Threat Group-3390

Ghost RAT (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Ghost RAT (Malware Family)

Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation

Space Pirates: исследуем инструменты и связи новой хакерской группировки

date ORKL added it fromORKL

The original link failed its last check. Original publisher Detailsfor Space Pirates: исследуем инструменты и связи новой хакерской группировки

Oblique RAT (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Oblique RAT (Malware Family)

atomic-red-team/atomics/T1562.002/T1562.002.md at master · redcanaryco/atomic-red-team

date ORKL added it fromORKL

The original link failed its last check. Original publisher Detailsfor atomic-red-team/atomics/T1562.002/T1562.002.md at master · redcanaryco/atomic-red-team

DNS Tunneling: how DNS can be (ab)used by malicious actors

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor DNS Tunneling: how DNS can be (ab)used by malicious actors

METALJACK (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor METALJACK (Malware Family)

elf.wellmess (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor elf.wellmess (Malware Family)

SUNBURST (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor SUNBURST (Malware Family)

Chinese Hackers Carried Out Country-Level Watering Hole Attack

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Chinese Hackers Carried Out Country-Level Watering Hole Attack

CHINACHOPPER (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor CHINACHOPPER (Malware Family)

German government warns of APT27 activity targeting local companies

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor German government warns of APT27 activity targeting local companies

China-based APT Mustang Panda might still have continued their attack activities against organizations in

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor China-based APT Mustang Panda might still have continued their attack activities against organizations in

Emissary Panda, APT 27, LuckyMouse, Bronze Union

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Emissary Panda, APT 27, LuckyMouse, Bronze Union

Cyber Security Research

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research

Accenture | Let there be change

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Accenture | Let there be change

Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia

HyperBro (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor HyperBro (Malware Family)

Likely China-based Attackers Target High-profile Organizations in Southeast Asia

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Likely China-based Attackers Target High-profile Organizations in Southeast Asia

Bitdefender Labs

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Bitdefender Labs

Newly discovered Chinese hacking group hacked 100+ websites to use as “watering holes”

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Newly discovered Chinese hacking group hacked 100+ websites to use as “watering holes”

Definitive Dossier of Devilish Debug Details — Part One: PDB Paths and Malware | Mandiant

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Definitive Dossier of Devilish Debug Details — Part One: PDB Paths and Malware | Mandiant

MimiKatz (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor MimiKatz (Malware Family)

APT trends report Q1 2019

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor APT trends report Q1 2019

TwoFace (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor TwoFace (Malware Family)

ZXShell (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor ZXShell (Malware Family)

Turbine Panda, APT 26, Shell Crew, WebMasters, KungFu Kittens

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Turbine Panda, APT 26, Shell Crew, WebMasters, KungFu Kittens

PlugX (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor PlugX (Malware Family)

PowGoop (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor PowGoop (Malware Family)

Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia

Chinese ‘Space Pirates’ are hacking Russian aerospace firms

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Chinese ‘Space Pirates’ are hacking Russian aerospace firms

China Chopper - Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor China Chopper - Threat Group Cards: A Threat Actor Encyclopedia

Space Pirates Target Russian Aerospace

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Space Pirates Target Russian Aerospace

Budworm: APT Group Uses Updated Custom Tool in Attacks on Government and Telecoms Org

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Budworm: APT Group Uses Updated Custom Tool in Attacks on Government and Telecoms Org

Accenture | Let there be change

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Accenture | Let there be change

Disrupting active exploitation of on-premises SharePoint vulnerabilities

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Disrupting active exploitation of on-premises SharePoint vulnerabilities

Emissary Panda, APT 27, LuckyMouse, Bronze Union

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Emissary Panda, APT 27, LuckyMouse, Bronze Union

Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government

Microsoft discovers threat actor targeting SolarWinds Serv-U software with 0-day exploit | Microsoft Security Blog

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Microsoft discovers threat actor targeting SolarWinds Serv-U software with 0-day exploit | Microsoft Security Blog

PlugX : Mustang Panda APT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PlugX : Mustang Panda APT

GTFire Phishing Scheme: Avoiding Detection Using Google Services | Group-IB Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GTFire Phishing Scheme: Avoiding Detection Using Google Services | Group-IB Blog

PlugX Meeting Invitation via MSBuild and GDATA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PlugX Meeting Invitation via MSBuild and GDATA

Dissecting CrashFix: KongTuke's New Toy

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dissecting CrashFix: KongTuke's New Toy

The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor

New MintsLoader Variant Using Hashtable Obfuscation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New MintsLoader Variant Using Hashtable Obfuscation

Dragons in Thunder

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Dragons in Thunder

UNC6384 Weaponizes ZDI-CAN-25373 Vulnerability to Deploy PlugX Against Hungarian and Belgian Diplomatic Entities - Arctic Wolf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UNC6384 Weaponizes ZDI-CAN-25373 Vulnerability to Deploy PlugX Against Hungarian and Belgian Diplomatic Entities - Arctic Wolf

Phantom Taurus: A New Chinese Nexus APT and the Discovery of the NET-STAR Malware Suite

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Phantom Taurus: A New Chinese Nexus APT and the Discovery of the NET-STAR Malware Suite

PRC-Nexus Espionage Campaign Hijacks Web Traffic to Target Diplomats

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PRC-Nexus Espionage Campaign Hijacks Web Traffic to Target Diplomats

Lost in Translation: Threat Actors Use SEO Poisoning and Fake DeepL Sites to Distribute Gh0st RAT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lost in Translation: Threat Actors Use SEO Poisoning and Fake DeepL Sites to Distribute Gh0st RAT

Disrupting active exploitation of on-premises SharePoint vulnerabilities | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Disrupting active exploitation of on-premises SharePoint vulnerabilities | Microsoft Security Blog

CERTFR-2025-CTI-009.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERTFR-2025-CTI-009.pdf

Cyber%20Threat%20Intelligence%20Report%202025.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber%20Threat%20Intelligence%20Report%202025.pdf

ESET APT Activity Report Q4 2024-Q1 2025

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET APT Activity Report Q4 2024-Q1 2025

(Larva-25003) 웹 서버 대상 IIS 악성코드 유포 사례 - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor (Larva-25003) 웹 서버 대상 IIS 악성코드 유포 사례 - ASEC

MintsLoader Malware Analysis: Multi-Stage Loader Used by TAG-124 and SocGholish

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MintsLoader Malware Analysis: Multi-Stage Loader Used by TAG-124 and SocGholish

