Sandworm Team

Also reported as IRIDIUM, Seashell Blizzard, Quedagh, FROZENBARENTS, APT44 and 39 other names. Sources disagree on the origin.

Reports: 528
Last reported: 7 September 2026
Known CVEs: 185
Techniques in ATT&CK: 85
Origin: Iran, Russia

ID: G0034
Sources: ATT&CK MISP ETDA Malpedia Microsoft
Merge evidence: 65 alias matches

Reports per quarter

2007 Q4: 1 report
2008 Q1: no reports
2008 Q2: no reports
2008 Q3: no reports
2008 Q4: no reports
2009 Q1: no reports
2009 Q2: no reports
2009 Q3: no reports
2009 Q4: no reports
2010 Q1: 1 report
2010 Q2: no reports
2010 Q3: 1 report
2010 Q4: no reports
2011 Q1: no reports
2011 Q2: no reports
2011 Q3: no reports
2011 Q4: no reports
2012 Q1: no reports
2012 Q2: no reports
2012 Q3: no reports
2012 Q4: no reports
2013 Q1: no reports
2013 Q2: no reports
2013 Q3: no reports
2013 Q4: no reports
2014 Q1: no reports
2014 Q2: no reports
2014 Q3: 1 report
2014 Q4: 12 reports
2015 Q1: 2 reports
2015 Q2: 1 report
2015 Q3: 3 reports
2015 Q4: 1 report
2016 Q1: 12 reports
2016 Q2: no reports
2016 Q3: 4 reports
2016 Q4: 10 reports
2017 Q1: 4 reports
2017 Q2: 23 reports
2017 Q3: 15 reports
2017 Q4: 9 reports
2018 Q1: 4 reports
2018 Q2: 1 report
2018 Q3: 3 reports
2018 Q4: 8 reports
2019 Q1: 13 reports
2019 Q2: 8 reports
2019 Q3: 5 reports
2019 Q4: 3 reports
2020 Q1: 8 reports
2020 Q2: 13 reports
2020 Q3: 8 reports
2020 Q4: 17 reports
2021 Q1: 10 reports
2021 Q2: 7 reports
2021 Q3: 8 reports
2021 Q4: 5 reports
2022 Q1: 71 reports
2022 Q2: 51 reports
2022 Q3: 12 reports
2022 Q4: 12 reports
2023 Q1: 18 reports
2023 Q2: 9 reports
2023 Q3: 6 reports
2023 Q4: 10 reports
2024 Q1: 3 reports
2024 Q2: 15 reports
2024 Q3: 8 reports
2024 Q4: 6 reports
2025 Q1: 8 reports
2025 Q2: 5 reports
2025 Q3: 4 reports
2025 Q4: 3 reports
2026 Q1: 7 reports
2026 Q2: 57 reports
2026 Q3: 2 reports

Dated reports, 2007 Q4 to 2026 Q3.

Techniques seen in the last two years

T1059.001 6 reports in ATT&CK
T1105 6 reports in ATT&CK
T1190 6 reports in ATT&CK
T1566.001 6 reports in ATT&CK
T1053.005 5 reports in ATT&CK
T1059.003 5 reports reports only
T1082 5 reports in ATT&CK
T1083 5 reports in ATT&CK
T1529 5 reports reports only
T1566.002 5 reports in ATT&CK

Show all 294 techniques Show fewer

T1005 4 reports in ATT&CK
T1016 4 reports reports only
T1018 4 reports in ATT&CK
T1033 4 reports in ATT&CK
T1057 4 reports reports only
T1070.004 4 reports in ATT&CK
T1071.001 4 reports in ATT&CK
T1091 4 reports reports only
T1134 4 reports reports only
T1189 4 reports reports only
T1485 4 reports in ATT&CK
T1569.002 4 reports reports only
T1680 4 reports reports only
T1041 3 reports in ATT&CK
T1046 3 reports reports only
T1049 3 reports in ATT&CK
T1053 3 reports reports only
T1069.002 3 reports reports only
T1090 3 reports in ATT&CK
T1090.003 3 reports reports only
T1113 3 reports reports only
T1124 3 reports reports only
T1133 3 reports in ATT&CK
T1135 3 reports reports only
T1195 3 reports in ATT&CK
T1195.002 3 reports in ATT&CK
T1204.002 3 reports in ATT&CK
T1219 3 reports in ATT&CK
T1222 3 reports reports only
T1484.001 3 reports reports only
T1490 3 reports in ATT&CK
T1566.003 3 reports reports only
T1567 3 reports reports only
T1595.002 3 reports in ATT&CK
T1602.002 3 reports reports only
T1608.004 3 reports reports only
T1659 3 reports reports only
T1003.003 2 reports in ATT&CK
T1007 2 reports reports only
T1012 2 reports reports only
T1021 2 reports reports only
T1021.001 2 reports reports only
T1021.004 2 reports reports only
T1027 2 reports in ATT&CK
T1047 2 reports in ATT&CK
T1055 2 reports reports only
T1056.001 2 reports in ATT&CK
T1059 2 reports reports only
T1059.006 2 reports reports only
T1074.001 2 reports reports only
T1078 2 reports in ATT&CK
T1078.003 2 reports reports only
T1087 2 reports reports only
T1087.002 2 reports in ATT&CK
T1098.007 2 reports reports only
T1114.002 2 reports reports only
T1136.001 2 reports reports only
T1203 2 reports in ATT&CK
T1210 2 reports reports only
T1212 2 reports reports only
T1213 2 reports reports only
T1219.002 2 reports reports only
T1482 2 reports reports only
T1505.003 2 reports in ATT&CK
T1518.001 2 reports reports only
T1547.001 2 reports reports only
T1548.002 2 reports reports only
T1555.003 2 reports in ATT&CK
T1558 2 reports reports only
T1560 2 reports reports only
T1566 2 reports reports only
T1567.002 2 reports reports only
T1567.004 2 reports reports only
T1583.003 2 reports reports only
T1584.004 2 reports in ATT&CK
T1598 2 reports reports only
T1608.006 2 reports reports only
T1665 2 reports reports only
T0807 1 report in ATT&CK
T0809 1 report reports only
T0816 1 report reports only
T0822 1 report reports only
T0823 1 report reports only
T0827 1 report reports only
T0829 1 report reports only
T0840 1 report reports only
T0846 1 report reports only
T0852 1 report reports only
T0859 1 report reports only
T0886 1 report reports only
T0888 1 report reports only
T0892 1 report reports only
T1003 1 report reports only
T1003.001 1 report in ATT&CK
T1003.002 1 report reports only
T1003.004 1 report reports only
T1008 1 report reports only
T1010 1 report reports only
T1016.001 1 report reports only
T1020 1 report reports only
T1021.002 1 report in ATT&CK
T1021.005 1 report reports only
T1021.006 1 report reports only
T1036.010 1 report reports only
T1037 1 report reports only
T1037.001 1 report reports only
T1039 1 report reports only
T1040 1 report in ATT&CK
T1053.003 1 report reports only
T1055.001 1 report reports only
T1055.002 1 report reports only
T1055.003 1 report reports only
T1055.004 1 report reports only
T1055.009 1 report reports only
T1055.012 1 report reports only
T1056 1 report reports only
T1059.002 1 report reports only
T1059.004 1 report reports only
T1059.005 1 report in ATT&CK
T1059.007 1 report reports only
T1059.009 1 report reports only
T1059.010 1 report reports only
T1059.011 1 report reports only
T1068 1 report reports only
T1069 1 report reports only
T1069.001 1 report reports only
T1069.003 1 report reports only
T1070 1 report reports only
T1071 1 report reports only
T1071.002 1 report reports only
T1071.004 1 report reports only
T1072 1 report in ATT&CK
T1074 1 report reports only
T1074.002 1 report reports only
T1078.004 1 report reports only
T1087.001 1 report reports only
T1087.004 1 report reports only
T1090.001 1 report reports only
T1090.002 1 report reports only
T1095 1 report reports only
T1098 1 report reports only
T1098.001 1 report reports only
T1098.003 1 report reports only
T1098.004 1 report reports only
T1098.005 1 report reports only
T1098.006 1 report reports only
T1102 1 report reports only
T1102.002 1 report in ATT&CK
T1104 1 report reports only
T1110 1 report reports only
T1110.001 1 report reports only
T1110.002 1 report reports only
T1110.003 1 report reports only
T1112 1 report reports only
T1114 1 report reports only
T1114.001 1 report reports only
T1114.003 1 report reports only
T1115 1 report reports only
T1119 1 report reports only
T1120 1 report reports only
T1123 1 report reports only
T1125 1 report reports only
T1129 1 report reports only
T1132 1 report reports only
T1132.001 1 report in ATT&CK
T1134.001 1 report reports only
T1136 1 report reports only
T1136.002 1 report reports only
T1137 1 report reports only
T1137.006 1 report reports only
T1140 1 report in ATT&CK
T1187 1 report reports only
T1199 1 report in ATT&CK
T1200 1 report reports only
T1201 1 report reports only
T1204 1 report reports only
T1204.001 1 report in ATT&CK
T1204.004 1 report reports only
T1213.001 1 report reports only
T1213.002 1 report reports only
T1213.003 1 report reports only
T1217 1 report reports only
T1218 1 report reports only
T1218.007 1 report reports only
T1218.011 1 report in ATT&CK
T1221 1 report reports only
T1222.001 1 report reports only
T1484 1 report reports only
T1486 1 report in ATT&CK
T1489 1 report in ATT&CK
T1491.002 1 report in ATT&CK
T1496 1 report reports only
T1497 1 report reports only
T1497.001 1 report reports only
T1505 1 report reports only
T1505.004 1 report reports only
T1518 1 report reports only
T1530 1 report reports only
T1534 1 report reports only
T1537 1 report reports only
T1538 1 report reports only
T1543 1 report reports only
T1543.002 1 report reports only
T1543.003 1 report reports only
T1543.004 1 report reports only
T1546 1 report reports only
T1546.003 1 report reports only
T1546.004 1 report reports only
T1546.008 1 report reports only
T1546.012 1 report reports only
T1546.015 1 report reports only
T1547 1 report reports only
T1547.002 1 report reports only
T1547.005 1 report reports only
T1547.009 1 report reports only
T1548 1 report reports only
T1550 1 report reports only
T1550.001 1 report reports only
T1550.002 1 report reports only
T1552.004 1 report reports only
T1554 1 report reports only
T1555 1 report reports only
T1556 1 report reports only
T1556.006 1 report reports only
T1556.009 1 report reports only
T1557 1 report reports only
T1558.003 1 report reports only
T1559 1 report reports only
T1560.001 1 report reports only
T1560.002 1 report reports only
T1561.001 1 report reports only
T1561.002 1 report in ATT&CK
T1564.002 1 report reports only
T1565 1 report reports only
T1565.001 1 report reports only
T1566.004 1 report reports only
T1567.001 1 report reports only
T1569 1 report reports only
T1570 1 report in ATT&CK
T1571 1 report in ATT&CK
T1572 1 report reports only
T1573 1 report reports only
T1573.001 1 report reports only
T1573.002 1 report reports only
T1574 1 report reports only
T1574.001 1 report reports only
T1574.011 1 report reports only
T1578 1 report reports only
T1580 1 report reports only
T1583 1 report in ATT&CK
T1583.001 1 report in ATT&CK
T1584 1 report reports only
T1585 1 report reports only
T1585.002 1 report in ATT&CK
T1586.002 1 report reports only
T1587 1 report reports only
T1587.001 1 report in ATT&CK
T1587.003 1 report reports only
T1588 1 report reports only
T1588.002 1 report in ATT&CK
T1588.003 1 report reports only
T1588.004 1 report reports only
T1588.007 1 report reports only
T1589.002 1 report in ATT&CK
T1591.002 1 report in ATT&CK
T1595 1 report reports only
T1598.002 1 report reports only
T1598.003 1 report in ATT&CK
T1602 1 report reports only
T1602.001 1 report reports only
T1608 1 report reports only
T1608.001 1 report in ATT&CK
T1608.002 1 report reports only
T1608.003 1 report reports only
T1608.005 1 report reports only
T1613 1 report reports only
T1614 1 report reports only
T1614.001 1 report reports only
T1615 1 report reports only
T1619 1 report reports only
T1622 1 report reports only
T1652 1 report reports only
T1654 1 report reports only
T1657 1 report reports only

