eastern Mediterranean Sea and a malicious campaign of APT10 against Turkey

WINNTI GROUP: Insights From the Past

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor WINNTI GROUP: Insights From the Past

APT41 Using New Speculoos Backdoor to Target Organizations Globally

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT41 Using New Speculoos Backdoor to Target Organizations Globally

정상 인증서에 숨은 섀도 포스, 7년간의 행적 드러나

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor 정상 인증서에 숨은 섀도 포스, 7년간의 행적 드러나

APT41 Initiates Intrusion Campaign Using Multiple Exploits

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT41 Initiates Intrusion Campaign Using Multiple Exploits

COVID-19 Themes Are Being Utilized by Threat Actors of Varying Sophistication

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor COVID-19 Themes Are Being Utilized by Threat Actors of Varying Sophistication

Phân tích mã độc lợi dụng dịch Covid-19 để phát tán giả mạo “Chỉ thị của thủ tướng Nguyễn Xuân Phúc” - Phần

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Phân tích mã độc lợi dụng dịch Covid-19 để phát tán giả mạo “Chỉ thị của thủ tướng Nguyễn Xuân Phúc” - Phần

Is APT 27 Abusing COVID-19 To Attack People !

date in the CCS '25 data Yoroi fromCCS '25 data

The original link failed its last check. Detailsfor Is APT 27 Abusing COVID-19 To Attack People !

Phân tích mã độc lợi dụng dịch Covid-19 để phát tán giả mạo “Chỉ thị của thủ tướng Nguyễn Xuân Phúc” - Phần 1 - VinCSS Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Phân tích mã độc lợi dụng dịch Covid-19 để phát tán giả mạo “Chỉ thị của thủ tướng Nguyễn Xuân Phúc” - Phần 1 - VinCSS Blog

Cyber Threats 2019: A Year in Retrospect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Threats 2019: A Year in Retrospect

the adversary playbook for the long-standing espionage activity of a Chinese nation-state adversary

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor the adversary playbook for the long-standing espionage activity of a Chinese nation-state adversary

Operation DRBControl: Uncovering a Cyberespionage Campaign Targeting Gambling Companies in Southeast Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation DRBControl: Uncovering a Cyberespionage Campaign Targeting Gambling Companies in Southeast Asia

CLAMBLING - A New Backdoor Base On Dropbox (EN)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CLAMBLING - A New Backdoor Base On Dropbox (EN)

Winnti Group targeting universities in Hong Kong

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Winnti Group targeting universities in Hong Kong

Investigativ Berichterstattung und Reportagen

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Investigativ Berichterstattung und Reportagen

nao-sec.org

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor nao-sec.org

Cyber-Reports-2020-01-A-one-sided-Affair.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber-Reports-2020-01-A-one-sided-Affair.pdf

Microsoft Word - Threat Intelligence and the Limits of Malware Analysis_smc1.docx

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Word - Threat Intelligence and the Limits of Malware Analysis_smc1.docx

Rancor: Cyber Espionage Group Uses New Custom Malware to Attack Southeast Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rancor: Cyber Espionage Group Uses New Custom Malware to Attack Southeast Asia

Fresh PlugX October 2019

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Fresh PlugX October 2019

APT cases exploiting vulnerabilities in region‑specific software

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT cases exploiting vulnerabilities in region‑specific software

APT cases exploiting vulnerabilities in region‑specific software

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT cases exploiting vulnerabilities in region‑specific software

Analytics

Malpedia library date Positive Technologies fromORKLCCS '25 data

The original link failed its last check. Original publisher Detailsfor Analytics

New threat group behind Airbus cyber attacks, claim researchers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New threat group behind Airbus cyber attacks, claim researchers

PKPLUG: Chinese Cyber Espionage Group Attacking Southeast Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PKPLUG: Chinese Cyber Espionage Group Attacking Southeast Asia

HELO Winnti_ Attack or Scan

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor HELO Winnti_ Attack or Scan

