APT Explorer

All actors

APT18

Also reported as TG-0416, Wekby, Satin Typhoon, Wisp Team, DYNAMITE PANDA and 24 other names. Linked to China by four sources.

Reports
213
Last reported
Known CVEs
129
Techniques in ATT&CK
12
Origin
China
ID
G0026
Sources
ATT&CKMISPETDAMalpediaMicrosoft
Merge evidence
47 alias matches

Reports per quarter

Dated reports, 2008 Q4 to 2026 Q2.

Techniques seen in the last two years

Show all 38 techniques Show fewer

Counts come from technique IDs in the actor's report text. “Reports only” means reports name the technique but MITRE ATT&CK® does not list it for this actor.

Also listed by ATT&CK

CVEs named in reports

Show all 129 CVEs Show fewer

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

  1. APT 4, Maverick Panda, Wisp Team

    date ORKL added it ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  2. Demonstrating Hustle, Chinese APT Groups Quickly Use Zero-Day Vulnerability (CVE-2015-5119) Following Hacking Team Leak

    date ORKL added it ORKL

    Archived copy on ORKL Details

  3. Ghost RAT (Malware Family)

    date ORKL added it ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  4. CVE-2015-2545: overview of current threats

    date ORKL added it ORKL

    Archived copy on ORKL Details

  5. Anomali | AI Threat Intelligence & Agentic SOC Platform

    date ORKL added it ORKL

    Archived copy on ORKL Details

  6. China-based APT Mustang Panda might still have continued their attack activities against organizations in

    date ORKL added it ORKL

    Archived copy on ORKL Details

  7. Accenture | Let there be change

    date ORKL added it ORKL

    Archived copy on ORKL Details

  8. Old Snake, New Skin: SideWinder APT Activity Analysis 2021 | Group-IB

    date ORKL added it ORKL

    Archived copy on ORKL Details

  9. Definitive Dossier of Devilish Debug Details — Part One: PDB Paths and Malware | Mandiant

    date ORKL added it ORKL

    Archived copy on ORKL Details

  10. Council on Foreign Relations

    date ORKL added it ORKL

    The original link failed its last check. Original publisher Details

Show all 213 reports Show fewer

  1. Evasive Maneuvers by the Wekby Group with Custom ROP-packing and DNS Covert Channels

    date ORKL added it ORKL

    Archived copy on ORKL Details

  2. Staying ahead of threat actors in the age of AI | Microsoft Security Blog

    date ORKL added it ORKL

    Archived copy on ORKL Details

  3. Disrupting malicious uses of AI by state-affiliated threat actors

    date ORKL added it ORKL

    Archived copy on ORKL Details

  4. Threat Group Cards: A Threat Actor Encyclopedia

    date ORKL added it ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  5. Accenture | Let there be change

    date ORKL added it ORKL

    Archived copy on ORKL Details

  6. New Wekby Attacks Use DNS Requests As Command and Control Mechanism

    date ORKL added it ORKL

    Archived copy on ORKL Details

  7. PlugX : Mustang Panda APT

    Malpedia library date ORKL

    Archived copy on ORKL Details

  8. PlugX Meeting Invitation via MSBuild and GDATA

    Malpedia library date ORKL

    Archived copy on ORKL Details

  9. The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor

    Malpedia library date ORKL

    Archived copy on ORKL Details

  10. UNC6384 Weaponizes ZDI-CAN-25373 Vulnerability to Deploy PlugX Against Hungarian and Belgian Diplomatic Entities - Arctic Wolf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  11. PRC-Nexus Espionage Campaign Hijacks Web Traffic to Target Diplomats