Counts come from technique IDs in the actor's report text. “Reports only” means reports name the technique but MITRE ATT&CK® does not list it for this actor.

Also listed by ATT&CK

Show all 24 techniques Show fewer

CVEs named in reports

Show all 185 CVEs Show fewer

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

7 September 2026

Beyond Lazarus: Organization of DPRK cyber capabilities

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Beyond Lazarus: Organization of DPRK cyber capabilities
7 September 2026

Beyond Lazarus: Organization of DPRK Cyber Capabilities

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Beyond Lazarus: Organization of DPRK Cyber Capabilities
28 May 2026

eset-apt-activity-report-q4-2025-q1-2026.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eset-apt-activity-report-q4-2025-q1-2026.pdf
1 May 2026

NotPetya Malware Analysis - Bye, boot partition. I’ll miss you

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor NotPetya Malware Analysis - Bye, boot partition. I’ll miss you
29 April 2026

Russian Sandworm group attacks energy company in Poland with DynoWiper, ESET Research discovers

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Russian Sandworm group attacks energy company in Poland with DynoWiper, ESET Research discovers
17 April 2026

28th November– Threat Intelligence Report

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor 28th November– Threat Intelligence Report
6 April 2026

BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry
6 April 2026

DCRat (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor DCRat (Malware Family)
6 April 2026

Russian Sandworm hackers breached 11 Ukrainian telcos since May

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Russian Sandworm hackers breached 11 Ukrainian telcos since May
6 April 2026

CEO of Ukraine's largest telecom operator describes Russian cyberattack that wiped thousands of computers

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor CEO of Ukraine's largest telecom operator describes Russian cyberattack that wiped thousands of computers

Show all 528 reports Show fewer

6 April 2026

CyclopsBlink (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor CyclopsBlink (Malware Family)
6 April 2026

Researchers spot updated version of malware that hit Viasat

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Researchers spot updated version of malware that hit Viasat
6 April 2026

Russian hackers use WinRAR to wipe Ukraine state agency’s data

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Russian hackers use WinRAR to wipe Ukraine state agency’s data
6 April 2026

HermeticWiper (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor HermeticWiper (Malware Family)
6 April 2026

KillDisk Disk-Wiping Malware Adds Ransomware Component

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor KillDisk Disk-Wiping Malware Adds Ransomware Component
6 April 2026

Russian hackers wiped thousands of systems in KyivStar attack

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Russian hackers wiped thousands of systems in KyivStar attack
6 April 2026

Microsoft Zero Day Traced to Russian ‘Sandworm’ Hackers

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Microsoft Zero Day Traced to Russian ‘Sandworm’ Hackers
6 April 2026

Five Threat Groups Target Industrial Systems: Dragos

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Five Threat Groups Target Industrial Systems: Dragos
6 April 2026

Olympic Destroyer (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Olympic Destroyer (Malware Family)
6 April 2026

New wave of cyberattacks against Ukrainian power industry

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor New wave of cyberattacks against Ukrainian power industry
6 April 2026

Russian Sandworm hackers targeted 20 critical orgs in Ukraine

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Russian Sandworm hackers targeted 20 critical orgs in Ukraine
6 April 2026

A deeper look at the malware being used on Ukrainian targets

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor A deeper look at the malware being used on Ukrainian targets
6 April 2026

Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure | CISA

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure | CISA
6 April 2026

Sandworm uses a new version of ArguePatch to attack targets in Ukraine

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Sandworm uses a new version of ArguePatch to attack targets in Ukraine
6 April 2026

Sandworm Team, Iron Viking, Voodoo Bear

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Sandworm Team, Iron Viking, Voodoo Bear
6 April 2026

Russia's Cyberwar on Ukraine Is a Blueprint for What's to Come

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Russia's Cyberwar on Ukraine Is a Blueprint for What's to Come
6 April 2026

BlackEnergy (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor BlackEnergy (Malware Family)
6 April 2026

Russia-Ukraine War: Cyber Threat Intelligence Report | Security Insider

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Russia-Ukraine War: Cyber Threat Intelligence Report | Security Insider
6 April 2026

The BadPilot campaign: Seashell Blizzard subgroup conducts multiyear global access operation | Microsoft Security Blog

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor The BadPilot campaign: Seashell Blizzard subgroup conducts multiyear global access operation | Microsoft Security Blog
6 April 2026

Signals of Trouble: Multiple Russia-Aligned Threat Actors Actively Targeting Signal Messenger

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Signals of Trouble: Multiple Russia-Aligned Threat Actors Actively Targeting Signal Messenger
6 April 2026

Sandworm-linked hackers target users of Ukraine’s military app in new spying campaign

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Sandworm-linked hackers target users of Ukraine’s military app in new spying campaign
6 April 2026

AcidPour | New Embedded Wiper Variant of AcidRain Appears in Ukraine

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor AcidPour | New Embedded Wiper Variant of AcidRain Appears in Ukraine
6 April 2026

EternalPetya (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor EternalPetya (Malware Family)
6 April 2026

Sandworm Team and the Ukrainian Power Authority Attacks | Mandiant

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Sandworm Team and the Ukrainian Power Authority Attacks | Mandiant
6 April 2026

Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S. Critical Infrastructure | CISA

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S. Critical Infrastructure | CISA
6 April 2026

Sandworm Zero Day Vulnerability | iSIGHT Partners

date ORKL added it fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor Sandworm Zero Day Vulnerability | iSIGHT Partners
6 April 2026

Six Russian GRU Officers Charged in Connection with Worldwide Deployment of Destructive Malware and Other Disruptive Actions in Cyberspace

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Six Russian GRU Officers Charged in Connection with Worldwide Deployment of Destructive Malware and Other Disruptive Actions in Cyberspace
6 April 2026

Pro-Russian hackers blamed for water dam sabotage in Norway

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Pro-Russian hackers blamed for water dam sabotage in Norway
6 April 2026

Advantech/Broadwin WebAccess RPC Vulnerability (Update B) | CISA

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Advantech/Broadwin WebAccess RPC Vulnerability (Update B) | CISA
6 April 2026

Evolving Tactics: How Russian APT Groups Are Shaping Cyber Threats in 2024

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Evolving Tactics: How Russian APT Groups Are Shaping Cyber Threats in 2024
6 April 2026

Ongoing Sophisticated Malware Campaign Compromising ICS (Update E) | CISA

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Ongoing Sophisticated Malware Campaign Compromising ICS (Update E) | CISA
6 April 2026

BlackEnergy

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor BlackEnergy
6 April 2026

Research, News, and Perspectives

date ORKL added it fromORKL

The original link failed its last check. Original publisher Detailsfor Research, News, and Perspectives
6 April 2026

Russian hackers start targeting Ukraine with Follina exploits

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Russian hackers start targeting Ukraine with Follina exploits
6 April 2026

Aktive APT-Gruppen in Deutschland

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Aktive APT-Gruppen in Deutschland
6 April 2026

ELECTRUM Targeted Ukrainian Electric Entity Using Custom Tools and CaddyWiper Malware, October 2022

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor ELECTRUM Targeted Ukrainian Electric Entity Using Custom Tools and CaddyWiper Malware, October 2022
6 April 2026

Iridium cyberespionage gang behind Aussie parliament attacks

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Iridium cyberespionage gang behind Aussie parliament attacks
6 April 2026

RansomBoggs: New ransomware targeting Ukraine

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor RansomBoggs: New ransomware targeting Ukraine
6 April 2026

Another Hacker Selling Access to Charity, Antivirus Firm Networks

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Another Hacker Selling Access to Charity, Antivirus Firm Networks
6 April 2026

Cyber-Attack Against Ukrainian Critical Infrastructure | CISA

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Cyber-Attack Against Ukrainian Critical Infrastructure | CISA
6 April 2026