Weaver Ant, the Web Shell Whisperer: Tracking a Live China-nexus Operation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Weaver Ant, the Web Shell Whisperer: Tracking a Live China-nexus Operation

Updated Shadowpad Malware Leads to Ransomware Deployment

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Updated Shadowpad Malware Leads to Ransomware Deployment

Meet NailaoLocker: a ransomware distributed in Europe by ShadowPad and PlugX backdoors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Meet NailaoLocker: a ransomware distributed in Europe by ShadowPad and PlugX backdoors

Updated Shadowpad Malware Leads to Ransomware Deployment

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Updated Shadowpad Malware Leads to Ransomware Deployment

China-linked Espionage Tools Used in Ransomware Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-linked Espionage Tools Used in Ransomware Attacks

TAG-124’s Multi-Layered TDS Infrastructure and Extensive User Base

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TAG-124’s Multi-Layered TDS Infrastructure and Extensive User Base

CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia

Justice Department and FBI Conduct International Operation to Delete Malware Used by China-Backed Hackers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Justice Department and FBI Conduct International Operation to Delete Malware Used by China-Backed Hackers

Chinese State-Sponsored RedDelta Targeted Taiwan, Mongolia, and Southeast Asia with Adapted PlugX Infection Chain

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese State-Sponsored RedDelta Targeted Taiwan, Mongolia, and Southeast Asia with Adapted PlugX Infection Chain

Unmasking Adversary Infrastructure: How Certificates and Redirects Exposed Earth Baxia and PlugX Activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unmasking Adversary Infrastructure: How Certificates and Redirects Exposed Earth Baxia and PlugX Activity

Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdf

DragonRank, a Chinese-speaking SEO manipulator service provider

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DragonRank, a Chinese-speaking SEO manipulator service provider

Russian Military Cyber Actors Target US and Global Critical Infrastructure | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Russian Military Cyber Actors Target US and Global Critical Infrastructure | CISA

Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure

file creation date fromORKL

Archived copy on ORKL Detailsfor Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure

Sailing_the_Seven_SEAs_Deep_Dive_into_Polaris_Arsenal_and_Intelligence_Insights.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sailing_the_Seven_SEAs_Deep_Dive_into_Polaris_Arsenal_and_Intelligence_Insights.pdf

Fake Browser Updates Lead to BOINC Volunteer Computing Software | Huntress

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Fake Browser Updates Lead to BOINC Volunteer Computing Software | Huntress

Gootloader’s New Hideout Revealed: The Malware Hunt in WordPress’ Shadows

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Gootloader’s New Hideout Revealed: The Malware Hunt in WordPress’ Shadows

Reverse Engineering Redosdru String Decryption

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Reverse Engineering Redosdru String Decryption

China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence

Operation Diplomatic Specter: An Active Chinese Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Diplomatic Specter: An Active Chinese Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia

Finding Malware: Detecting SOGU with Google Security Operations.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Finding Malware: Detecting SOGU with Google Security Operations.

Wirtschaftsspionage gegen Volkwagen: VW-Konzern wurde jahrelang ausge…

Malpedia library date fromORKL

The title opens archive.today, not the publisher’s page. Archived copy on ORKL Detailsfor Wirtschaftsspionage gegen Volkwagen: VW-Konzern wurde jahrelang ausge…

Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks

The Secret Life of RATs: connecting the dots by dissecting multiple backdoors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Secret Life of RATs: connecting the dots by dissecting multiple backdoors

PowerPoint 簡報

Malpedia library date TeamT5 fromORKL

Archived copy on ORKL Detailsfor PowerPoint 簡報

A Look into PlugX Kernel driver

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Look into PlugX Kernel driver

2023 Adversary Infrastructure Report

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023 Adversary Infrastructure Report

Unmasking the Enigma: A Historical Dive into the World of PlugX Malware | Splunk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unmasking the Enigma: A Historical Dive into the World of PlugX Malware | Splunk

Modern Asia APT groups TTPs

file creation date Kaspersky fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Modern Asia APT groups TTPs

Chinese State-Sponsored Cyber Espionage Activity Targeting Semiconductor Industry in East Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese State-Sponsored Cyber Espionage Activity Targeting Semiconductor Industry in East Asia

Introducing the REF5961 intrusion set

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Introducing the REF5961 intrusion set

Carderbee Targets Hong Kong in Supply Chain Attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Carderbee Targets Hong Kong in Supply Chain Attack

My Tea’s not cold. An overview of China’s cyber threat

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor My Tea’s not cold. An overview of China’s cyber threat

Carderbee: APT Group use Legit Software in Supply Chain Attack Targeting Orgs in Hong Kong

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Carderbee: APT Group use Legit Software in Supply Chain Attack Targeting Orgs in Hong Kong

RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale

Stealth Mode: Chinese Cyber Espionage Actors Continue to Evolve Tactics to Avoid Detection | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Stealth Mode: Chinese Cyber Espionage Actors Continue to Evolve Tactics to Avoid Detection | Mandiant

The Spies Who Loved You: Infected USB Drives to Steal Secrets | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Spies Who Loved You: Infected USB Drives to Steal Secrets | Mandiant

Chinese Threat Actors Targeting Europe in SmugX Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese Threat Actors Targeting Europe in SmugX Campaign

PowerPoint Presentation

file creation date fromORKL

Archived copy on ORKL Detailsfor PowerPoint Presentation

Through the Cortex XDR Lens: Uncovering a New Activity Group Targeting Governments in the Middle East and Africa - Palo Alto Networks Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Through the Cortex XDR Lens: Uncovering a New Activity Group Targeting Governments in the Middle East and Africa - Palo Alto Networks Blog

Lancefly: Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lancefly: Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors

Lancefly- Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Lancefly- Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors

New Mustang Panda’s campaing against Australia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Mustang Panda’s campaing against Australia

Open-Source Gh0st RAT Still Haunting Inboxes 15 Years After Release

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Open-Source Gh0st RAT Still Haunting Inboxes 15 Years After Release

Botconf2022-19-FaouCoteCyr.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Botconf2022-19-FaouCoteCyr.pdf

With KEYPLUG, China’s RedGolf Spies On, Steals From Wide Field of Targets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor With KEYPLUG, China’s RedGolf Spies On, Steals From Wide Field of Targets

APT attacks on industrial organizations in H2 2022 | Kaspersky ICS CERT EN

Malpedia library date Kaspersky fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT attacks on industrial organizations in H2 2022 | Kaspersky ICS CERT EN

PwC Cyber Threats 2022: A Year in Retrospect.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor PwC Cyber Threats 2022: A Year in Retrospect.pdf