    Malpedia library date ORKL

    Archived copy on ORKL Details

  12. Updated Shadowpad Malware Leads to Ransomware Deployment

    Malpedia library date ORKL

    Archived copy on ORKL Details

  13. Meet NailaoLocker: a ransomware distributed in Europe by ShadowPad and PlugX backdoors

    Malpedia library date ORKL

    Archived copy on ORKL Details

  14. Updated Shadowpad Malware Leads to Ransomware Deployment

    Malpedia library date ORKL

    Archived copy on ORKL Details

  15. China-linked Espionage Tools Used in Ransomware Attacks

    Malpedia library date ORKL

    Archived copy on ORKL Details

  16. CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia

    Malpedia library date ORKL

    Archived copy on ORKL Details

  17. Justice Department and FBI Conduct International Operation to Delete Malware Used by China-Backed Hackers

    Malpedia library date ORKL

    Archived copy on ORKL Details

  18. Chinese State-Sponsored RedDelta Targeted Taiwan, Mongolia, and Southeast Asia with Adapted PlugX Infection Chain

    Malpedia library date ORKL

    Archived copy on ORKL Details

  19. Unmasking Adversary Infrastructure: How Certificates and Redirects Exposed Earth Baxia and PlugX Activity

    Malpedia library date ORKL

    Archived copy on ORKL Details

  20. Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  21. DragonRank, a Chinese-speaking SEO manipulator service provider

    Malpedia library date ORKL

    Archived copy on ORKL Details

  22. Sailing_the_Seven_SEAs_Deep_Dive_into_Polaris_Arsenal_and_Intelligence_Insights.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  23. China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence

    Malpedia library date ORKL

    Archived copy on ORKL Details

  24. Operation Diplomatic Specter: An Active Chinese Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia

    Malpedia library date ORKL

    Archived copy on ORKL Details

  25. Finding Malware: Detecting SOGU with Google Security Operations.

    Malpedia library date ORKL

    Archived copy on ORKL Details

  26. Wirtschaftsspionage gegen Volkwagen: VW-Konzern wurde jahrelang ausge…

    Malpedia library date ORKL

    The title opens archive.today, not the publisher’s page. Archived copy on ORKL Details

  27. Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks

    Malpedia library date ORKL

    Archived copy on ORKL Details

  28. Staying ahead of threat actors in the age of AI _ Microsoft Security Blog

    file creation date ORKL

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  29. The Secret Life of RATs: connecting the dots by dissecting multiple backdoors

    Malpedia library date ORKL

    Archived copy on ORKL Details

  30. PowerPoint 簡報

    Malpedia library date TeamT5 ORKL

    Archived copy on ORKL Details

  31. A Look into PlugX Kernel driver

    Malpedia library date ORKL

    Archived copy on ORKL Details

  32. Dark Pink APT unleashes malware for deeper and more sinister intrusions in the Asia-Pacific and Europe _ Group-IB Blog

    file creation date ORKL

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  33. 2023 Adversary Infrastructure Report

    Malpedia library date ORKL

    Archived copy on ORKL Details

  34. Unmasking the Enigma: A Historical Dive into the World of PlugX Malware | Splunk

    Malpedia library date ORKL

    Archived copy on ORKL Details

  35. Carderbee Targets Hong Kong in Supply Chain Attack

    Malpedia library date ORKL

    Archived copy on ORKL Details

  36. My Tea’s not cold. An overview of China’s cyber threat

    Malpedia library date ORKL

    Archived copy on ORKL Details

  37. Carderbee: APT Group use Legit Software in Supply Chain Attack Targeting Orgs in Hong Kong

    Malpedia library date ORKL

    Archived copy on ORKL Details

  38. RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale

    Malpedia library date ORKL

    Archived copy on ORKL Details

  39. The Spies Who Loved You: Infected USB Drives to Steal Secrets | Mandiant

    Malpedia library date ORKL

    Archived copy on ORKL Details

  40. Chinese Threat Actors Targeting Europe in SmugX Campaign

    Malpedia library date ORKL

    Archived copy on ORKL Details

  41. Lancefly: Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors

    Malpedia library date ORKL

    Archived copy on ORKL Details

  42. New Mustang Panda’s campaing against Australia

    Malpedia library date ORKL

    Archived copy on ORKL Details

  43. Botconf2022-19-FaouCoteCyr.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  44. With KEYPLUG, China’s RedGolf Spies On, Steals From Wide Field of Targets