Router Roulette: Cybercriminals and Nation-States Sharing Compromised Networks

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Router Roulette: Cybercriminals and Nation-States Sharing Compromised Networks
6 April 2026

VPNFilter (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor VPNFilter (Malware Family)
6 April 2026

Recent OT and Espionage Attacks Linked to Russia’s Sandworm, Now Named APT44

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Recent OT and Espionage Attacks Linked to Russia’s Sandworm, Now Named APT44
6 April 2026

Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia
6 April 2026

VOODOO BEAR | Threat Actor Profile | CrowdStrike

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor VOODOO BEAR | Threat Actor Profile | CrowdStrike
6 April 2026

UPD. Ответственность за атаку на «Киевстар» взяли российские хакеры. Рассказываем, что такое «Солнцепёк» и кто за ним стоит

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor UPD. Ответственность за атаку на «Киевстар» взяли российские хакеры. Рассказываем, что такое «Солнцепёк» и кто за ним стоит
6 April 2026

Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia
6 April 2026

PartyTicket (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor PartyTicket (Malware Family)
6 April 2026

New “Prestige” ransomware impacts organizations in Ukraine and Poland | Microsoft Security Blog

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor New “Prestige” ransomware impacts organizations in Ukraine and Poland | Microsoft Security Blog
10 March 2026

Iranian MOIS Actors & the Cyber Crime Connection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Iranian MOIS Actors & the Cyber Crime Connection
10 February 2026

Threats to the Defense Industrial Base

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threats to the Defense Industrial Base
9 February 2026

Detecting Russian Threats to Critical Energy Infrastructure - Truesec

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detecting Russian Threats to Critical Energy Infrastructure - Truesec
6 February 2026

DynoWiper: From Russia with Love

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DynoWiper: From Russia with Love
30 January 2026

DynoWiper update: Technical analysis and attribution

publisher's date ESET Research fromORKLESET

Archived copy on ORKL Detailsfor DynoWiper update: Technical analysis and attribution
30 January 2026

Energy Sector Incident Report – 29 December

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Energy Sector Incident Report – 29 December
23 January 2026

ESET Research: Sandworm behind cyberattack on Poland’s power grid in late 2025

publisher's date ESET Research fromESET

Detailsfor ESET Research: Sandworm behind cyberattack on Poland’s power grid in late 2025
10 December 2025

Analyzing the Impact of the Operation Endgame Takedown on Rhadamanthys & the MaaS Ecosystem

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing the Impact of the Operation Endgame Takedown on Rhadamanthys & the MaaS Ecosystem
5 November 2025

eset-apt-activity-report-q2-2025-q3-2025.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eset-apt-activity-report-q2-2025-q3-2025.pdf
1 October 2025

Rhadamanthys 0.9.x – walk through the updates

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rhadamanthys 0.9.x – walk through the updates
3 September 2025

PXA Stealers Evolution to PureRAT: Part 6 - Finally, the Final Stage PureRAT (Stage 9)

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor PXA Stealers Evolution to PureRAT: Part 6 - Finally, the Final Stage PureRAT (Stage 9)
8 August 2025

Distribution of SmartLoader Malware via Github Repository Disguised as a Legitimate Project

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Distribution of SmartLoader Malware via Github Repository Disguised as a Legitimate Project
18 July 2025

UK sanctions Russian cyber spies accused of facilitating murders

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UK sanctions Russian cyber spies accused of facilitating murders
1 July 2025

ESET APT Activity Report Q4 2024-Q1 2025: Malware sharing, data wiping and exploits

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET APT Activity Report Q4 2024-Q1 2025: Malware sharing, data wiping and exploits
22 May 2025

De-obfuscating ALCATRAZ

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor De-obfuscating ALCATRAZ
12 May 2025

ESET APT Activity Report Q4 2024-Q1 2025

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET APT Activity Report Q4 2024-Q1 2025
10 May 2025

Malware development trick 47: simple Windows clipboard hijacking. Simple C example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development trick 47: simple Windows clipboard hijacking. Simple C example.
1 May 2025

Malware development trick 46: simple Windows keylogger. Simple C example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development trick 46: simple Windows keylogger. Simple C example.
24 April 2025

m-trends-2025-en.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor m-trends-2025-en.pdf
28 March 2025

A Deep Dive into Water Gamayun's Arsenal and Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Deep Dive into Water Gamayun's Arsenal and Infrastructure
6 March 2025

Unveiling EncryptHub: Analysis of a multi-stage malware campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unveiling EncryptHub: Analysis of a multi-stage malware campaign
12 February 2025

The BadPilot campaign: Seashell Blizzard subgroup conducts multiyear global access operation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The BadPilot campaign: Seashell Blizzard subgroup conducts multiyear global access operation
11 February 2025

Sandworm APT Targets Ukrainian Users with Trojanized Microsoft KMS Activation Tools in Cyber Espionage Campaigns

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sandworm APT Targets Ukrainian Users with Trojanized Microsoft KMS Activation Tools in Cyber Espionage Campaigns
11 February 2025

Sandworm APT Exploits Trojanized KMS Tools to Target Ukrainian Users in Cyber Espionage Campaign

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Sandworm APT Exploits Trojanized KMS Tools to Target Ukrainian Users in Cyber Espionage Campaign
15 January 2025

第113篇：俄乌网络战之一，沙虫APT组织致乌克兰第1次大停电事件复盘 | CTF导航

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 第113篇：俄乌网络战之一，沙虫APT组织致乌克兰第1次大停电事件复盘 | CTF导航
10 January 2025

Jul-Dec%202024%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Jul-Dec%202024%20Botnet%20Threat%20Update.pdf
4 January 2025

RevDiaries | Analysis of the Roblox Executor Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RevDiaries | Analysis of the Roblox Executor Malware
5 December 2024

GitHub - cert-orangecyberdefense/edam: Edam dropper

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GitHub - cert-orangecyberdefense/edam: Edam dropper
28 November 2024

RU APT targeting Energy Infrastructure (Unknown unknowns, part 3)

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RU APT targeting Energy Infrastructure (Unknown unknowns, part 3)
7 November 2024

ESET APT Activity Report Q2 2024-Q3 2024

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET APT Activity Report Q2 2024-Q3 2024
6 November 2024

CopyRh(ight)adamantys Campaign: Rhadamantys Exploits Intellectual Property Infringement Baits

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CopyRh(ight)adamantys Campaign: Rhadamantys Exploits Intellectual Property Infringement Baits
23 October 2024

Highlighting TA866/Asylum Ambuscade Activity Since 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Highlighting TA866/Asylum Ambuscade Activity Since 2021
17 October 2024

ClickFix tactic: The Phantom Meet

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ClickFix tactic: The Phantom Meet
26 September 2024

Rhadamanthys Stealer Adds

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rhadamanthys Stealer Adds
22 September 2024

The Russian APT Tool Matrix

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Russian APT Tool Matrix
12 September 2024

Crystal Rans0m: Emerging hybrid ransomware with stealer capabilities

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Crystal Rans0m: Emerging hybrid ransomware with stealer capabilities
4 September 2024

Hacktivists Call for Release of Telegram Founder with #FreeDurov DDoS Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hacktivists Call for Release of Telegram Founder with #FreeDurov DDoS Campaign
25 July 2024

Growing Number of Threats Leveraging AI

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Growing Number of Threats Leveraging AI
24 July 2024

Stargazers Ghost Network - Check Point Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Stargazers Ghost Network - Check Point Research
14 July 2024

Malware Analysis - Rhadamanthys

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Analysis - Rhadamanthys
9 July 2024

Jan-Jun%202024%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Jan-Jun%202024%20Botnet%20Threat%20Update.pdf
5 June 2024

European Election Security At Risk: A Detailed Analysis of State-Sponsored, eCrime, and Hacktivist Threats

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor European Election Security At Risk: A Detailed Analysis of State-Sponsored, eCrime, and Hacktivist Threats
5 June 2024

Phishing for Gold: Cyber Threats Facing the 2024 Paris Olympics

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Phishing for Gold: Cyber Threats Facing the 2024 Paris Olympics
13 May 2024

ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilities

file creation date fromORKL

Archived copy on ORKL Detailsfor ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilities
11 May 2024

俄罗斯APT在东欧攻击中部署新的“Kapeka”后门 | CTF导航

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 俄罗斯APT在东欧攻击中部署新的“Kapeka”后门 | CTF导航
1 May 2024

Router Roulette: Cybercriminals and Nation-States Sharing Compromised Networks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Router Roulette: Cybercriminals and Nation-States Sharing Compromised Networks
29 April 2024

APT44 Report

Malpedia library date Selin Uğurlu fromORKL

The original link failed its last check. Original publisher Detailsfor APT44 Report
25 April 2024

Poll Vaulting: Cyber Threats to Global Elections

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Poll Vaulting: Cyber Threats to Global Elections
22 April 2024

Analyzing Forest Blizzard’s custom post-compromise tool for exploiting CVE-2022-38028 to obtain credentials | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing Forest Blizzard’s custom post-compromise tool for exploiting CVE-2022-38028 to obtain credentials | Microsoft Security Blog
19 April 2024

CERT-UA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERT-UA
17 April 2024

WithSecure-Research-Kapeka.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor WithSecure-Research-Kapeka.pdf
17 April 2024

Unearthing APT44: Russia’s Notorious Cyber Sabotage Unit Sandworm

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unearthing APT44: Russia’s Notorious Cyber Sabotage Unit Sandworm
16 April 2024

apt44-unearthing-sandworm.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor apt44-unearthing-sandworm.pdf
15 April 2024

s&p2024.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor s&p2024.pdf
10 April 2024

TA547 Targets German Organizations: Rhadamanthys Stealer | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TA547 Targets German Organizations: Rhadamanthys Stealer | Proofpoint US
2 April 2024

APT and financial attacks on industrial organizations in H2 2023 | Kaspersky ICS CERT EN

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT and financial attacks on industrial organizations in H2 2023 | Kaspersky ICS CERT EN
16 February 2024

CVE-2024-21412_ Water Hydra Targets Traders with Microsoft Defender SmartScreen Zero-Day