HELO Winnti- Attack or Scan-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor HELO Winnti- Attack or Scan-

APT41: A Dual Espionage and Cyber Crime Operation

file creation date FireEye fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor APT41: A Dual Espionage and Cyber Crime Operation

GAME OVER: Detecting and Stopping an APT41 Operation | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GAME OVER: Detecting and Stopping an APT41 Operation | Mandiant

APT-41.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor APT-41.pdf

report_APT41

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor report_APT41

TLP-WHITE-CERT-EU-MEMO-190725-1.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor TLP-WHITE-CERT-EU-MEMO-190725-1.pdf

Encore! APT17 hacked Chinese targets and offered the data for sale

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Encore! APT17 hacked Chinese targets and offered the data for sale

Encore! APT17 hacked Chinese targets and offered the data for sale

date in the CCS '25 data Intrusion Truth fromCCS '25 data

Detailsfor Encore! APT17 hacked Chinese targets and offered the data for sale

GitHub - br-data/2019-winnti-analyse: Scripts and rulesets for analysing the Winnti malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GitHub - br-data/2019-winnti-analyse: Scripts and rulesets for analysing the Winnti malware

Winnti: Attacking the Heart of the German Industry

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Winnti: Attacking the Heart of the German Industry

APT17 is run by the Jinan bureau of the Chinese Ministry of State Security

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT17 is run by the Jinan bureau of the Chinese Ministry of State Security

APT17 is run by the Jinan bureau of the Chinese Ministry of State Security

Malpedia library date Intrusion Truth fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT17 is run by the Jinan bureau of the Chinese Ministry of State Security

Into the Fog - The Return of ICEFOG APT

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Into the Fog - The Return of ICEFOG APT

Uncovering New Activity By APT10 | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Uncovering New Activity By APT10 | FortiGuard Labs

Operation ShadowHammer: a high-profile supply chain attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation ShadowHammer: a high-profile supply chain attack

C/C++ Runtime Library Code Tampering in Supply Chain

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor C/C++ Runtime Library Code Tampering in Supply Chain

SectorM04 Targeting Singapore – An Analysis – Red Alert

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SectorM04 Targeting Singapore – An Analysis – Red Alert

“Red October”. Detailed Malware Description 3. Second Stage of Attack

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor “Red October”. Detailed Malware Description 3. Second Stage of Attack

“Red October”. Detailed Malware Description 1. First Stage of Attack

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor “Red October”. Detailed Malware Description 1. First Stage of Attack

“Red October”. Detailed Malware Description 5. Second Stage of Attack

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor “Red October”. Detailed Malware Description 5. Second Stage of Attack

“Red October”. Detailed Malware Description 4. Second Stage of Attack

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor “Red October”. Detailed Malware Description 4. Second Stage of Attack

Operation Red Signature Targets South Korean Companies

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Red Signature Targets South Korean Companies

Operation Red Signature Targets South Korean Companies

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Operation Red Signature Targets South Korean Companies

Chinese Cyberespionage Originating From Tsinghua University Infrastructure

file creation date fromORKL

Archived copy on ORKL Detailsfor Chinese Cyberespionage Originating From Tsinghua University Infrastructure

Chinese Cyberespionage Originating From Tsinghua University Infrastructure

date in the CCS '25 data Recorded Future fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Chinese Cyberespionage Originating From Tsinghua University Infrastructure

Chinese Cyberespionage Originating From Tsinghua University Infrastructure

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Chinese Cyberespionage Originating From Tsinghua University Infrastructure

Malicious document targets Vietnamese officials

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malicious document targets Vietnamese officials

RedAlpha: New Campaigns Discovered Targeting the Tibetan Community

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RedAlpha: New Campaigns Discovered Targeting the Tibetan Community

GitHub - TKCERT/winnti-nmap-script: Nmap Script to scan for Winnti infections

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GitHub - TKCERT/winnti-nmap-script: Nmap Script to scan for Winnti infections