    Malpedia library date ORKL

    Archived copy on ORKL Details

  45. PlugX Malware Being Distributed via Vulnerability Exploitation

    Malpedia library date ORKL

    Archived copy on ORKL Details

  46. Investigating the PlugX Trojan Disguised as a Legitimate Windows Debugger Tool

    Malpedia library date ORKL

    Archived copy on ORKL Details

  47. Mustang Panda APT Group Uses European Commission-Themed Lure to Deliver PlugX Malware

    Malpedia library date ORKL

    Archived copy on ORKL Details

  48. Chinese PlugX Malware Hidden in Your USB Devices?

    Malpedia library date ORKL

    Archived copy on ORKL Details

  49. JSAC2023_2_LT4.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  50. [QuickNote] Another nice PlugX sample

    Malpedia library date ORKL

    Archived copy on ORKL Details

  51. Diving into a PlugX sample of Mustang Panda group

    Malpedia library date ORKL

    Archived copy on ORKL Details

  52. RedDelta Targets European Government Organizations and Continues to Iterate Custom PlugX Variant

    Malpedia library date ORKL

    Archived copy on ORKL Details

  53. Secure Communications Blog

    Malpedia library date ORKL

    Archived copy on ORKL Details

  54. Hitching a ride with Mustang Panda

    Malpedia library date ORKL

    Archived copy on ORKL Details

  55. PlugXローダーの進化

    Malpedia library date ORKL

    Archived copy on ORKL Details

  56. Demonstrating_Hustle

    date ORKL added it ORKL

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  57. APT Group Wekby Leveraging Adobe Flash Exploit (CVE-2015-5119) _ Volexity Blog

    date ORKL added it ORKL

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  58. WarHawk: New APT backdoor from SideWinder | Zscaler

    Malpedia library date ORKL

    Archived copy on ORKL Details

  59. Secure Communications Blog

    Malpedia library date ORKL

    Archived copy on ORKL Details

  60. Witchetty: Group Uses Updated Toolset in Attacks on Governments in Middle East

    Malpedia library date ORKL

    Archived copy on ORKL Details

  61. Hunting for Unsigned DLLs to Find APTs

    Malpedia library date ORKL

    Archived copy on ORKL Details

  62. Dissecting PlugX to Extract Its Crown Jewels

    Malpedia library date Ido Naor ORKL

    Archived copy on ORKL Details

  63. New Wave of Espionage Activity Targets Asian Governments

    Malpedia library date ORKL

    Archived copy on ORKL Details

  64. MustangPanda%20-%20Enemy%20at%20the%20gate_final.pdf

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  65. THREAT ANALYSIS REPORT: PlugX RAT Loader Evolution

    Malpedia library date ORKL

    Archived copy on ORKL Details

  66. Dynamite Panda APT Group - Brandefense

    Malpedia library date ORKL

    Archived copy on ORKL Details

  67. Advanced Persistent Threats (APTs)

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  68. Attacks on industrial control systems using ShadowPad | Kaspersky ICS CERT EN

    Malpedia library date ORKL

    Archived copy on ORKL Details

  69. Operation Earth Berberoka: An Analysis of a Multivector and Multiplatform APT Campaign Targeting Online Gambling Sites

    Malpedia library date ORKL

    Archived copy on ORKL Details

  70. China-based APT Mustang Panda might still have continued their attack activities against organizations in

    Malpedia library date VinCSS ORKLCCS '25 data

    Archived copy on ORKL Details

  71. Space Pirates: analyzing the tools and connections of a new hacker group

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  72. HUI Loaderの分析 - JPCERT/CC Eyes

    Malpedia library date ORKL

    Archived copy on ORKL Details

  73. AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  74. Mustang Panda deploys a new wave of malware targeting Europe

    Malpedia library date ORKL

    Archived copy on ORKL Details

  75. Moshen Dragon’s Triad-and-Error Approach | Abusing Security Software to Sideload PlugX and ShadowPad

    Malpedia library date ORKL

    Archived copy on ORKL Details

  76. Chinese APT Bronze President Mounts Spy Campaign on Russian Military

    Malpedia library date ORKL

    Archived copy on ORKL Details

  77. yir-cyber-threats-annex-download.pdf

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  78. Botconf2022-40-LunghiHorejsi.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  79. https://documents.trendmicro.com/assets/txt/earth-berberoka-windows-iocs-2.txt