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor CVE-2024-21412_ Water Hydra Targets Traders with Microsoft Defender SmartScreen Zero-Day
13 February 2024

CVE-2024-21412: Water Hydra Targets Traders with Microsoft Defender SmartScreen Zero-Day

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CVE-2024-21412: Water Hydra Targets Traders with Microsoft Defender SmartScreen Zero-Day
12 January 2024

Q4%202023%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Q4%202023%20Botnet%20Threat%20Update.pdf
14 December 2023

Rhadamanthys v0.5.0 - a deep dive into the stealer’s components - Check Point Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rhadamanthys v0.5.0 - a deep dive into the stealer’s components - Check Point Research
10 November 2023

SektorCERT-The-attack-against-Danish-critical-infrastructure-TLP-CLEAR.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor SektorCERT-The-attack-against-Danish-critical-infrastructure-TLP-CLEAR.pdf
9 November 2023

Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology
9 November 2023

Microsoft shares threat intelligence at CYBERWARCON 2023 | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft shares threat intelligence at CYBERWARCON 2023 | Microsoft Security Blog
27 October 2023

GHOSTPULSE haunts victims using defense evasion bag o' tricks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GHOSTPULSE haunts victims using defense evasion bag o' tricks
26 October 2023

ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilities

Malpedia library date ESET fromORKLCCS '25 data

Archived copy on ORKL Detailsfor ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilities
18 October 2023

Government-backed actors exploiting WinRAR vulnerability

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Government-backed actors exploiting WinRAR vulnerability
12 October 2023

2023%20Q3%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023%20Q3%20Botnet%20Threat%20Update.pdf
5 October 2023

deep analysis of Xiangoop Loader and EntryShell payload

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor deep analysis of Xiangoop Loader and EntryShell payload
3 October 2023

Rhadamanthys malware analysis: How infostealers use VMs to avoid analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rhadamanthys malware analysis: How infostealers use VMs to avoid analysis
12 September 2023

The Transportation sector cyber threat overview

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Transportation sector cyber threat overview
31 August 2023

From Hidden Bee to Rhadamanthys – The Evolution of Custom Executable Formats

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From Hidden Bee to Rhadamanthys – The Evolution of Custom Executable Formats
3 August 2023

Golang Garble String Decryption

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Golang Garble String Decryption
18 July 2023

NemesisProject

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor NemesisProject
12 July 2023

The GRU's Disruptive Playbook | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The GRU's Disruptive Playbook | Mandiant
11 July 2023

2023%20Q2%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023%20Q2%20Botnet%20Threat%20Update.pdf
15 June 2023

eSentire Threat Intelligence Malware Analysis: Resident Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eSentire Threat Intelligence Malware Analysis: Resident Campaign
14 June 2023

Cadet Blizzard emerges as a novel and distinct Russian threat actor | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cadet Blizzard emerges as a novel and distinct Russian threat actor | Microsoft Security Blog
26 May 2023

New Info Stealer Bandit Stealer Targets Browsers, Wallets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Info Stealer Bandit Stealer Targets Browsers, Wallets
4 May 2023

Sandworm Attackers Use WinRAR to Wipe Data from Government Devices

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sandworm Attackers Use WinRAR to Wipe Data from Government Devices
19 April 2023

Ukraine remains Russia’s biggest cyber focus in 2023

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ukraine remains Russia’s biggest cyber focus in 2023
19 April 2023

Ukraine remains Russia’s biggest cyber focus in 2023

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Ukraine remains Russia’s biggest cyber focus in 2023
15 April 2023

Dissecting Npm Malware- Five Packages And Their Evil Install Scripts

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Dissecting Npm Malware- Five Packages And Their Evil Install Scripts
14 April 2023

2022 ICS/OT Threat Landscape Recap & What to Watch for This Year

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2022 ICS/OT Threat Landscape Recap & What to Watch for This Year
12 April 2023

2023%20Q1%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023%20Q1%20Botnet%20Threat%20Update.pdf
30 March 2023

Contracts Identify Cyber Operations Projects from Russian Company NTC Vulkan

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Contracts Identify Cyber Operations Projects from Russian Company NTC Vulkan
30 March 2023

Contracts Identify Cyber Operations Projects from Russian Company NTC Vulkan | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Contracts Identify Cyber Operations Projects from Russian Company NTC Vulkan | Mandiant
24 March 2023

APT attacks on industrial organizations in H2 2022 | Kaspersky ICS CERT EN

Malpedia library date Kaspersky fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT attacks on industrial organizations in H2 2022 | Kaspersky ICS CERT EN
15 March 2023

Microsoft Security Compliance and Identity

Malpedia library date Microsoft fromORKL

The original link failed its last check. Original publisher Detailsfor Microsoft Security Compliance and Identity
21 February 2023

One Year After: The Cyber Implications of the Russo-Ukrainian War

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor One Year After: The Cyber Implications of the Russo-Ukrainian War
21 February 2023

Tech Analysis of Rhadamanthys Obfuscation Techniques | Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tech Analysis of Rhadamanthys Obfuscation Techniques | Blog
15 February 2023

google_fog_of_war_research_report.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor google_fog_of_war_research_report.pdf
3 February 2023

UAC-0114 Group aka Winter Vivern Attack Detection: Hackers Launch Phishing Campaigns Targeting Government Entities of Ukraine and Poland

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UAC-0114 Group aka Winter Vivern Attack Detection: Hackers Launch Phishing Campaigns Targeting Government Entities of Ukraine and Poland
31 January 2023

eset_apt_activity_report_t32022.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eset_apt_activity_report_t32022.pdf
30 January 2023

APT Activity Report T3 2022 Sandworm Deploying its Enhanced Wiper Arsenal

date in the CCS '25 data ESET fromCCS '25 data

Detailsfor APT Activity Report T3 2022 Sandworm Deploying its Enhanced Wiper Arsenal
29 January 2023

Petya/Not Petya Ransomware:

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Petya/Not Petya Ransomware:
27 January 2023

SwiftSlicer- New destructive wiper malware strikes Ukraine

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor SwiftSlicer- New destructive wiper malware strikes Ukraine
27 January 2023

CERT-UA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERT-UA
27 January 2023

SwiftSlicer: New destructive wiper malware strikes Ukraine

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SwiftSlicer: New destructive wiper malware strikes Ukraine
24 January 2023

The Year of the Wiper | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Year of the Wiper | FortiGuard Labs
16 January 2023

Dancing With Shellcodes: Analyzing Rhadamanthys Stealer

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dancing With Shellcodes: Analyzing Rhadamanthys Stealer
12 January 2023

RhadaManthys Stealer Spreading Via Google Ads: Key Insights

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RhadaManthys Stealer Spreading Via Google Ads: Key Insights
3 January 2023

Malware-Traffic-Analysis.net - 2023-01-03 - Google ad --> fake Notepad++ page --

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware-Traffic-Analysis.net - 2023-01-03 - Google ad --> fake Notepad++ page --
16 December 2022

Russia’s Wartime Cyber Operations in Ukraine- Military Impacts, Influences, and Implications

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Russia’s Wartime Cyber Operations in Ukraine- Military Impacts, Influences, and Implications
5 December 2022

What We Think | Business & Technology Insights

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What We Think | Business & Technology Insights
3 December 2022

Preparing for a Russian cyber offensive against Ukraine this winter

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Preparing for a Russian cyber offensive against Ukraine this winter
3 December 2022

Preparing for a Russian cyber offensive against Ukraine this winter - Microsoft On the Issues

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Preparing for a Russian cyber offensive against Ukraine this winter - Microsoft On the Issues
30 November 2022

Unpacking Colibri Loader- A Russian APT linked Campaign

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Unpacking Colibri Loader- A Russian APT linked Campaign
30 November 2022

Unpacking Colibri Loader: A Russian APT linked Campaign

Malpedia library date BitSight fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Unpacking Colibri Loader: A Russian APT linked Campaign
18 November 2022

GRU 26165: The Russian cyber unit that hacks targets on-site

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GRU 26165: The Russian cyber unit that hacks targets on-site
16 November 2022

Inside the Mind of a ‘Rat’ - Agent Tesla Detection and Analysis

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Inside the Mind of a ‘Rat’ - Agent Tesla Detection and Analysis
31 October 2022

Mondelez and Zurich reach settlement in NotPetya cyberattack insurance suit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mondelez and Zurich reach settlement in NotPetya cyberattack insurance suit
25 October 2022

Conceptualizing a Continuum of Cyber Threat Attribution

date ORKL added it fromORKL

The original link failed its last check. Original publisher Detailsfor Conceptualizing a Continuum of Cyber Threat Attribution
20 October 2022

eset_threat_report_t22021.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor eset_threat_report_t22021.pdf
14 October 2022

New “Prestige” ransomware impacts organizations in Ukraine and Poland

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New “Prestige” ransomware impacts organizations in Ukraine and Poland
26 September 2022

The Anatomy of Wiper Malware, Part 3: Input/Output Controls | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Anatomy of Wiper Malware, Part 3: Input/Output Controls | CrowdStrike
23 September 2022

Hacktivists Collaborate with GRU-sponsored Threat Actors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hacktivists Collaborate with GRU-sponsored Threat Actors
19 September 2022

Russia-Nexus UAC-0113 Emulating Telecommunication Providers in Ukraine

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Russia-Nexus UAC-0113 Emulating Telecommunication Providers in Ukraine
18 August 2022

Overview of the Cyber Weapons Used in the Ukraine - Russia War

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Overview of the Cyber Weapons Used in the Ukraine - Russia War
18 August 2022

Overview of the Cyber Weapons Used in the Ukraine - Russia War | Trustwave

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Overview of the Cyber Weapons Used in the Ukraine - Russia War | Trustwave
12 August 2022

The Anatomy of Wiper Malware, Part 1: Common Techniques | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Anatomy of Wiper Malware, Part 1: Common Techniques | CrowdStrike
31 July 2022

Space Invaders- Cyber Threats That Are Out Of This World

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Space Invaders- Cyber Threats That Are Out Of This World
31 July 2022

Space Invaders: Cyber Threats That Are Out Of This World

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Space Invaders: Cyber Threats That Are Out Of This World
26 July 2022