Malware Analysis – PlugX – Part 2

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Analysis – PlugX – Part 2

Burning Umbrella: An Intelligence Report on the Winnti Umbrella and Associated State-Sponsored Attackers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Burning Umbrella: An Intelligence Report on the Winnti Umbrella and Associated State-Sponsored Attackers

Burning Umbrella

date in the CCS '25 data 401TRG fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Burning Umbrella

Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries | Mandiant

Time of death? A therapeutic postmortem of connected medicine

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Time of death? A therapeutic postmortem of connected medicine

GitHub - TKCERT/winnti-detector: Network detector for Winnti malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GitHub - TKCERT/winnti-detector: Network detector for Winnti malware

GitHub - TKCERT/winnti-suricata-lua: Suricata rules to detect Winnti communication

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GitHub - TKCERT/winnti-suricata-lua: Suricata rules to detect Winnti communication

ukatemicrysys_territorialdispute

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ukatemicrysys_territorialdispute

Territorial Dispute - NSA's perspective on APT landscape

date in the CCS '25 data CrySyS Lab fromCCS '25 data

Detailsfor Territorial Dispute - NSA's perspective on APT landscape

Malware Analysis – PlugX

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Analysis – PlugX

PlugXと攻撃者グループ "DragonOK"の関連性 | LAC WATCH

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PlugXと攻撃者グループ "DragonOK"の関連性 | LAC WATCH

Evidence Aurora Operation Still Active: Supply Chain Attack Through CCleaner part2

file creation date Intezer fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Evidence Aurora Operation Still Active: Supply Chain Attack Through CCleaner part2

Evidence Aurora Operation Still Active: Supply Chain Attack Through CCleaner

file creation date Intezer fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Evidence Aurora Operation Still Active: Supply Chain Attack Through CCleaner

Protecting the Software Supply Chain- Deep Insights into the CCleaner Backdoor

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Protecting the Software Supply Chain- Deep Insights into the CCleaner Backdoor

CCleaner Backdoor: Analysis & Recommendations - CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CCleaner Backdoor: Analysis & Recommendations - CrowdStrike

Aurora_Operation_CCleaner_II

date in the CCS '25 data Intezer fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Aurora_Operation_CCleaner_II

Evidence Aurora Operation Still Active Part 2- More Ties Uncovered Between CCleaner Hack & Chinese Hackers

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Evidence Aurora Operation Still Active Part 2- More Ties Uncovered Between CCleaner Hack & Chinese Hackers

Avast Threat Labs analysis of CCleaner incident

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Avast Threat Labs analysis of CCleaner incident

Avast Threat Labs analysis of CCleaner incident

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Avast Threat Labs analysis of CCleaner incident

Evidence Aurora Operation Still Active- Supply Chain Attack Through CCleaner

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Evidence Aurora Operation Still Active- Supply Chain Attack Through CCleaner

Aurora_Operation_CCleaner

date in the CCS '25 data Cisco fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Aurora_Operation_CCleaner

Operation RAT Cook: Chinese APT actors use fake Game of Thrones leaks as lures | Proofpoint

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation RAT Cook: Chinese APT actors use fake Game of Thrones leaks as lures | Proofpoint

Operation RAT Cook- Chinese APT actors use fake Game of Thrones leaks as lures

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Operation RAT Cook- Chinese APT actors use fake Game of Thrones leaks as lures

Operation RAT Cook: Chinese APT actors use fake Game of Thrones leaks as lures | Proofpoint US

Malpedia library date Proofpoint fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Operation RAT Cook: Chinese APT actors use fake Game of Thrones leaks as lures | Proofpoint US

ShadowPad in corporate networks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ShadowPad in corporate networks

Winnti (LEAD/APT17) Evolution - Going Open Source

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Winnti (LEAD/APT17) Evolution - Going Open Source

Winnti Evolution - Going Open Source

date in the CCS '25 data ProtectWise fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Winnti Evolution - Going Open Source