PlugX Malware Being Distributed via Vulnerability Exploitation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PlugX Malware Being Distributed via Vulnerability Exploitation

Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting

Iron Tiger's SysUpdate Reappears, Adds Linux Targeting

file creation date Trendmicro fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Iron Tiger's SysUpdate Reappears, Adds Linux Targeting

Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting

Investigating the PlugX Trojan Disguised as a Legitimate Windows Debugger Tool

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Investigating the PlugX Trojan Disguised as a Legitimate Windows Debugger Tool

Dalbit (m00nlight): Chinese Hacker Group's APT Attack Campaign - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dalbit (m00nlight): Chinese Hacker Group's APT Attack Campaign - ASEC

Mustang Panda APT Group Uses European Commission-Themed Lure to Deliver PlugX Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mustang Panda APT Group Uses European Commission-Themed Lure to Deliver PlugX Malware

eset_apt_activity_report_t32022.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eset_apt_activity_report_t32022.pdf

Chinese PlugX Malware Hidden in Your USB Devices?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese PlugX Malware Hidden in Your USB Devices?

JSAC2023_2_LT4.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor JSAC2023_2_LT4.pdf

[QuickNote] Another nice PlugX sample

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor [QuickNote] Another nice PlugX sample

The Mac Malware of 2022

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Mac Malware of 2022

Diving into a PlugX sample of Mustang Panda group

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Diving into a PlugX sample of Mustang Panda group

APT41 — The spy who failed to encrypt me

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT41 — The spy who failed to encrypt me

RedDelta Targets European Government Organizations and Continues to Iterate Custom PlugX Variant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RedDelta Targets European Government Organizations and Continues to Iterate Custom PlugX Variant

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog

Hitching a ride with Mustang Panda

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hitching a ride with Mustang Panda

PlugXローダーの進化

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PlugXローダーの進化

Conceptualizing a Continuum of Cyber Threat Attribution

date ORKL added it fromORKL

The original link failed its last check. Original publisher Detailsfor Conceptualizing a Continuum of Cyber Threat Attribution

APT27 – One Year To Exfiltrate Them All- Intrusion In-Depth Analysis

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT27 – One Year To Exfiltrate Them All- Intrusion In-Depth Analysis

APT27 - One Year To Exfiltrate Them All: Intrusion In-Depth Analysis

Malpedia library date Intrinsec fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT27 - One Year To Exfiltrate Them All: Intrusion In-Depth Analysis

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog

Witchetty: Group Uses Updated Toolset in Attacks on Governments in Middle East

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Witchetty: Group Uses Updated Toolset in Attacks on Governments in Middle East

Hunting for Unsigned DLLs to Find APTs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hunting for Unsigned DLLs to Find APTs

Webworm: Espionage Attackers Testing and Using Older Modified RATs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Webworm: Espionage Attackers Testing and Using Older Modified RATs

Dissecting PlugX to Extract Its Crown Jewels

Malpedia library date Ido Naor fromORKL

Archived copy on ORKL Detailsfor Dissecting PlugX to Extract Its Crown Jewels

New Wave of Espionage Activity Targets Asian Governments

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Wave of Espionage Activity Targets Asian Governments

MustangPanda%20-%20Enemy%20at%20the%20gate_final.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor MustangPanda%20-%20Enemy%20at%20the%20gate_final.pdf

THREAT ANALYSIS REPORT: PlugX RAT Loader Evolution

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor THREAT ANALYSIS REPORT: PlugX RAT Loader Evolution

Threat Analysis Report- PlugX RAT Loader Evolution

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Threat Analysis Report- PlugX RAT Loader Evolution

Cyber Espionage in the South China Sea | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Espionage in the South China Sea | Proofpoint US

Rising Tide- Chasing the Currents of Espionage in the South China Sea

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Rising Tide- Chasing the Currents of Espionage in the South China Sea

Iron Tiger Compromises Chat Application Mimi, Targets Windows, Mac, and Linux Users (IOCs)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Iron Tiger Compromises Chat Application Mimi, Targets Windows, Mac, and Linux Users (IOCs)

Iron Tiger Compromises Chat Application Mimi, Targets Windows, Mac, and Linux Users

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Iron Tiger Compromises Chat Application Mimi, Targets Windows, Mac, and Linux Users

LuckyMouse uses a backdoored Electron app to target MacOS

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor LuckyMouse uses a backdoored Electron app to target MacOS

LuckyMouse uses a backdoored Electron app to target MacOS

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor LuckyMouse uses a backdoored Electron app to target MacOS

LuckyMouse uses a backdoored Electron app to target MacOS - SEKOIA.IO Blog

date in the CCS '25 data SEKOIA fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor LuckyMouse uses a backdoored Electron app to target MacOS - SEKOIA.IO Blog

Iron Tiger Compromises Chat Application Mimi, Targets Windows, Mac, and Linux Users

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Iron Tiger Compromises Chat Application Mimi, Targets Windows, Mac, and Linux Users

Iron Tiger Compromises Chat Application Mimi, Targets Windows, Mac, and Linux Users

date in the CCS '25 data Trend Micro fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Iron Tiger Compromises Chat Application Mimi, Targets Windows, Mac, and Linux Users

Advanced Persistent Threats (APTs)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Advanced Persistent Threats (APTs)

Malicious IIS extensions quietly open persistent backdoors into servers | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malicious IIS extensions quietly open persistent backdoors into servers | Microsoft Security Blog

Attacks on industrial control systems using ShadowPad | Kaspersky ICS CERT EN

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attacks on industrial control systems using ShadowPad | Kaspersky ICS CERT EN

Backdoor via XFF – Mysterious Threat Actor Under Radar

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Backdoor via XFF – Mysterious Threat Actor Under Radar

THALES%20THREAT%20HANDBOOK%202022%20Light%20Version_1.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor THALES%20THREAT%20HANDBOOK%202022%20Light%20Version_1.pdf

Operation Earth Berberoka: An Analysis of a Multivector and Multiplatform APT Campaign Targeting Online Gambling Sites

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Earth Berberoka: An Analysis of a Multivector and Multiplatform APT Campaign Targeting Online Gambling Sites

China-based APT Mustang Panda might still have continued their attack activities against organizations in

Malpedia library date VinCSS fromORKLCCS '25 data

Archived copy on ORKL Detailsfor China-based APT Mustang Panda might still have continued their attack activities against organizations in

Space Pirates analyzing the tools and connections of a new hacker group

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Space Pirates analyzing the tools and connections of a new hacker group