Mandiant Red Team Emulates FIN11 Tactics To Control Operational Technology Servers | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mandiant Red Team Emulates FIN11 Tactics To Control Operational Technology Servers | Mandiant
19 July 2022

Continued cyber activity in Eastern Europe observed by TAG

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Continued cyber activity in Eastern Europe observed by TAG
19 July 2022

Continued cyber activity in Eastern Europe observed by TAG

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Continued cyber activity in Eastern Europe observed by TAG
14 July 2022

Industroyer2 and INCONTROLLER In-depth Technical Analysis of the Most Recent ICS-specific Malware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Industroyer2 and INCONTROLLER In-depth Technical Analysis of the Most Recent ICS-specific Malware
24 June 2022

CERT-UA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERT-UA
24 June 2022

Deep Analysis of Snake Keylogger

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Deep Analysis of Snake Keylogger
24 June 2022

Deep Analysis of Snake Keylogger

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Deep Analysis of Snake Keylogger
23 June 2022

Threat Update: Industroyer2 | Splunk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Update: Industroyer2 | Splunk
13 June 2022

Risky Biz News: Google shuts down YouTube Russian propaganda channels

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Risky Biz News: Google shuts down YouTube Russian propaganda channels
10 June 2022

CERT-UA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERT-UA
31 May 2022

Industroyer vs. Industroyer2

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Industroyer vs. Industroyer2
26 May 2022

eset_threat_report_t12022

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor eset_threat_report_t12022
18 May 2022

How ntopng monitors IEC 60870-5-104 traffic – ntop

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How ntopng monitors IEC 60870-5-104 traffic – ntop
13 May 2022

UNC1151 Assessed with High Confidence to have Links to Belarus, Ghostwriter Campaign Aligned with Belarusian Government Interests _ Mandiant

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor UNC1151 Assessed with High Confidence to have Links to Belarus, Ghostwriter Campaign Aligned with Belarusian Government Interests _ Mandiant
12 May 2022

Threat Thursday- Malware Rebooted - How Industroyer2 Takes Aim at Ukraine Infrastructure

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Threat Thursday- Malware Rebooted - How Industroyer2 Takes Aim at Ukraine Infrastructure
12 May 2022

Network Footprints of Gamaredon Group

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Network Footprints of Gamaredon Group
12 May 2022

Network Footprints of Gamaredon Group

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Network Footprints of Gamaredon Group
12 May 2022

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog
12 May 2022

Threat Thursday_ Malware Rebooted - How Industroyer2 Takes Aim at Ukraine Infrastructure

date in the CCS '25 data BlackBerry fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Threat Thursday_ Malware Rebooted - How Industroyer2 Takes Aim at Ukraine Infrastructure
9 May 2022

Malware development: persistence - part 4. Windows services. Simple C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development: persistence - part 4. Windows services. Simple C++ example.
6 May 2022

Attackers Deploy New ICS Attack Framework - TRITON - and Cause Operational Disruption to Critical Infrastructure.pdf

file creation date fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Attackers Deploy New ICS Attack Framework - TRITON - and Cause Operational Disruption to Critical Infrastructure.pdf
6 May 2022

Russian Cyber Attack campaigns and actors - NOBELIUM has struck again.pdf

file creation date fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Russian Cyber Attack campaigns and actors - NOBELIUM has struck again.pdf
6 May 2022

BE2 custom plugins, router abuse, and target profiles.pdf

file creation date fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor BE2 custom plugins, router abuse, and target profiles.pdf
6 May 2022

Russian cyber attack campaigns and actors.pdf

file creation date fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Russian cyber attack campaigns and actors.pdf
6 May 2022

Black Energy – Analysis.pdf

file creation date fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Black Energy – Analysis.pdf
28 April 2022

An Overview of the Increasing Wiper Malware Threat | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor An Overview of the Increasing Wiper Malware Threat | FortiGuard Labs
27 April 2022

Industroyer2: Nozomi Networks Labs Analyzes the IEC 104 Payload

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Industroyer2: Nozomi Networks Labs Analyzes the IEC 104 Payload
25 April 2022

INDUSTROYER.V2: Old Malware Learns New Tricks | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor INDUSTROYER.V2: Old Malware Learns New Tricks | Mandiant
25 April 2022

Industroyer2 IEC-104 Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Industroyer2 IEC-104 Analysis
23 April 2022

Industroyer2 in Perspective

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Industroyer2 in Perspective
23 April 2022

Industroyer2 in Perspective

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Industroyer2 in Perspective
23 April 2022

Industroyer2 in Perspective

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Industroyer2 in Perspective
20 April 2022

Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure

file creation date CISA, NSA, FBI fromORKL

Archived copy on ORKL Detailsfor Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure
20 April 2022

Russian State-Sponsored and Criminal Cyber .pdf

file creation date fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Russian State-Sponsored and Criminal Cyber .pdf
20 April 2022

AA22-110A_Joint_CSA_Russian_State-Sponsored_and_Criminal_Cyber_Threats_to_Critical_Infrastructure_4_20_22_Final.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AA22-110A_Joint_CSA_Russian_State-Sponsored_and_Criminal_Cyber_Threats_to_Critical_Infrastructure_4_20_22_Final.pdf
20 April 2022

Alert (AA22-110A)- Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Alert (AA22-110A)- Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure
20 April 2022

Malware development: persistence - part 1. Registry run keys. C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development: persistence - part 1. Registry run keys. C++ example.
20 April 2022

Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure | CISA
12 April 2022

Industroyer2- Industroyer reloaded

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Industroyer2- Industroyer reloaded
12 April 2022

Ghidra script to handle stack strings – Max Kersten

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ghidra script to handle stack strings – Max Kersten
12 April 2022

Industroyer2: Industroyer reloaded

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Industroyer2: Industroyer reloaded
12 April 2022

Industroyer2 Industroyer Reloaded

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Industroyer2 Industroyer Reloaded
12 April 2022

CERT-UA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERT-UA
12 April 2022

Cyberattack by Sandworm Group (UAC-0082) on energy facilities of Ukraine using malicious programs INDUSTROYER2 and CADDYWIPER

date in the CCS '25 data CERT-UA fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Cyberattack by Sandworm Group (UAC-0082) on energy facilities of Ukraine using malicious programs INDUSTROYER2 and CADDYWIPER
12 April 2022

Industroyer2- Industroyer reloaded

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Industroyer2- Industroyer reloaded
12 April 2022

Industroyer2: Industroyer reloaded

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Industroyer2: Industroyer reloaded
11 April 2022

CISA warns orgs of WatchGuard bug exploited by Russian state hackers

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor CISA warns orgs of WatchGuard bug exploited by Russian state hackers
11 April 2022

CISA warns orgs of WatchGuard bug exploited by Russian state hackers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CISA warns orgs of WatchGuard bug exploited by Russian state hackers
7 April 2022

Ukraine CyberWar Overview

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Ukraine CyberWar Overview
6 April 2022

US disrupts Russian Cyclops Blink botnet before being used in attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor US disrupts Russian Cyclops Blink botnet before being used in attacks
6 April 2022

US disrupts Russian Cyclops Blink botnet before being used in attacks

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor US disrupts Russian Cyclops Blink botnet before being used in attacks
6 April 2022

Justice Department Announces Court-Authorized Disruption of Botnet Controlled by the Russian Federation’s Main Intelligence Directorate (GRU)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Justice Department Announces Court-Authorized Disruption of Botnet Controlled by the Russian Federation’s Main Intelligence Directorate (GRU)
6 April 2022

Justice Department Announces Court-Authorized Disruption of Botnet Controlled by the Russian Federation’s Main Intelligence Directorate (GRU)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Justice Department Announces Court-Authorized Disruption of Botnet Controlled by the Russian Federation’s Main Intelligence Directorate (GRU)
5 April 2022

New Analysis: The CaddyWiper Malware Attacking Ukraine

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Analysis: The CaddyWiper Malware Attacking Ukraine
1 April 2022

Threat Update: CaddyWiper | Splunk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Update: CaddyWiper | Splunk
31 March 2022

AcidRain | A Modem Wiper Rains Down on Europe

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AcidRain | A Modem Wiper Rains Down on Europe
31 March 2022

Viasat confirms satellite modems were wiped with AcidRain malware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Viasat confirms satellite modems were wiped with AcidRain malware
31 March 2022

AcidRain: A Modem Wiper Rains Down on Europe

date in the CCS '25 data Sentinelone fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor AcidRain: A Modem Wiper Rains Down on Europe
31 March 2022

eSentire Threat Intelligence Malware Analysis: CaddyWiper

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eSentire Threat Intelligence Malware Analysis: CaddyWiper
31 March 2022

AcidRain - A Modem Wiper Rains Down on Europe

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor AcidRain - A Modem Wiper Rains Down on Europe
30 March 2022

EMBER BEAR: Threat Actor Profile | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor EMBER BEAR: Threat Actor Profile | CrowdStrike
30 March 2022

Who is EMBER BEAR-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Who is EMBER BEAR-
30 March 2022

EMBER BEAR: Threat Actor Profile | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor EMBER BEAR: Threat Actor Profile | CrowdStrike
26 March 2022

Analysis of a Caddy Wiper Sample Targeting Ukraine

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis of a Caddy Wiper Sample Targeting Ukraine
24 March 2022

Ukrainian Cyber Lead Says ‘At Least 4 Types of Malware’ in Use to Target Critical Infrastructure and Humanitarian Aid

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ukrainian Cyber Lead Says ‘At Least 4 Types of Malware’ in Use to Target Critical Infrastructure and Humanitarian Aid
23 March 2022

New Sandworm Malware Cyclops Blink Replaces VPNFilter

date in the CCS '25 data CISA fromCCS '25 data

The link to Mirror on Box failed its last check. Detailsfor New Sandworm Malware Cyclops Blink Replaces VPNFilter
21 March 2022

Sandworm: A tale of disruption told anew

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sandworm: A tale of disruption told anew
21 March 2022

Sandworm- A tale of disruption told anew

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Sandworm- A tale of disruption told anew
18 March 2022