    Malpedia library date ORKL

    Archived copy on ORKL Details

  80. New APT Group Earth Berberoka Targets Gambling Websites With Old and New Malware

    Malpedia library date ORKL

    Archived copy on ORKL Details

  81. Hacking activity of SectorB Group in 2021 – Red Alert

    Malpedia library date ORKL

    Archived copy on ORKL Details

  82. Ghidra script to handle stack strings – Max Kersten

    Malpedia library date ORKL

    Archived copy on ORKL Details

  83. Mustang Panda's Hodur : Vieux trucs, nouvelle variante de Korplug

    Malpedia library date ORKL

    Archived copy on ORKL Details

  84. Chinese APT Combines Fresh Hodur RAT with Complex Anti-Detection

    Malpedia library date ORKL

    Archived copy on ORKL Details

  85. New Mustang Panda hacking campaign targets diplomats, ISPs

    Malpedia library date ORKL

    Archived copy on ORKL Details

  86. Mustang Panda’s Hodur: Old tricks, new Korplug variant

    Malpedia library date ORKL

    Archived copy on ORKL Details

  87. Operation Dragon Castling: APT group targeting betting companies

    Malpedia library date ORKL

    Archived copy on ORKL Details

  88. TA416: Activity, Techniques, & Targeting Explained | Proofpoint US

    Malpedia library date ORKL

    Archived copy on ORKL Details

  89. rt-apt41-dual-operation.pdf

    file creation date ORKL

    Archived copy on ORKL Details

  90. Adam Kozy Testimony

    Malpedia library date Adam Kozy ORKL

    Archived copy on ORKL Details

  91. A “GULP” of PlugX

    Malpedia library date ORKL

    Archived copy on ORKL Details

  92. Threat Spotlight: BlackMatter, LockBit, and THOR - Cisco Umbrella

    Malpedia library date ORKL

    Archived copy on ORKL Details

  93. Microsoft Word - exorcist whitepaper.docx

    Malpedia library date ORKL

    Archived copy on ORKL Details

  94. 4 Chinese APT Groups Identified Targeting Mail Server of Afghan Telecommunications Firm Roshan

    date in the CCS '25 data Recorded Future CCS '25 data

    The original link failed its last check. Details

  95. Indonesian intelligence agency compromised in suspected Chinese hack

    Malpedia library date ORKL

    Archived copy on ORKL Details

  96. Advanced Persistent Threats (APTs)

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  97. D1T1%20-%20%20ShadowPad%20-%20A%20Masterpiece%20of%20Privately%20Sold%20Malware%20in%20Chinese%20Espionage%20-%20Yi-Jhen%20Hsieh%20&%20Joey%20Chen.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  98. THOR: Previously Unseen PlugX Variant Deployed During Microsoft Exchange Server Attacks by PKPLUG Group

    Malpedia library date ORKL

    Archived copy on ORKL Details

  99. LuminousMoth – PlugX, File Exfiltration and Persistence Revisited

    Malpedia library date ORKL

    Archived copy on ORKL Details

  100. Threat Activity Group RedFoxtrot Linked to China’s PLA Unit 69010; Targets Bordering Asian Countries

    Malpedia library date ORKL

    Archived copy on ORKL Details

  101. RedDelta PlugX Undergoing Changes and Overlapping Again with Mustang Panda PlugX Infrastructure

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  102. Mustang Panda PlugX - 45.251.240.55 Pivot

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  103. PowerPoint 簡報

    Malpedia library date ORKL

    Archived copy on ORKL Details

  104. RedEcho group parks domains after public exposure

    Malpedia library date ORKL

    Archived copy on ORKL Details

  105. Exchange servers under siege from at least 10 APT groups

    Malpedia library date ORKL

    Archived copy on ORKL Details

  106. China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions

    Malpedia library date ORKL

    Archived copy on ORKL Details

  107. Cyber Threats 2020: A Year in Retrospect

    Malpedia library date ORKL

    Archived copy on ORKL Details

  108. Report2021GTR.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  109. Investigation into PlugX Uncovers Unique APT Technique