Space Pirates: analyzing the tools and connections of a new hacker group

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Space Pirates: analyzing the tools and connections of a new hacker group

HUI Loaderの分析 - JPCERT/CC Eyes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor HUI Loaderの分析 - JPCERT/CC Eyes

AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf

PowerPoint Presentation

Malpedia library date Hughes, Jennifer fromORKLCCS '25 data

Archived copy on ORKL Detailsfor PowerPoint Presentation

Mustang Panda deploys a new wave of malware targeting Europe

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mustang Panda deploys a new wave of malware targeting Europe

APT_trends_report_Q2_2022_Securelist

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT_trends_report_Q2_2022_Securelist

Moshen Dragon’s Triad-and-Error Approach | Abusing Security Software to Sideload PlugX and ShadowPad

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Moshen Dragon’s Triad-and-Error Approach | Abusing Security Software to Sideload PlugX and ShadowPad

Chinese APT Bronze President Mounts Spy Campaign on Russian Military

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese APT Bronze President Mounts Spy Campaign on Russian Military

yir-cyber-threats-annex-download.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor yir-cyber-threats-annex-download.pdf

Botconf2022-40-LunghiHorejsi.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Botconf2022-40-LunghiHorejsi.pdf

https://documents.trendmicro.com/assets/txt/earth-berberoka-windows-iocs-2.txt

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor https://documents.trendmicro.com/assets/txt/earth-berberoka-windows-iocs-2.txt

APT trends report Q1 2022

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q1 2022

New APT Group Earth Berberoka Targets Gambling Websites With Old and New Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New APT Group Earth Berberoka Targets Gambling Websites With Old and New Malware

Blog |Top 10 Malware March 2022

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Blog |Top 10 Malware March 2022

Hacking activity of SectorB Group in 2021 – Red Alert

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hacking activity of SectorB Group in 2021 – Red Alert

Ghidra script to handle stack strings – Max Kersten

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ghidra script to handle stack strings – Max Kersten

Chinese Hackers Target VMware Horizon Servers with Log4Shell to Deploy Rootkit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese Hackers Target VMware Horizon Servers with Log4Shell to Deploy Rootkit

State-sponsored Attack Groups Capitalise on Russia-Ukraine War for Cyber Espionage

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor State-sponsored Attack Groups Capitalise on Russia-Ukraine War for Cyber Espionage

State-sponsored Attack Groups Capitalise on Russia-Ukraine War for Cyber Espionage

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor State-sponsored Attack Groups Capitalise on Russia-Ukraine War for Cyber Espionage

New Milestones for Deep Panda: Log4Shell and Digitally Signed Fire Chili Rootkits

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Milestones for Deep Panda: Log4Shell and Digitally Signed Fire Chili Rootkits

Mustang Panda's Hodur : Vieux trucs, nouvelle variante de Korplug

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mustang Panda's Hodur : Vieux trucs, nouvelle variante de Korplug

Chinese APT Combines Fresh Hodur RAT with Complex Anti-Detection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese APT Combines Fresh Hodur RAT with Complex Anti-Detection

New Mustang Panda hacking campaign targets diplomats, ISPs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Mustang Panda hacking campaign targets diplomats, ISPs

Mustang Panda’s Hodur: Old tricks, new Korplug variant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mustang Panda’s Hodur: Old tricks, new Korplug variant

Gh0stCringe RAT Being Distributed to Vulnerable Database Servers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Gh0stCringe RAT Being Distributed to Vulnerable Database Servers

TA416: Activity, Techniques, & Targeting Explained | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TA416: Activity, Techniques, & Targeting Explained | Proofpoint US

New -SockDetour- Fileless, Socketless Backdoor Targets U.S. Defense Contractors

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New -SockDetour- Fileless, Socketless Backdoor Targets U.S. Defense Contractors

SockDetour – a Silent, Fileless, Socketless Backdoor – Targets U.S. Defense Contractors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SockDetour – a Silent, Fileless, Socketless Backdoor – Targets U.S. Defense Contractors

SockDetour Backdoor Targets U.S. Defense Contractors

date in the CCS '25 data palo alto networks fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor SockDetour Backdoor Targets U.S. Defense Contractors

SockDetour - a Silent Fileless Socketless Backdoor - Targets US Defense Contractors

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor SockDetour - a Silent Fileless Socketless Backdoor - Targets US Defense Contractors

Defense contractors hit by stealthy SockDetour Windows backdoor

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Defense contractors hit by stealthy SockDetour Windows backdoor

Adam Kozy Testimony

Malpedia library date Adam Kozy fromORKL

Archived copy on ORKL Detailsfor Adam Kozy Testimony

Red Cross blames hack on Zoho vulnerability, suspects APT attack

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Red Cross blames hack on Zoho vulnerability, suspects APT attack

The APT Fallout of Vulnerabilities such as ProxyLogon, OGNL Injection, and log4shell

date in the title HVS Consulting fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The APT Fallout of Vulnerabilities such as ProxyLogon, OGNL Injection, and log4shell

The APT Fallout of Vulnerabilities such as ProxyLogon, OGNL Injection, and log4shell

date in the CCS '25 data HVS Consulting fromCCS '25 data

Detailsfor The APT Fallout of Vulnerabilities such as ProxyLogon, OGNL Injection, and log4shell

Threat Roundup for February 4 to February 11

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Roundup for February 4 to February 11

APT27 Group Targets German Organizations with HyperBro

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT27 Group Targets German Organizations with HyperBro

404: This page could not be found.

Malpedia library date Cyware fromORKLCCS '25 data

Archived copy on ORKL Detailsfor 404: This page could not be found.

What We Can Do against the Chaotic A41APT Campaign（公開版）

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What We Can Do against the Chaotic A41APT Campaign（公開版）

German govt warns of APT27 hackers backdooring business networks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor German govt warns of APT27 hackers backdooring business networks

German govt warns of APT27 hackers backdooring business networks

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor German govt warns of APT27 hackers backdooring business networks

BfV Cyber-Brief Nr. 01/2022

Malpedia library date BfV fromORKL

Archived copy on ORKL Detailsfor BfV Cyber-Brief Nr. 01/2022

BfV Cyber-Brief Nr. 01/2022

date in the CCS '25 data BfV fromCCS '25 data

The link to Mirror on Box failed its last check. Detailsfor BfV Cyber-Brief Nr. 01/2022

A “GULP” of PlugX

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A “GULP” of PlugX

Tropic Trooper Targets Transportation and Government Organizations

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tropic Trooper Targets Transportation and Government Organizations