Cyclops Blink malware sets up shop in ASUS routers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyclops Blink malware sets up shop in ASUS routers
18 March 2022

Double header: IsaacWiper and CaddyWiper

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Double header: IsaacWiper and CaddyWiper
18 March 2022

Cyclops Blink malware sets up shop in ASUS routers

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Cyclops Blink malware sets up shop in ASUS routers
18 March 2022

Ghostwriter in the Shell: Expanding on Mandiant’s Attribution of UNC1151 to Belarus

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ghostwriter in the Shell: Expanding on Mandiant’s Attribution of UNC1151 to Belarus
17 March 2022

Cyclops Blink Sets Sights on Asus Routers

date in the CCS '25 data Trend Micro fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Cyclops Blink Sets Sights on Asus Routers
17 March 2022

Cyclops Blink Sets Sights on Asus Routers

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Cyclops Blink Sets Sights on Asus Routers
17 March 2022

Analysis of CaddyWiper

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis of CaddyWiper
17 March 2022

ASUS warns of Cyclops Blink malware attacks targeting routers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ASUS warns of Cyclops Blink malware attacks targeting routers
17 March 2022

ASUS warns of Cyclops Blink malware attacks targeting routers

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor ASUS warns of Cyclops Blink malware attacks targeting routers
17 March 2022

Cyclops Blink Sets Sights on Asus Routers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyclops Blink Sets Sights on Asus Routers
16 March 2022

China’s Government Is Learning From Russia’s Cyberattacks Against Ukraine

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor China’s Government Is Learning From Russia’s Cyberattacks Against Ukraine
16 March 2022

Destructive Data Wiper Malware Targeting high-profile Ukrainian Organizations

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Destructive Data Wiper Malware Targeting high-profile Ukrainian Organizations
15 March 2022

CaddyWiper, a new data wiper hits Ukraine

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CaddyWiper, a new data wiper hits Ukraine
15 March 2022

Analysis of CaddyWiper, Wiper Targeting Ukraine - Truesec

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis of CaddyWiper, Wiper Targeting Ukraine - Truesec
15 March 2022

CaddyWiper: New wiper malware discovered in Ukraine

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CaddyWiper: New wiper malware discovered in Ukraine
15 March 2022

Threat Advisory: CaddyWiper

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Advisory: CaddyWiper
15 March 2022

CaddyWiper: Yet Another Data Wiping Malware Targeting Ukrainian Networks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CaddyWiper: Yet Another Data Wiping Malware Targeting Ukrainian Networks
14 March 2022

New CaddyWiper data wiping malware hits Ukrainian networks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New CaddyWiper data wiping malware hits Ukrainian networks
14 March 2022

New CaddyWiper data wiping malware hits Ukrainian networks

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New CaddyWiper data wiping malware hits Ukrainian networks
4 March 2022

Responses to Russia's Invasion of Ukraine Likely to Spur Retaliation | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Responses to Russia's Invasion of Ukraine Likely to Spur Retaliation | Mandiant
4 March 2022

Responses to Russia's Invasion of Ukraine Likely to Spur Retaliation

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Responses to Russia's Invasion of Ukraine Likely to Spur Retaliation
2 March 2022

HermeticWiper and PartyTicket Targeting Computers in Ukraine

date in the CCS '25 data RecordedFuture fromCCS '25 data

The link to Mirror on Box failed its last check. Detailsfor HermeticWiper and PartyTicket Targeting Computers in Ukraine
1 March 2022

What is HermeticWiper – An Analysis of the Malware and Larger Threat Landscape in the Russian Ukrainian War

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor What is HermeticWiper – An Analysis of the Malware and Larger Threat Landscape in the Russian Ukrainian War
28 February 2022

Cyber threat activity in Ukraine: analysis and resources

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber threat activity in Ukraine: analysis and resources
28 February 2022

Cyber threat activity in Ukraine- analysis and resources

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Cyber threat activity in Ukraine- analysis and resources
25 February 2022

Russia or Ukraine: Hacking groups take sides

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Russia or Ukraine: Hacking groups take sides
25 February 2022

What You Need to Know About Russian Cyber Escalation in Ukraine

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What You Need to Know About Russian Cyber Escalation in Ukraine
25 February 2022

Russia or Ukraine- Hacking groups take sides

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Russia or Ukraine- Hacking groups take sides
25 February 2022

What You Need to Know About Russian Cyber Escalation in Ukraine

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor What You Need to Know About Russian Cyber Escalation in Ukraine
24 February 2022

Threat Update – Ukraine & Russia conflict

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Threat Update – Ukraine & Russia conflict
24 February 2022

Talos on the developing situation in Ukraine

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Talos on the developing situation in Ukraine
24 February 2022

Threat Update – Ukraine & Russia war

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Update – Ukraine & Russia war
24 February 2022

Report-OSINT-Russia-Ukraine-Conflict-Cyberaspect.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Report-OSINT-Russia-Ukraine-Conflict-Cyberaspect.pdf
23 February 2022

Shadowserver Special Reports – Cyclops Blink

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Shadowserver Special Reports – Cyclops Blink
23 February 2022

New Sandworm Malware Cyclops Blink Replaces VPNFilter

Malpedia library date CISA fromORKL

Archived copy on ORKL Detailsfor New Sandworm Malware Cyclops Blink Replaces VPNFilter
23 February 2022

Security warning- Hackers are using this new malware to target firewall appliances

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Security warning- Hackers are using this new malware to target firewall appliances
23 February 2022

New Sandworm malware Cyclops Blink replaces VPNFilter

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New Sandworm malware Cyclops Blink replaces VPNFilter
23 February 2022

Cyclops-Blink-Malware-Analysis-Report.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyclops-Blink-Malware-Analysis-Report.pdf
23 February 2022

New Sandworm Malware Cyclops Blink Replaces VPNFilter | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Sandworm Malware Cyclops Blink Replaces VPNFilter | CISA
23 February 2022

Alert (AA22-054A) New Sandworm Malware Cyclops Blink Replaces VPNFilter

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Alert (AA22-054A) New Sandworm Malware Cyclops Blink Replaces VPNFilter
23 February 2022

Shadowserver Special Reports – Cyclops Blink

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Shadowserver Special Reports – Cyclops Blink
23 February 2022

New Sandworm malware Cyclops Blink replaces VPNFilter

file creation date NCSC-UK, CISA, FBI, NSA fromORKL

Archived copy on ORKL Detailsfor New Sandworm malware Cyclops Blink replaces VPNFilter
23 February 2022

New Sandworm malware Cyclops Blink replaces VPNFilter

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Sandworm malware Cyclops Blink replaces VPNFilter
14 February 2022

Var tæt på at slukke tusindvis af vindmøller: Nu fortæller Vestas om cyberangreb

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Var tæt på at slukke tusindvis af vindmøller: Nu fortæller Vestas om cyberangreb
14 February 2022

Var tæt på at slukke tusindvis af vindmøller- Nu fortæller Vestas om cyberangreb

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Var tæt på at slukke tusindvis af vindmøller- Nu fortæller Vestas om cyberangreb
9 February 2022

eset_threat_report_t32021.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eset_threat_report_t32021.pdf
8 February 2022

eset_threat_report_t32021

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor eset_threat_report_t32021
28 January 2022

Past Cyber Operations Against Ukraine and What May Be Next

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Past Cyber Operations Against Ukraine and What May Be Next
28 January 2022

Lessons Learned From Successive Use of Offensive Cyber Operations Against Ukraine and What May Be Next

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Lessons Learned From Successive Use of Offensive Cyber Operations Against Ukraine and What May Be Next
21 January 2022

Deep Analysis Agent Tesla Malware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Deep Analysis Agent Tesla Malware
20 January 2022

Anticipating Cyber Threats as the Ukraine Crisis Escalates | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Anticipating Cyber Threats as the Ukraine Crisis Escalates | Mandiant
20 January 2022

Anticipating Cyber Threats as the Ukraine Crisis Escalates

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Anticipating Cyber Threats as the Ukraine Crisis Escalates
20 January 2022

Anticipating and Preparing for Russian Cyber Activity

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Anticipating and Preparing for Russian Cyber Activity
19 January 2022

Technical Analysis of the WhisperGate Malicious Bootloader

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Technical Analysis of the WhisperGate Malicious Bootloader
19 January 2022

Technical Analysis of the WhisperGate Malicious Bootloader | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Technical Analysis of the WhisperGate Malicious Bootloader | CrowdStrike
12 January 2022

Deep analysis agent tesla malware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Deep analysis agent tesla malware
11 January 2022

Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S. Critical Infrastructure

date in the CCS '25 data cisa fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S. Critical Infrastructure
11 January 2022

Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S. Critical Infrastructure

Malpedia library date CISA, NSA, FBI fromORKL

Archived copy on ORKL Detailsfor Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S. Critical Infrastructure
16 November 2021

UNC1151 Assessed with High Confidence to have Links to Belarus, Ghostwriter Campaign Aligned with Belarusian Government Interests

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor UNC1151 Assessed with High Confidence to have Links to Belarus, Ghostwriter Campaign Aligned with Belarusian Government Interests
16 November 2021

UNC1151 Assessed with High Confidence to have Links to Belarus, Ghostwriter Campaign Aligned with Belarusian Government Interests

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UNC1151 Assessed with High Confidence to have Links to Belarus, Ghostwriter Campaign Aligned with Belarusian Government Interests
16 November 2021

UNC1151_Assessed-with-High-Confidence-to-have-Links-to-Belarus_Mandiant

date in the CCS '25 data Mandiant fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor UNC1151_Assessed-with-High-Confidence-to-have-Links-to-Belarus_Mandiant
4 November 2021

Deep Dive into a Fresh Variant of Snake Keylogger Malware | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Deep Dive into a Fresh Variant of Snake Keylogger Malware | FortiGuard Labs
28 October 2021

THREAT ANALYSIS REPORT: Snake Infostealer Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor THREAT ANALYSIS REPORT: Snake Infostealer Malware
23 September 2021

eset_threat_report_t22021

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor eset_threat_report_t22021
9 September 2021