    Malpedia library date ORKL

    Archived copy on ORKL Details

  110. CRACKING A SOFT CELL IS HARDER THAN YOU THINK

    Malpedia library date ORKL

    Archived copy on ORKL Details

  111. Higaisa or Winnti? APT41 backdoors, old and new

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  112. China's APT hackers move to ransomware attacks

    Malpedia library date ORKL

    Archived copy on ORKL Details

  113. Operation StealthyTrident: corporate software under attack

    Malpedia library date ORKL

    Archived copy on ORKL Details

  114. APT group targeting governmental agencies in East Asia

    Malpedia library date ORKL

    Archived copy on ORKL Details

  115. TA416's Golang PlugX Malware Loader | Proofpoint US

    Malpedia library date ORKL

    Archived copy on ORKL Details

  116. PowerPoint Presentation

    file creation date Ganesan, Brittany (OS/ASA) (CTR) ORKL

    Archived copy on ORKL Details

  117. Weaponizing Open Source Software for Targeted Attacks

    Malpedia library date ORKL

    Archived copy on ORKL Details

  118. APT trends report Q3 2020

    Malpedia library date ORKL

    Archived copy on ORKL Details

  119. APT41: Indictments Put Chinese Espionage Group in the Spotlight

    Malpedia library date Symantec ORKLCCS '25 data

    Archived copy on ORKL Details

  120. Back Despite Disruption: RedDelta Resumes Operations

    Malpedia library date Insikt Group® ORKL

    Archived copy on ORKL Details

  121. Research Roundup: Activity on Previously Identified APT33 Domains | ThreatConnect

    Malpedia library date ThreatConnect ORKLCCS '25 data

    Archived copy on ORKL Details

  122. ESET_Threat_Report_Q22020.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  123. APT trends report Q2 2020

    Malpedia library date ORKL

    Archived copy on ORKL Details

  124. What even is Winnti? - Risky Business Media

    Malpedia library date ORKL

    Archived copy on ORKL Details

  125. Chinese state hackers target Hong Kong Catholic Church

    Malpedia library date ORKL

    Archived copy on ORKL Details

  126. Accenture | Let there be change

    Malpedia library date ORKL

    Archived copy on ORKL Details

  127. Cycldek: Bridging the (air) gap

    Malpedia library date ORKL

    Archived copy on ORKL Details

  128. Mustang Panda Recent Activity: Dll-Sideloading trojans with temporal C2 servers

    Malpedia library date ORKL

    Archived copy on ORKL Details

  129. The energy reserves in the Eastern Mediterranean Sea and a malicious campaign of APT10 against Turkey

    Malpedia library date Lab52 ORKLCCS '25 data

    Archived copy on ORKL Details

  130. COVID-19 Themes Are Being Utilized by Threat Actors of Varying Sophistication

    Malpedia library date ORKL

    Archived copy on ORKL Details

  131. Phân tích mã độc lợi dụng dịch Covid-19 để phát tán giả mạo “Chỉ thị của thủ tướng Nguyễn Xuân Phúc” - Phần

    Malpedia library date ORKL

    Archived copy on ORKL Details

  132. Is APT 27 Abusing COVID-19 To Attack People !

    date in the CCS '25 data Yoroi CCS '25 data

    The original link failed its last check. Details

  133. Phân tích mã độc lợi dụng dịch Covid-19 để phát tán giả mạo “Chỉ thị của thủ tướng Nguyễn Xuân Phúc” - Phần 1 - VinCSS Blog

    Malpedia library date ORKL

    Archived copy on ORKL Details

  134. the adversary playbook for the long-standing espionage activity of a Chinese nation-state adversary

    Malpedia library date ORKL

    Archived copy on ORKL Details

  135. Operation DRBControl: Uncovering a Cyberespionage Campaign Targeting Gambling Companies in Southeast Asia

    Malpedia library date ORKL

    Archived copy on ORKL Details

  136. CLAMBLING - A New Backdoor Base On Dropbox (EN)

    Malpedia library date ORKL

    Archived copy on ORKL Details

  137. Reviving MuddyC3 Used by MuddyWater (IRAN) APT

    date in the CCS '25 data Shells.Systems ORKLCCS '25 data

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  138. Microsoft Word - Threat Intelligence and the Limits of Malware Analysis_smc1.docx