Full Spectrum Detections for 5 Popular Web Shells: Alfa, SharPyShell, Krypton, ASPXSpy, and TWOFACE

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Full Spectrum Detections for 5 Popular Web Shells: Alfa, SharPyShell, Krypton, ASPXSpy, and TWOFACE

APT Expands Attack on ManageEngine With Active Campaign Against ServiceDesk Plus

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT Expands Attack on ManageEngine With Active Campaign Against ServiceDesk Plus

APT Expands Attack on ManageEngine With Active Campaign Against ServiceDesk Plus

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT Expands Attack on ManageEngine With Active Campaign Against ServiceDesk Plus

BlackTech, an East Asian hacking group, has launched attacks in sectors such as finance and education

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor BlackTech, an East Asian hacking group, has launched attacks in sectors such as finance and education

Threat Spotlight: BlackMatter, LockBit, and THOR - Cisco Umbrella

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Spotlight: BlackMatter, LockBit, and THOR - Cisco Umbrella

Threat actor DEV-0322 exploiting ZOHO ManageEngine ADSelfService Plus

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Threat actor DEV-0322 exploiting ZOHO ManageEngine ADSelfService Plus

TA505 exploits SolarWinds Serv-U vulnerability (CVE-2021-35211) for initial access

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TA505 exploits SolarWinds Serv-U vulnerability (CVE-2021-35211) for initial access

TA505 exploits SolarWinds Serv-U vulnerability (CVE-2021-35211) for initial access – NCC Group Research

date in the CCS '25 data NCC Group fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor TA505 exploits SolarWinds Serv-U vulnerability (CVE-2021-35211) for initial access – NCC Group Research

TA505 exploits SolarWinds Serv-U vulnerability (CVE-2021-35211) for initial access

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor TA505 exploits SolarWinds Serv-U vulnerability (CVE-2021-35211) for initial access

Targeted Attack Campaign Against ManageEngine ADSelfService Plus Delivers Godzilla Webshells, NGLite Trojan and KdcSponge Stealer

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Targeted Attack Campaign Against ManageEngine ADSelfService Plus Delivers Godzilla Webshells, NGLite Trojan and KdcSponge Stealer

Targeted Attack Campaign Against ManageEngine ADSelfService Plus Delivers Godzilla Webshells, NGLite Trojan and KdcSponge Stealer

date in the CCS '25 data PaloAlto fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Targeted Attack Campaign Against ManageEngine ADSelfService Plus Delivers Godzilla Webshells, NGLite Trojan and KdcSponge Stealer

Targeted Attack Campaign Against ManageEngine ADSelfService Plus Delivers Godzilla Webshells, NGLite Trojan and KdcSponge Stealer

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Targeted Attack Campaign Against ManageEngine ADSelfService Plus Delivers Godzilla Webshells, NGLite Trojan and KdcSponge Stealer

Microsoft Exchange vulnerabilities exploited once again for ransomware, this time with Babuk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Exchange vulnerabilities exploited once again for ransomware, this time with Babuk

Microsoft Word - exorcist whitepaper.docx

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Word - exorcist whitepaper.docx

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog

Malware Gh0stTimes Used by BlackTech - JPCERT/CC Eyes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Gh0stTimes Used by BlackTech - JPCERT/CC Eyes

GhostEmperor- From ProxyLogon to kernel mode

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor GhostEmperor- From ProxyLogon to kernel mode

GhostEmperor: From ProxyLogon to kernel mode

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GhostEmperor: From ProxyLogon to kernel mode

4 Chinese APT Groups Identified Targeting Mail Server of Afghan Telecommunications Firm Roshan

date in the CCS '25 data Recorded Future fromCCS '25 data

The original link failed its last check. Detailsfor 4 Chinese APT Groups Identified Targeting Mail Server of Afghan Telecommunications Firm Roshan

Ransomware Hackers Attack a Top Safety Testing Org. Using Tactics and Techniques Borrowed from Chinese Espionage Groups

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware Hackers Attack a Top Safety Testing Org. Using Tactics and Techniques Borrowed from Chinese Espionage Groups

Indonesian intelligence agency compromised in suspected Chinese hack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Indonesian intelligence agency compromised in suspected Chinese hack

Advanced Persistent Threats (APTs)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Advanced Persistent Threats (APTs)

A deep-dive into the SolarWinds Serv-U SSH vulnerability (DEV-0322)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor A deep-dive into the SolarWinds Serv-U SSH vulnerability (DEV-0322)

D1T1%20-%20%20ShadowPad%20-%20A%20Masterpiece%20of%20Privately%20Sold%20Malware%20in%20Chinese%20Espionage%20-%20Yi-Jhen%20Hsieh%20&%20Joey%20Chen.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor D1T1%20-%20%20ShadowPad%20-%20A%20Masterpiece%20of%20Privately%20Sold%20Malware%20in%20Chinese%20Espionage%20-%20Yi-Jhen%20Hsieh%20&%20Joey%20Chen.pdf

UNC215_ Spotlight on a Chinese Espionage Campaign in Israel _ FireEye Inc

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor UNC215_ Spotlight on a Chinese Espionage Campaign in Israel _ FireEye Inc

UNC215: Spotlight on a Chinese Espionage Campaign in Israel | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UNC215: Spotlight on a Chinese Espionage Campaign in Israel | Mandiant

UNC215- Spotlight on a Chinese Espionage Campaign in Israel

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor UNC215- Spotlight on a Chinese Espionage Campaign in Israel

DeadRinger_ Exposing Chinese Threat Actors Targeting Major Telcos

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor DeadRinger_ Exposing Chinese Threat Actors Targeting Major Telcos

DeadRinger- Exposing Chinese Threat Actors Targeting Major Telcos

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor DeadRinger- Exposing Chinese Threat Actors Targeting Major Telcos

DeadRinger: Exposing Chinese Threat Actors Targeting Major Telcos

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DeadRinger: Exposing Chinese Threat Actors Targeting Major Telcos

THOR: Previously Unseen PlugX Variant Deployed During Microsoft Exchange Server Attacks by PKPLUG Group

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor THOR: Previously Unseen PlugX Variant Deployed During Microsoft Exchange Server Attacks by PKPLUG Group

LuminousMoth – PlugX, File Exfiltration and Persistence Revisited

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor LuminousMoth – PlugX, File Exfiltration and Persistence Revisited

Ongoing Campaign Leveraging Exchange Vulnerability Potentially Linked to Iran

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Ongoing Campaign Leveraging Exchange Vulnerability Potentially Linked to Iran

Old trees and new flowers- Analysis of the new version of KGH spy components used by Kimsuky