Dark Covenant: Connections Between the Russian State and Criminal Actors

Malpedia library date Insikt Group® fromORKL

Archived copy on ORKL Detailsfor Dark Covenant: Connections Between the Russian State and Criminal Actors
13 August 2021

The Ghostwriter Scenario (UNC1151)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Ghostwriter Scenario (UNC1151)
5 August 2021

Attacks Against Critical Infrastructure (White Paper)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attacks Against Critical Infrastructure (White Paper)
27 July 2021

Ghosts on the Wire: Expanding Conceptions of Network Anomalies

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ghosts on the Wire: Expanding Conceptions of Network Anomalies
27 July 2021

Ghosts on the Wire- Expanding Conceptions of Network Anomalies

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Ghosts on the Wire- Expanding Conceptions of Network Anomalies
27 July 2021

report-old-dogs-new-tricks.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor report-old-dogs-new-tricks.pdf
15 July 2021

Threats to the 2020 Tokyo Olympic Games

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threats to the 2020 Tokyo Olympic Games
24 June 2021

VB2021 paper: The Baffling Berserk Bear: A Decade’s Activity Targeting Critical Infrastructur

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor VB2021 paper: The Baffling Berserk Bear: A Decade’s Activity Targeting Critical Infrastructur
7 May 2021

What is ransomware?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What is ransomware?
29 April 2021

Dragos_2020_ICS_Cybersecurity_Year_In_Review.pdf?hsCtaTracking=159c0fc3-92d8-425d-aeb8-12824f2297e8%7Cf163726d-579b-4996-9a04-44e5a124d770

file creation date fromORKL

Archived copy on ORKL Detailsfor Dragos_2020_ICS_Cybersecurity_Year_In_Review.pdf?hsCtaTracking=159c0fc3-92d8-425d-aeb8-12824f2297e8%7Cf163726d-579b-4996-9a04-44e5a124d770
29 April 2021

ESET_Industry_Report_Government.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET_Industry_Report_Government.pdf
29 April 2021

Combating Ransomware - A Comprehensive Framework for Action: Key Recommendations from the Ransomware Task Force

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Combating Ransomware - A Comprehensive Framework for Action: Key Recommendations from the Ransomware Task Force
27 April 2021

APT trends report Q1 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q1 2021
4 April 2021

Technical report of AgentTesla

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Technical report of AgentTesla
3 March 2021

Centreon to Exim and Back- On the Trail of Sandworm

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Centreon to Exim and Back- On the Trail of Sandworm
3 March 2021

Centreon to Exim and Back: On the Trail of Sandworm - DomainTools | Start Here. Know Now.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Centreon to Exim and Back: On the Trail of Sandworm - DomainTools | Start Here. Know Now.
15 February 2021

France Ties Russia's Sandworm to a Multiyear Hacking Spree

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor France Ties Russia's Sandworm to a Multiyear Hacking Spree
11 February 2021

Monitoring Critical Infrastructure and Security

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Monitoring Critical Infrastructure and Security
8 February 2021

What Is the Point of These Nation-State Indictments-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor What Is the Point of These Nation-State Indictments-
8 February 2021

Auf Tätersuche- Herausforderungen bei der Analyse von Cyber-Angriffen

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Auf Tätersuche- Herausforderungen bei der Analyse von Cyber-Angriffen
8 February 2021

What Is the Point of These Nation-State Indictments?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What Is the Point of These Nation-State Indictments?
27 January 2021

CERTFR-2021-CTI-005.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERTFR-2021-CTI-005.pdf
14 January 2021

The Devil’s in the Details- SUNBURST Attribution

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Devil’s in the Details- SUNBURST Attribution
14 January 2021

The Devil’s in the Details: SUNBURST Attribution - DomainTools | Start Here. Know Now.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Devil’s in the Details: SUNBURST Attribution - DomainTools | Start Here. Know Now.
21 December 2020

Russian cyber attack campaigns and actors

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Russian cyber attack campaigns and actors
9 December 2020

A Zebra in Gopher's Clothing: Russian APT Uses COVID-19 Lures to Deliver Zebrocy

Malpedia library date Intezer fromORKLCCS '25 data

Archived copy on ORKL Detailsfor A Zebra in Gopher's Clothing: Russian APT Uses COVID-19 Lures to Deliver Zebrocy
9 December 2020

Russian APT Uses COVID-19 Lures to Deliver Zebrocy - Intezer

date in the CCS '25 data Intezer fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Russian APT Uses COVID-19 Lures to Deliver Zebrocy - Intezer
9 December 2020

A Zebra in Gopher's Clothing- Russian APT Uses COVID-19 Lures to Deliver Zebrocy

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor A Zebra in Gopher's Clothing- Russian APT Uses COVID-19 Lures to Deliver Zebrocy
17 November 2020

Ukraine’s Top Cyber Cop on Defending Against Disinformation and Russian Hackers

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Ukraine’s Top Cyber Cop on Defending Against Disinformation and Russian Hackers
12 November 2020

Dragos_Manufacturing%20Threat%20Perspective_1120.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dragos_Manufacturing%20Threat%20Perspective_1120.pdf
11 November 2020

Extrapolating Adversary Intent Through Infrastructure

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Extrapolating Adversary Intent Through Infrastructure
4 November 2020

The Enigmatic Energetic Bear

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Enigmatic Energetic Bear
4 November 2020

The Enigmatic Energetic Bear

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Enigmatic Energetic Bear
26 October 2020

The Russian Hackers (BERSERK BEAR) Playing 'Chekhov's Gun' With US Infrastructure

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Russian Hackers (BERSERK BEAR) Playing 'Chekhov's Gun' With US Infrastructure
19 October 2020

US charges Russian GRU officers for NotPetya, other major hacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor US charges Russian GRU officers for NotPetya, other major hacks
19 October 2020

Revisited- Fancy Bear's New Faces...and Sandworms' too

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Revisited- Fancy Bear's New Faces...and Sandworms' too
19 October 2020

UK exposes series of Russian cyber attacks against Olympic and Paralympic Games

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UK exposes series of Russian cyber attacks against Olympic and Paralympic Games
19 October 2020

US charges Russian GRU officers for NotPetya, other major hacks

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor US charges Russian GRU officers for NotPetya, other major hacks
19 October 2020

US Indicts Sandworm, Russia's Most Destructive Cyberwar Unit

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor US Indicts Sandworm, Russia's Most Destructive Cyberwar Unit
19 October 2020

UK exposes series of Russian cyber attacks against Olympic and Paralympic Games

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor UK exposes series of Russian cyber attacks against Olympic and Paralympic Games
15 October 2020

2020.10.15_Operation_Quicksand_MuddyWater’s_Offensive_Attack_Against_Israeli

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 2020.10.15_Operation_Quicksand_MuddyWater’s_Offensive_Attack_Against_Israeli
29 August 2020

Emulating NotPetya bootloader with Miasm |

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emulating NotPetya bootloader with Miasm |
13 August 2020

Attribution- A Puzzle

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Attribution- A Puzzle
13 August 2020

Attribution: A Puzzle

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attribution: A Puzzle
29 July 2020

ESET_Threat_Report_Q22020.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET_Threat_Report_Q22020.pdf
29 July 2020

ESET_Threat_Report_Q22020

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ESET_Threat_Report_Q22020
29 July 2020

Breaking-trust-Shades-of-crisis-across-an-insecure-software-supply-chain.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Breaking-trust-Shades-of-crisis-across-an-insecure-software-supply-chain.pdf
29 July 2020

APT trends report Q2 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q2 2020
24 July 2020

Russia's GRU Hackers Hit US Government and Energy Targets

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Russia's GRU Hackers Hit US Government and Energy Targets
12 June 2020

Probable Sandworm Infrastructure

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Probable Sandworm Infrastructure
9 June 2020

Looking at Big Threats Using Code Similarity. Part 1

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Looking at Big Threats Using Code Similarity. Part 1
1 June 2020

Russian Cyber Attack Campaigns and Actors - Threat Research

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Russian Cyber Attack Campaigns and Actors - Threat Research
28 May 2020

NSA- Russia's Sandworm Hackers Have Hijacked Mail Servers

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor NSA- Russia's Sandworm Hackers Have Hijacked Mail Servers
28 May 2020

Silos of Excellence

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Silos of Excellence
28 May 2020

CSA Sandworm Actors Exploiting Vulnerability in Exim Transfer Agent

Malpedia library date fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor CSA Sandworm Actors Exploiting Vulnerability in Exim Transfer Agent
26 May 2020

ESET_Turla_ComRAT

Malpedia library date ESET fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ESET_Turla_ComRAT
21 May 2020

MITRE ATT&CK T1055 Process Injection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MITRE ATT&CK T1055 Process Injection
15 May 2020

Mikroceen_ Spying backdoor leveraged in high‑profile networks in Central Asia _ WeLiveSecurity

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Mikroceen_ Spying backdoor leveraged in high‑profile networks in Central Asia _ WeLiveSecurity
14 May 2020

Mikroceen: Spying backdoor leveraged in high-profile networks in Central Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mikroceen: Spying backdoor leveraged in high-profile networks in Central Asia
14 May 2020

APT group planted backdoors targeting high profile networks in Central Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT group planted backdoors targeting high profile networks in Central Asia
14 May 2020

Mikroceen- Spying backdoor leveraged in high‑profile networks in Central Asia

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Mikroceen- Spying backdoor leveraged in high‑profile networks in Central Asia
27 April 2020

ESET_Threat_Report_Q12020

date in the CCS '25 data ESET fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ESET_Threat_Report_Q12020
5 March 2020

Human-operated ransomware attacks: A preventable disaster | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Human-operated ransomware attacks: A preventable disaster | Microsoft Security Blog
1 March 2020

Spyware-Stealer-Locker-Wiper-LockerGoga-Revisited.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Spyware-Stealer-Locker-Wiper-LockerGoga-Revisited.pdf
24 February 2020

The ICS Threat Landscape and Activity Groups

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor The ICS Threat Landscape and Activity Groups
20 February 2020

UK condemns Russia's GRU over Georgia cyber-attacks

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor UK condemns Russia's GRU over Georgia cyber-attacks
31 January 2020