Paranoid PlugX

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Paranoid PlugX

APT17

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT17

Intrusions Affecting Multiple Victims Across Multiple Sectors | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Intrusions Affecting Multiple Victims Across Multiple Sectors | CISA

Examining a Possible Member of the Winnti Group

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Examining a Possible Member of the Winnti Group

Operation Cloud Hopper

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation Cloud Hopper

cloud-hopper-report-final-upda_72977

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor cloud-hopper-report-final-upda_72977

Operation Cloud Hopper

date in the CCS '25 data PWC fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Operation Cloud Hopper

RedLeaves - Malware Based on Open Source RAT - JPCERT/CC Eyes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RedLeaves - Malware Based on Open Source RAT - JPCERT/CC Eyes

Winnti Abuses GitHub for C&C Communications

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Winnti Abuses GitHub for C&C Communications

Unpacking the spyware disguised as antivirus | Malwarebytes Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unpacking the spyware disguised as antivirus | Malwarebytes Labs

ICIT-Brief-China-Espionage-Dynasty

date in the CCS '25 data Debra Obyrne fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ICIT-Brief-China-Espionage-Dynasty

Attack Delivers ‘9002’ Trojan Through Google Drive

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attack Delivers ‘9002’ Trojan Through Google Drive

Please Read

date in the CCS '25 data FireEye and Microsoft fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Please Read

security_report_20160613.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor security_report_20160613.pdf

Ever Present Persistence - Established Footholds Seen in the Wild

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Ever Present Persistence - Established Footholds Seen in the Wild

Ever Present Persistence - Established Footholds Seen in the Wild

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Ever Present Persistence - Established Footholds Seen in the Wild

Suckfly: Revealing the secret life of your code signing certificates

file creation date Symantec fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Suckfly: Revealing the secret life of your code signing certificates

Suckfly: Revealing the secret life of your code signing certificates | Symantec Connect Community

date in the CCS '25 data Symantec fromORKLCCS '25 data

The link to CyberMonitor archive on GitHub failed its last check. CyberMonitor archive on GitHub Detailsfor Suckfly: Revealing the secret life of your code signing certificates | Symantec Connect Community

Endpoint Protection - Symantec Enterprise

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Endpoint Protection - Symantec Enterprise

Know Your Enemies 2.0: A Primer on Advanced Persistent Threat Groups

file creation date ICIT fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Know Your Enemies 2.0: A Primer on Advanced Persistent Threat Groups

Newcomers in the Derusbi family

Malpedia library date fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor Newcomers in the Derusbi family

Revealing the Attack Operations Targeting Japan

date in the CCS '25 data JPCERT fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Revealing the Attack Operations Targeting Japan

I am HDRoot! Part 2

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor I am HDRoot! Part 2

VB2015_Catching_the_silent_whisper

Malpedia library date mpun@fortinet.com, ericleung@fortinet.com, ntan@fortinet.com fromORKL

Archived copy on ORKL Detailsfor VB2015_Catching_the_silent_whisper

I am HDRoot! Part 1

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor I am HDRoot! Part 1

Chinese Actors Use ‘3102’ Malware in Attacks on US Government and EU Media

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese Actors Use ‘3102’ Malware in Attacks on US Government and EU Media

Targeted Attack Distributes PlugX in Russia | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Targeted Attack Distributes PlugX in Russia | Proofpoint US

Uncovering the Seven Pointed Dagger

Malpedia library date Arbor Networks fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Uncovering the Seven Pointed Dagger

The Black Vine Cyberespionage Group

date in the CCS '25 data Symantec fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The Black Vine Cyberespionage Group

Games are over: Winnti is now targeting pharmaceutical companies

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Games are over: Winnti is now targeting pharmaceutical companies

TT Malware Log

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor TT Malware Log

APT17、マイクロソフトの「TechNet」をマルウェア拡散に悪用

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT17、マイクロソフトの「TechNet」をマルウェア拡散に悪用

APT17_Report.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor APT17_Report.pdf