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Old trees and new flowers- Analysis of the new version of KGH spy components used by Kimsuky

Triage analysis of Serv-U FTP user backdoor deployed by CVE-2021-35211 (DEV-0322)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Triage analysis of Serv-U FTP user backdoor deployed by CVE-2021-35211 (DEV-0322)

Attacks Against the Government Sector (White Paper)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attacks Against the Government Sector (White Paper)

Microsoft discovers threat actor (DEV-0322) targeting SolarWinds Serv-U software with 0-day exploit

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Microsoft discovers threat actor (DEV-0322) targeting SolarWinds Serv-U software with 0-day exploit

Kimsuky APT organization's targeted attacks on South Korean defense and security related departments

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Kimsuky APT organization's targeted attacks on South Korean defense and security related departments

Threat Activity Group RedFoxtrot Linked to China’s PLA Unit 69010; Targets Bordering Asian Countries

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Activity Group RedFoxtrot Linked to China’s PLA Unit 69010; Targets Bordering Asian Countries

Evilnum organizes recent attacks against European financial companies

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Evilnum organizes recent attacks against European financial companies

BackdoorDiplomacy: Upgrading from Quarian to Turian

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BackdoorDiplomacy: Upgrading from Quarian to Turian

eset_threat_report_t12021.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eset_threat_report_t12021.pdf

SSTIC2021-Article-Taking_Advantage_of_PE_Metadata_or_How_To_Complete_your_Favorite_Threat_Actor_Sample_Collection-lunghi.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SSTIC2021-Article-Taking_Advantage_of_PE_Metadata_or_How_To_Complete_your_Favorite_Threat_Actor_Sample_Collection-lunghi.pdf

Analysis of Lazarus's recent targeted attacks against military industry and other industries

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Analysis of Lazarus's recent targeted attacks against military industry and other industries

RedDelta PlugX Undergoing Changes and Overlapping Again with Mustang Panda PlugX Infrastructure

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedDelta PlugX Undergoing Changes and Overlapping Again with Mustang Panda PlugX Infrastructure

SSTIC2021-Slides-Taking_Advantage_of_PE_Metadata_or_How_To_Complete_your_Favorite_Threat_Actor_Sample_Collection-lunghi.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SSTIC2021-Slides-Taking_Advantage_of_PE_Metadata_or_How_To_Complete_your_Favorite_Threat_Actor_Sample_Collection-lunghi.pdf

eset_threat_report_t12021

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor eset_threat_report_t12021

Mustang Panda PlugX - 45.251.240.55 Pivot

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Mustang Panda PlugX - 45.251.240.55 Pivot

APT Threat Landscape of Taiwan in 2020

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT Threat Landscape of Taiwan in 2020

PowerPoint 簡報

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PowerPoint 簡報

Lemon Duck spreads its wings: Actors target Microsoft Exchange servers, incorporate new TTPs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lemon Duck spreads its wings: Actors target Microsoft Exchange servers, incorporate new TTPs

Proxylogon: A Coinminer, a Ransomware, and a Botnet Join the Party

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Proxylogon: A Coinminer, a Ransomware, and a Botnet Join the Party

Multi-Factor Authentication: Headache for Cyber Actors Inspires New Attack Techniques

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Multi-Factor Authentication: Headache for Cyber Actors Inspires New Attack Techniques

Analysis of top non-HTTP/S threats | Zscaler Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis of top non-HTTP/S threats | Zscaler Blog

ESET_Industry_Report_Government.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET_Industry_Report_Government.pdf

Water Pamola Attacked Online Shops Via Malicious Orders

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Water Pamola Attacked Online Shops Via Malicious Orders

Microsoft Word - Appendix_Water-Pamola-Attacked-Online-Shops.docx

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Word - Appendix_Water-Pamola-Attacked-Online-Shops.docx

APT_trends_report_Q1_2021_Securelist

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT_trends_report_Q1_2021_Securelist

APT trends report Q1 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q1 2021

APT trends report Q1 2021

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT trends report Q1 2021

Hello Ransomware Uses Updated China Chopper Web Shell, SharePoint Vulnerability

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hello Ransomware Uses Updated China Chopper Web Shell, SharePoint Vulnerability

Analysing a malware PCAP with IcedID and Cobalt Strike traffic

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysing a malware PCAP with IcedID and Cobalt Strike traffic

Analysing a malware PCAP with IcedID and Cobalt Strike traffic

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Analysing a malware PCAP with IcedID and Cobalt Strike traffic

Microsoft Exchange Breach in Jan. 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Exchange Breach in Jan. 2021

Actor Exploits Microsoft Exchange Server Vulnerabilities, Cortex XDR Blocks Harvesting of Credentials

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Actor Exploits Microsoft Exchange Server Vulnerabilities, Cortex XDR Blocks Harvesting of Credentials

Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware

date in the CCS '25 data SecureWorks fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware

Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware

Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware

The leap of a Cycldek-related threat actor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The leap of a Cycldek-related threat actor

The leap of a Cycldek-related threat actor

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The leap of a Cycldek-related threat actor

Study of targeted attacks on Russian research institutes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Study of targeted attacks on Russian research institutes

RedEcho group parks domains after public exposure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RedEcho group parks domains after public exposure

Imperva Observes Hive of Activity Following Hafnium Microsoft Exchange Disclosures

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Imperva Observes Hive of Activity Following Hafnium Microsoft Exchange Disclosures

Web Shell Threat Hunting with Azure Sentinel

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Web Shell Threat Hunting with Azure Sentinel

Analyzing attacks taking advantage of the Exchange Server vulnerabilities

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing attacks taking advantage of the Exchange Server vulnerabilities

https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/hafnium-china-chopper-and-aspnet-runtime/

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/hafnium-china-chopper-and-aspnet-runtime/

You Don't Know the HAFNIUM of it...

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor You Don't Know the HAFNIUM of it...