    Malpedia library date ORKL

    Archived copy on ORKL Details

  139. Fresh PlugX October 2019

    Malpedia library date ORKL

    Archived copy on ORKL Details

  140. APT cases exploiting vulnerabilities in region‑specific software

    Malpedia library date ORKL

    Archived copy on ORKL Details

  141. Analytics

    Malpedia library date Positive Technologies ORKLCCS '25 data

    The original link failed its last check. Original publisher Details

  142. BLOG SERIES_Huge Fan of Your Work

    date in the CCS '25 data Crowdstrike ORKLCCS '25 data

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  143. New threat group behind Airbus cyber attacks, claim researchers

    Malpedia library date ORKL

    Archived copy on ORKL Details

  144. PKPLUG: Chinese Cyber Espionage Group Attacking Southeast Asia

    Malpedia library date ORKL

    Archived copy on ORKL Details

  145. APT41: A Dual Espionage and Cyber Crime Operation

    file creation date FireEye ORKL

    The link to Mirror on Box failed its last check. Mirror on Box Details

  146. Analytics

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  147. Operation-Taskmasters-2019-eng

    date in the CCS '25 data Positive Technologies ORKLCCS '25 data

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  148. APT-41.pdf

    file creation date ORKL

    Archived copy on ORKL Details

  149. report_APT41

    file creation date ORKL

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  150. Into the Fog - The Return of ICEFOG APT

    Malpedia library date ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  151. Uncovering New Activity By APT10 | FortiGuard Labs

    Malpedia library date ORKL

    Archived copy on ORKL Details

  152. SectorM04 Targeting Singapore – An Analysis – Red Alert

    Malpedia library date ORKL

    Archived copy on ORKL Details

  153. Operation Red Signature Targets South Korean Companies

    Malpedia library date ORKL

    Archived copy on ORKL Details

  154. Malicious document targets Vietnamese officials

    Malpedia library date ORKL

    Archived copy on ORKL Details

  155. 20180614_cecreport_vol3.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  156. Malware Analysis – PlugX – Part 2

    Malpedia library date ORKL

    Archived copy on ORKL Details

  157. Time of death? A therapeutic postmortem of connected medicine

    Malpedia library date ORKL

    Archived copy on ORKL Details

  158. Malware Analysis – PlugX

    Malpedia library date ORKL

    Archived copy on ORKL Details

  159. PlugXと攻撃者グループ "DragonOK"の関連性 | LAC WATCH

    Malpedia library date ORKL

    Archived copy on ORKL Details

  160. Advanced Persistent Threat Groups

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  161. Paranoid PlugX

    Malpedia library date ORKL

    Archived copy on ORKL Details

  162. Blog | Arctic Wolf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  163. APT18

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  164. Intrusions Affecting Multiple Victims Across Multiple Sectors | CISA

    Malpedia library date ORKL

    Archived copy on ORKL Details

  165. RedLeaves - Malware Based on Open Source RAT - JPCERT/CC Eyes

    Malpedia library date ORKL

    Archived copy on ORKL Details

  166. HTA-F02-Detecting-and-Responding-to-Advanced-Threats-within-Exchange-Environments.pdf

    file creation date ORKL

    The original link failed its last check. Original publisher Details

  167. DragonOK Updates Toolset and Targets Multiple Geographic Regions

    Malpedia library date ORKL

    Archived copy on ORKL Details

  168. A Tale of Two Targets

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  169. threatconnect-discovers-chinese-apt-activity-in-europe

    date in the CCS '25 data ThreatConnect ORKLCCS '25 data

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  170. Unpacking the spyware disguised as antivirus | Malwarebytes Labs

    Malpedia library date ORKL

    Archived copy on ORKL Details

  171. New Wekby Attacks Use DNS Requests As Command and Control Mechanism - Palo Alto Networks BlogPalo Alto Networks Blog

    file creation date ORKL

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  172. security_report_20160613.pdf