WINNTI Analysis

Malpedia library date Novetta fromORKL

The original link failed its last check. Original publisher Detailsfor WINNTI Analysis

The Anthem Hack: All Roads Lead to China | ThreatConnect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Anthem Hack: All Roads Lead to China | ThreatConnect

Global Threat Intel Report

Malpedia library date Crowdstrike fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Global Threat Intel Report

Operation CloudyOmega: Ichitaro zero-day and ongoing cyberespionage campaign targeting Japan | Symantec Connect

date in the CCS '25 data Symantec fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation CloudyOmega: Ichitaro zero-day and ongoing cyberespionage campaign targeting Japan | Symantec Connect

Microsoft Word - Executive Summary-Final.docx

file creation date Novetta fromORKL

The original link failed its last check. Original publisher Detailsfor Microsoft Word - Executive Summary-Final.docx

Security vendors take action against Hidden Lynx malware

Malpedia library date fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor Security vendors take action against Hidden Lynx malware

Threat Spotlight: Group 72

date in the CCS '25 data Cisco fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Threat Spotlight: Group 72

Security vendors take action against Hidden Lynx malware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Security vendors take action against Hidden Lynx malware

Operation Ephemeral Hydra: IE Zero-Day Linked to DeputyDog Uses Diskless Method | FireEye Blog

file creation date FireEye fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation Ephemeral Hydra: IE Zero-Day Linked to DeputyDog Uses Diskless Method | FireEye Blog

Operation DeputyDog: Zero-Day (CVE-2013-3893) Attack Against Japanese Targets | FireEye Blog

file creation date FireEye fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation DeputyDog: Zero-Day (CVE-2013-3893) Attack Against Japanese Targets | FireEye Blog

The French Connection: French Aerospace-Focused CVE-2014-0322 Attack Shares Similarities with 2012 Capstone Turbine Activity

date in the CCS '25 data Crowdstrike fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor The French Connection: French Aerospace-Focused CVE-2014-0322 Attack Shares Similarities with 2012 Capstone Turbine Activity

The French Connection: French Aerospace-Focused CVE-2014-0322 Attack Shares Similarities with 2012 Capstone Turbine Activity » Adversary Manifesto

date in the CCS '25 data CrowdStrike fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The French Connection: French Aerospace-Focused CVE-2014-0322 Attack Shares Similarities with 2012 Capstone Turbine Activity » Adversary Manifesto

Operation SnowMan: DeputyDog Actor Compromises US Veterans of Foreign Wars Website | FireEye Blog

date in the CCS '25 data FireEye fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation SnowMan: DeputyDog Actor Compromises US Veterans of Foreign Wars Website | FireEye Blog

targeted_attacks_against_the_energy_sector

date in the CCS '25 data Symantec fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor targeted_attacks_against_the_energy_sector

CrowdCasts Monthly: You Have an Adversary Problem

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor CrowdCasts Monthly: You Have an Adversary Problem

Operation DeputyDog: Zero-Day (CVE-2013-3893) Attack Against Japanese Targets

Malpedia library date fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor Operation DeputyDog: Zero-Day (CVE-2013-3893) Attack Against Japanese Targets

Operation DeputyDog- Zero-Day (CVE-2013-3893) Attack Against Japanese Targets

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Operation DeputyDog- Zero-Day (CVE-2013-3893) Attack Against Japanese Targets

Hidden Lynx – Professional Hackers for Hire

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Hidden Lynx – Professional Hackers for Hire

Hidden Lynx – Professional Hackers for Hire

Malpedia library date fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor Hidden Lynx – Professional Hackers for Hire

Hidden Lynx: Professional Hackers For Hire

Malpedia library date Symantec fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Hidden Lynx: Professional Hackers For Hire

BKDR_RARSTONE: New RAT to Watch Out For - TrendLabs Security Intelligence Blog

Malpedia library date fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor BKDR_RARSTONE: New RAT to Watch Out For - TrendLabs Security Intelligence Blog