Microsoft Exchange Server Attack Timeline

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Exchange Server Attack Timeline

Tactics, Techniques, and Procedures (TTPs) Used by HAFNIUM to Target Microsoft Exchange Servers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tactics, Techniques, and Procedures (TTPs) Used by HAFNIUM to Target Microsoft Exchange Servers

Examining Exchange Exploitation and its Lessons for Defenders

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Examining Exchange Exploitation and its Lessons for Defenders

Lessons from Exchange Exploitation for Defenders

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lessons from Exchange Exploitation for Defenders

Tactics, Techniques, and Procedures (TTPs) Used by HAFNIUM to Target Microsoft Exchange Servers

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Tactics, Techniques, and Procedures (TTPs) Used by HAFNIUM to Target Microsoft Exchange Servers

Exchange servers under siege from at least 10 APT groups

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Exchange servers under siege from at least 10 APT groups

Exchange servers under siege from at least 10 APT groups

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Exchange servers under siege from at least 10 APT groups

Remediation Steps for the Microsoft Exchange Server Vulnerabilities

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Remediation Steps for the Microsoft Exchange Server Vulnerabilities

Microsoft Exchange attacks: how to detect, mitigate, and stay calm

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Exchange attacks: how to detect, mitigate, and stay calm

Reproducing the Microsoft Exchange Proxylogon Exploit Chain

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Reproducing the Microsoft Exchange Proxylogon Exploit Chain

Analyzing Attacks Against Microsoft Exchange Server With China Chopper Webshells

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing Attacks Against Microsoft Exchange Server With China Chopper Webshells

How Symantec Stops Microsoft Exchange Server Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How Symantec Stops Microsoft Exchange Server Attacks

Detection and Response to Exploitation of Microsoft Exchange Zero-Day Vulnerabilities | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detection and Response to Exploitation of Microsoft Exchange Zero-Day Vulnerabilities | Mandiant

https://www.huntress.com/hubfs/Videos/Webinars/Overlay-Mass_Exploitation_of_Exchange.mp4

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor https://www.huntress.com/hubfs/Videos/Webinars/Overlay-Mass_Exploitation_of_Exchange.mp4

Rapid Response: Mass Exploitation of On-Prem Exchange Servers | Huntress

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rapid Response: Mass Exploitation of On-Prem Exchange Servers | Huntress

HAFNIUM targeting Exchange Servers with 0-day exploits | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor HAFNIUM targeting Exchange Servers with 0-day exploits | Microsoft Security Blog

Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities

China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions

Cyber Threats 2020: A Year in Retrospect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Threats 2020: A Year in Retrospect

Report2021GTR.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Report2021GTR.pdf

Gh0stRat Anti-Debugging : Nested SEH (try - catch) to Decrypt and Load its Payload

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Gh0stRat Anti-Debugging : Nested SEH (try - catch) to Decrypt and Load its Payload

ESET_Threat_Report_Q42020.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET_Threat_Report_Q42020.pdf

Operation NightScout: Supply-chain attack targets online gaming in Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation NightScout: Supply-chain attack targets online gaming in Asia

Chopper ASPX Web Shell Used in Targeted Attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chopper ASPX Web Shell Used in Targeted Attack

Investigation into PlugX Uncovers Unique APT Technique

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Investigation into PlugX Uncovers Unique APT Technique

CRACKING A SOFT CELL IS HARDER THAN YOU THINK

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CRACKING A SOFT CELL IS HARDER THAN YOU THINK

Higaisa or Winnti? APT41 backdoors, old and new

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Higaisa or Winnti? APT41 backdoors, old and new

China's APT hackers move to ransomware attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China's APT hackers move to ransomware attacks

APT27+turns+to+ransomware

Malpedia library date Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT27+turns+to+ransomware

China's APT hackers move to ransomware attacks

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor China's APT hackers move to ransomware attacks

China cyber attacks- the current threat landscape

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor China cyber attacks- the current threat landscape

RAT used by Chinese cyberspies infiltrating Indian businesses

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RAT used by Chinese cyberspies infiltrating Indian businesses

Operation StealthyTrident: corporate software under attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation StealthyTrident: corporate software under attack

Operation StealthyTrident- corporate software under attack

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Operation StealthyTrident- corporate software under attack

Cyber Actors Target K-12 Distance Learning Education to Cause Disruptions and Steal Data | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Actors Target K-12 Distance Learning Education to Cause Disruptions and Steal Data | CISA

No pandas, just people: The current state of China’s cybercrime underground

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor No pandas, just people: The current state of China’s cybercrime underground

APT group targeting governmental agencies in East Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT group targeting governmental agencies in East Asia

APT Group Targeting Governmental Agencies in East Asia

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT Group Targeting Governmental Agencies in East Asia

APT group targeting governmental agencies in East Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT group targeting governmental agencies in East Asia

Investigation with a twist: an accidental APT attack and averted data destruction

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Investigation with a twist: an accidental APT attack and averted data destruction

Investigation with a twist_ an accidental APT attack and averted data destruction

date in the CCS '25 data Positive Technologies fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Investigation with a twist_ an accidental APT attack and averted data destruction

Group-IB_Hi-Tech_Crime_Trends_2020-2021_en

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Group-IB_Hi-Tech_Crime_Trends_2020-2021_en

TA416's Golang PlugX Malware Loader | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TA416's Golang PlugX Malware Loader | Proofpoint US

Weaponizing Open Source Software for Targeted Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Weaponizing Open Source Software for Targeted Attacks

APT trends report Q3 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q3 2020

Potential for China Cyber Response to Heightened U.S.–China Tensions | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Potential for China Cyber Response to Heightened U.S.–China Tensions | CISA

VB2020 paper: Pandamic: emissary Pandas in the Middle East

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor VB2020 paper: Pandamic: emissary Pandas in the Middle East

Palmerworm_ Espionage Gang Targets the Media, Finance, and Other Sectors _ Symantec Blogs

date in the CCS '25 data Symantec fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Palmerworm_ Espionage Gang Targets the Media, Finance, and Other Sectors _ Symantec Blogs

APT41: Indictments Put Chinese Espionage Group in the Spotlight

Malpedia library date Symantec fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT41: Indictments Put Chinese Espionage Group in the Spotlight

MAR-10297887-1.v2 – Iranian Web Shells | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MAR-10297887-1.v2 – Iranian Web Shells | CISA

Back Despite Disruption: RedDelta Resumes Operations

Malpedia library date Insikt Group® fromORKL

Archived copy on ORKL Detailsfor Back Despite Disruption: RedDelta Resumes Operations

Iran-Based Threat Actor Exploits VPN Vulnerabilities | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Iran-Based Threat Actor Exploits VPN Vulnerabilities | CISA

Research Roundup: Activity on Previously Identified APT33 Domains | ThreatConnect

Malpedia library date ThreatConnect fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Research Roundup: Activity on Previously Identified APT33 Domains | ThreatConnect

WastedLocker (2020/08/16) - IoC (TT Malware Log)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor WastedLocker (2020/08/16) - IoC (TT Malware Log)

ESET_Threat_Report_Q22020.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET_Threat_Report_Q22020.pdf

APT trends report Q2 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q2 2020