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  173. CVE-2015-2545: overview of current threats - Securelist

    file creation date ORKL

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  174. CVE-2015-2545: overview of current threats

    Malpedia library date ORKL

    Archived copy on ORKL Details

  175. CVE-2015-2545: overview of current threats

    date in the CCS '25 data Kaspersky ORKLCCS '25 data

    The link to Mirror on Box failed its last check. Mirror on Box Details

  176. CVE-2015-2545- overview of current threats

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  177. New Wekby Attacks Use DNS Requests As Command and Control Mechanism

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  178. New Wekby Attacks Use DNS Requests As Command and Control Mechanism

    Malpedia library date ORKL

    Archived copy on ORKL Details

  179. New Wekby Attacks Use DNS Requests As Command and Control Mechanism

    date in the CCS '25 data Palo Alto ORKLCCS '25 data

    The link to Mirror on Box failed its last check. Mirror on Box Details

  180. New Poison Ivy RAT Variant Targets Hong Kong Pro-Democracy Activists - Palo Alto Networks BlogPalo Alto Networks Blog

    date in the CCS '25 data Palo Alto ORKLCCS '25 data

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  181. Ghosts in the Endpoint

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  182. rpt-mtrends-2016.pdf

    file creation date ORKL

    The original link failed its last check. Original publisher Details

  183. Targeted Attack Distributes PlugX in Russia | Proofpoint US

    Malpedia library date ORKL

    Archived copy on ORKL Details

  184. 2015-09-20150911-280-CSIT-15085-NfLog.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  185. HTExploitTelemetry

    Malpedia library date FireEye ORKLCCS '25 data

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  186. Uncovering the Seven Pointed Dagger

    Malpedia library date Arbor Networks ORKLCCS '25 data

    The link to Mirror on Box failed its last check. Mirror on Box Details

  187. Watering Hole Attack on Aerospace Firm Exploits CVE-2015-5122 to Install IsSpace Backdoor

    Malpedia library date ORKL

    Archived copy on ORKL Details

  188. Afghan Government Compromise_ Browser Beware _ Volexity Blog

    date in the CCS '25 data Volexity ORKLCCS '25 data

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  189. Unit 42 Identifies New DragonOK Backdoor Malware Deployed Against Japanese Targets

    Malpedia library date ORKL

    Archived copy on ORKL Details

  190. The Anthem Hack: All Roads Lead to China | ThreatConnect

    Malpedia library date ORKL

    Archived copy on ORKL Details

  191. rpt-m-trends-2015.pdf

    file creation date ORKL

    The original link failed its last check. Original publisher Details

  192. APT Gang Branches Out to Medical Espionage in Community Health Breach

    Malpedia library date ThreatPost ORKLCCS '25 data

    Archived copy on ORKL Details

  193. The Art of Attribution Identifying and Pursuing your Cyber Adversaries

    Malpedia library date ORKL

    Archived copy on ORKL Details

  194. Research, News, and Perspectives

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  195. Who is Samurai Panda

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  196. Samurai Panda | Threat Actor Profile | CrowdStrike

    Malpedia library date ORKL

    Archived copy on ORKL Details

  197. Anchor Panda | Threat Actor Profile | CrowdStrike

    Malpedia library date ORKL

    Archived copy on ORKL Details

  198. Who is Anchor Panda

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  199. BKDR_RARSTONE: New RAT to Watch Out For - TrendLabs Security Intelligence Blog

    Malpedia library date ORKL

    The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Details

  200. APT1: Exposing One of China’s Cyber Espionage Units | Mandiant | FireEye

    file creation date ORKL

    Archived copy on ORKL Details

  201. Mandiant_APT1_Report

    file creation date Mandiant ORKL

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  202. Detecting APT Activity with Network Traffic Analysis

    Malpedia library date ORKL

    Archived copy on ORKL Details

  203. HOW CHINA WILL USE CYBER WARFARE TO LEAPFROG IN MILITARY COMPETITIVENESS

    file creation date Jason Fritz ORKL

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

Newest first. Details opens the report in Explore.