Two Chinese Hackers Working with the Ministry of State Security Charged with Global Computer Intrusion Campaign Targeting Intellectual Property and Confidential Business Information, Including COVID-19 Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Two Chinese Hackers Working with the Ministry of State Security Charged with Global Computer Intrusion Campaign Targeting Intellectual Property and Confidential Business Information, Including COVID-19 Research

What even is Winnti? - Risky Business Media

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What even is Winnti? - Risky Business Media

What even is Winnti-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor What even is Winnti-

Chinese state hackers target Hong Kong Catholic Church

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese state hackers target Hong Kong Catholic Church

Accenture | Let there be change

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Accenture | Let there be change

BRONZE VINEWOOD Targets Supply Chains _ Secureworks

date in the CCS '25 data SecureWorks fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor BRONZE VINEWOOD Targets Supply Chains _ Secureworks

BRONZE VINEWOOD Targets Supply Chains

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor BRONZE VINEWOOD Targets Supply Chains

Deep-dive: The DarkHotel APT

Malpedia library date Bushido Token fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Deep-dive: The DarkHotel APT

COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group

Cycldek: Bridging the (air) gap

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cycldek: Bridging the (air) gap

SSTIC2020-Slides-pivoter_tel_bernard_ou_comment_monitorer_des_attaquants_ngligents-lunghi.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SSTIC2020-Slides-pivoter_tel_bernard_ou_comment_monitorer_des_attaquants_ngligents-lunghi.pdf

Mustang Panda Recent Activity: Dll-Sideloading trojans with temporal C2 servers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mustang Panda Recent Activity: Dll-Sideloading trojans with temporal C2 servers

Mustang Panda Recent Activity- Dll-Sideloading trojans with temporal C2 servers

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Mustang Panda Recent Activity- Dll-Sideloading trojans with temporal C2 servers

WastedLoader or DridexLoader-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor WastedLoader or DridexLoader-

T1055 Process Injection

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor T1055 Process Injection

What happened between the BigBadWolf and the Tiger?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What happened between the BigBadWolf and the Tiger?

What happened between the BigBadWolf and the Tiger-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor What happened between the BigBadWolf and the Tiger-

APT group planted backdoors targeting high profile networks in Central Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT group planted backdoors targeting high profile networks in Central Asia

The energy reserves in the Eastern Mediterranean Sea and a malicious campaign of APT10 against Turkey

Malpedia library date Lab52 fromORKLCCS '25 data

Archived copy on ORKL Detailsfor The energy reserves in the Eastern Mediterranean Sea and a malicious campaign of APT10 against Turkey

APT trends report Q1 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q1 2020

WINNTI GROUP_ Insights From the Past

date in the CCS '25 data QuoIntelligence fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor WINNTI GROUP_ Insights From the Past

WINNTI GROUP: Insights From the Past

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor WINNTI GROUP: Insights From the Past

WINNTI GROUP- Insights From the Past

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor WINNTI GROUP- Insights From the Past

Deobfuscating and hunting for OSTAP, Trickbot’s dropper and best friend

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Deobfuscating and hunting for OSTAP, Trickbot’s dropper and best friend

Deobfuscating and hunting for OSTAP, Trickbot’s dropper and best friend

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Deobfuscating and hunting for OSTAP, Trickbot’s dropper and best friend

How the Iranian Cyber Security Agency Detects Emissary Panda Malware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor How the Iranian Cyber Security Agency Detects Emissary Panda Malware

report-bb-decade-of-the-rats

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor report-bb-decade-of-the-rats

COVID-19 Themes Are Being Utilized by Threat Actors of Varying Sophistication

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor COVID-19 Themes Are Being Utilized by Threat Actors of Varying Sophistication

Is APT 27 Abusing COVID-19 To Attack People -!

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Is APT 27 Abusing COVID-19 To Attack People -!

Phân tích mã độc lợi dụng dịch Covid-19 để phát tán giả mạo “Chỉ thị của thủ tướng Nguyễn Xuân Phúc” - Phần

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Phân tích mã độc lợi dụng dịch Covid-19 để phát tán giả mạo “Chỉ thị của thủ tướng Nguyễn Xuân Phúc” - Phần

Is APT 27 Abusing COVID-19 To Attack People !

date in the CCS '25 data Yoroi fromCCS '25 data

The original link failed its last check. Detailsfor Is APT 27 Abusing COVID-19 To Attack People !

cybersecurity-threatscape-2019-q4-eng

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor cybersecurity-threatscape-2019-q4-eng

Swallowing the Snake's Tail: Tracking Turla Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Swallowing the Snake's Tail: Tracking Turla Infrastructure

Phân tích mã độc lợi dụng dịch Covid-19 để phát tán giả mạo “Chỉ thị của thủ tướng Nguyễn Xuân Phúc” - Phần 1 - VinCSS Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Phân tích mã độc lợi dụng dịch Covid-19 để phát tán giả mạo “Chỉ thị của thủ tướng Nguyễn Xuân Phúc” - Phần 1 - VinCSS Blog

New Variant of TrickBot Being Spread by Word Document

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New Variant of TrickBot Being Spread by Word Document

New Variant of TrickBot Being Spread by Word Document | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Variant of TrickBot Being Spread by Word Document | FortiGuard Labs

the adversary playbook for the long-standing espionage activity of a Chinese nation-state adversary

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor the adversary playbook for the long-standing espionage activity of a Chinese nation-state adversary

Uncovering DRBControl: Inside the Cyberespionage Campaign Targeting Gambling Operations

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Uncovering DRBControl: Inside the Cyberespionage Campaign Targeting Gambling Operations

Operation DRBControl: Uncovering a Cyberespionage Campaign Targeting Gambling Companies in Southeast Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation DRBControl: Uncovering a Cyberespionage Campaign Targeting Gambling Companies in Southeast Asia

Uncovering DRBControl- Inside the Cyberespionage Campaign Targeting Gambling Operations

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Uncovering DRBControl- Inside the Cyberespionage Campaign Targeting Gambling Operations

CLAMBLING - A New Backdoor Base On Dropbox (EN)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CLAMBLING - A New Backdoor Base On Dropbox (EN)

Actors Still Exploiting SharePoint Vulnerability to Attack Middle East Government Organizations

date in the CCS '25 data Palo Alto fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Actors Still Exploiting SharePoint Vulnerability to Attack Middle East Government Organizations

APT27 ZXShell RootKit module updates

date in the CCS '25 data Lab52 fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT27 ZXShell RootKit module updates

APT27 ZXShell RootKit module updates

Malpedia library date fromORKL