Rich Headers- leveraging this mysterious artifact of the PE format

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Rich Headers- leveraging this mysterious artifact of the PE format
31 January 2020

leveraging this mysterious artifact of the PE format

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor leveraging this mysterious artifact of the PE format
1 January 2020

North American Electric Cyber Threat Perspective

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor North American Electric Cyber Threat Perspective
1 January 2020

Microsoft Word - Threat Intelligence and the Limits of Malware Analysis_smc1.docx

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Word - Threat Intelligence and the Limits of Malware Analysis_smc1.docx
17 October 2019

Inside Olympic Destroyer, the Most Deceptive Hack in History

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Inside Olympic Destroyer, the Most Deceptive Hack in History
17 October 2019

The Untold Story of the 2018 Olympics Cyberattack, the Most Deceptive Hack in History

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Untold Story of the 2018 Olympics Cyberattack, the Most Deceptive Hack in History
17 October 2019

Operation Ghost

Malpedia library date ESET fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation Ghost
15 August 2019

CRASHOVERRIDE: Reassessing the 2016 Ukraine Electric Power Event as a Protection-Focused Attack

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor CRASHOVERRIDE: Reassessing the 2016 Ukraine Electric Power Event as a Protection-Focused Attack
1 August 2019

APT trends report Q2 2019

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q2 2019
1 August 2019

Industrial Cybersecurity Threat Briefing

file creation date fromORKL

Archived copy on ORKL Detailsfor Industrial Cybersecurity Threat Briefing
1 August 2019

Dragos - Global Oil and Gas Cyber Threat Perspctive

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Dragos - Global Oil and Gas Cyber Threat Perspctive
1 August 2019

ClearSky-2019-H1-Cyber-Events-Summary-Report.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ClearSky-2019-H1-Cyber-Events-Summary-Report.pdf
3 June 2019

Zebrocy Multilanguage Malware Salad

date in the CCS '25 data EFF fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Zebrocy Multilanguage Malware Salad
3 June 2019

Zebrocy’s Multilanguage Malware Salad

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Zebrocy’s Multilanguage Malware Salad
3 June 2019

Zebrocy’s Multilanguage Malware Salad

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Zebrocy’s Multilanguage Malware Salad
20 May 2019

Malware Against the C Monoculture

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Against the C Monoculture
20 May 2019

Malware Against the C Monoculture

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Malware Against the C Monoculture
8 May 2019

2019-data-breach-investigations-report.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2019-data-breach-investigations-report.pdf
1 May 2019

ESET-LightNeuron

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ESET-LightNeuron
10 April 2019

rpt-mtrends-2019.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor rpt-mtrends-2019.pdf
13 March 2019

Report2019GlobalThreatReport

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Report2019GlobalThreatReport
11 March 2019

Researcher Claims Iranian APT Behind 6TB Data Heist at Citrix

Malpedia library date Threatpost fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Researcher Claims Iranian APT Behind 6TB Data Heist at Citrix
11 March 2019

Resecurity reports ‘IRIDUIM’ behind Citrix data breach, 200+ government agencies, oil and gas companies, and technology companies also targeted.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Resecurity reports ‘IRIDUIM’ behind Citrix data breach, 200+ government agencies, oil and gas companies, and technology companies also targeted.
8 March 2019

Iranian-backed hackers stole data from U.S. government contractor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Iranian-backed hackers stole data from U.S. government contractor
8 March 2019

Iranian-backed hackers stole data from major U.S. government contractor

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Iranian-backed hackers stole data from major U.S. government contractor
3 March 2019

rpt-mtrends-2019

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor rpt-mtrends-2019
20 February 2019

CrowdStrike_GTR_2019.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor CrowdStrike_GTR_2019.pdf
18 February 2019

CrowdStrike_GTR_2019_.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor CrowdStrike_GTR_2019_.pdf
12 February 2019

The Leader in OT Cybersecurity Technology | Nozomi Networks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Leader in OT Cybersecurity Technology | Nozomi Networks
25 January 2019

GitHub - NozomiNetworks/greyenergy-unpacker: Toolkit collection developed to help malware analysts dissecting and detecting the packer used by GreyEnergy samples.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GitHub - NozomiNetworks/greyenergy-unpacker: Toolkit collection developed to help malware analysts dissecting and detecting the packer used by GreyEnergy samples.
24 January 2019

GreyEnergy’s overlap with Zebrocy

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GreyEnergy’s overlap with Zebrocy
18 January 2019

BLACK ENERGY – Analysis

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor BLACK ENERGY – Analysis
18 January 2019

Black Energy – Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Black Energy – Analysis
5 December 2018

APT review of the year

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT review of the year
22 October 2018

GreyEnergy: Updated arsenal of one of the most dangerous threat actors

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor GreyEnergy: Updated arsenal of one of the most dangerous threat actors
18 October 2018

ESET_GreyEnergy

Malpedia library date ESET fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ESET_GreyEnergy
17 October 2018

GreyEnergy: Updated arsenal of one of the most dangerous threat actors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GreyEnergy: Updated arsenal of one of the most dangerous threat actors
17 October 2018

GreyEnergy- Updated arsenal of one of the most dangerous threat actors

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor GreyEnergy- Updated arsenal of one of the most dangerous threat actors
12 October 2018

Microsoft Word - CRASHOVERRIDE_Dragos_Website_FINAL.docx

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor Microsoft Word - CRASHOVERRIDE_Dragos_Website_FINAL.docx
11 October 2018

New TeleBots backdoor- First evidence linking Industroyer to NotPetya

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New TeleBots backdoor- First evidence linking Industroyer to NotPetya
11 October 2018

New TeleBots backdoor: First evidence linking Industroyer to NotPetya

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New TeleBots backdoor: First evidence linking Industroyer to NotPetya
22 August 2018

The Untold Story of NotPetya, the Most Devastating Cyberattack in History

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Untold Story of NotPetya, the Most Devastating Cyberattack in History
22 August 2018

The Untold Story of NotPetya, the Most Devastating Cyberattack in History

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Untold Story of NotPetya, the Most Devastating Cyberattack in History
11 July 2018

BfV Cyber-Brief Nr. 02/2018

file creation date Bundesamt für Verfassungsschutz fromORKL

The original link failed its last check. Original publisher Detailsfor BfV Cyber-Brief Nr. 02/2018
3 April 2018

Lazarus KillDisks Central American casino

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lazarus KillDisks Central American casino
1 March 2018

Industrial Control System Threats

Malpedia library date Dragos fromORKL

The original link failed its last check. Original publisher Detailsfor Industrial Control System Threats
4 February 2018

Attackers Deploy New ICS Attack Framework "TRITON" and Cause Operational Disruption to Critical Infrastructure

file creation date FireEye fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Attackers Deploy New ICS Attack Framework "TRITON" and Cause Operational Disruption to Critical Infrastructure
15 January 2018

KillDisk Variant Hits Latin American Financial Groups

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor KillDisk Variant Hits Latin American Financial Groups
10 January 2018

blog

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor blog
14 December 2017

Attackers Deploy New ICS Attack Framework “TRITON” and Cause Operational Disruption to Critical Infrastructure « Attackers Deploy New ICS Attack Framework “TRITON” and Cause Operational Disruption to Critical Infrastructure | FireEye Inc

date in the CCS '25 data Mandiant fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Attackers Deploy New ICS Attack Framework “TRITON” and Cause Operational Disruption to Critical Infrastructure « Attackers Deploy New ICS Attack Framework “TRITON” and Cause Operational Disruption to Critical Infrastructure | FireEye Inc
14 December 2017

TRITON Malware | Attackers Deploy New ICS Attack Framework

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TRITON Malware | Attackers Deploy New ICS Attack Framework
14 December 2017

Attackers Deploy New ICS Attack Framework “TRITON” and Cause Operational Disruption to Critical Infrastructure

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Attackers Deploy New ICS Attack Framework “TRITON” and Cause Operational Disruption to Critical Infrastructure
27 October 2017

TeleBots are back_ supply-chain attacks against Ukraine

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor TeleBots are back_ supply-chain attacks against Ukraine
25 October 2017

Microsoft Defender Hotinformation | Microsoft Security

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Defender Hotinformation | Microsoft Security
24 October 2017

Kiev metro hit with a new variant of the infamous Diskcoder ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Kiev metro hit with a new variant of the infamous Diskcoder ransomware
24 October 2017

Bad Rabbit ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bad Rabbit ransomware
24 October 2017

Threat Spotlight: Follow the Bad Rabbit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Spotlight: Follow the Bad Rabbit
5 October 2017

biggest threat to industrial control systems since Stuxnet

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor biggest threat to industrial control systems since Stuxnet
25 September 2017

Cyberattacks Against Ukrainian ICS

file creation date Sentryo fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Cyberattacks Against Ukrainian ICS
18 September 2017

Casting a Light on BlackEnergy

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Casting a Light on BlackEnergy
24 August 2017

Bad Rabbit: Not-Petya is back with improved ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bad Rabbit: Not-Petya is back with improved ransomware
11 August 2017

Ukrainian Man Arrested, Charged in NotPetya Distribution

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ukrainian Man Arrested, Charged in NotPetya Distribution
14 July 2017

Keeping up with the Petyas: Demystifying the malware family | Malwarebytes Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Keeping up with the Petyas: Demystifying the malware family | Malwarebytes Labs
5 July 2017

The MeDoc Connection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The MeDoc Connection
4 July 2017

Analysis of TeleBots’ cunning backdoor

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Analysis of TeleBots’ cunning backdoor
4 July 2017

Analysis of TeleBots’ cunning backdoor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis of TeleBots’ cunning backdoor
4 July 2017

In ExPetr/Petya’s shadow, FakeCry ransomware wave hits Ukraine

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor In ExPetr/Petya’s shadow, FakeCry ransomware wave hits Ukraine
4 July 2017

Industroyer

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Industroyer
4 July 2017

Industroyer

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Industroyer
3 July 2017

Who is behind Petna?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Who is behind Petna?
3 July 2017

Cherepanov-Lipovsky-VB2016-from1.indd

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cherepanov-Lipovsky-VB2016-from1.indd
3 July 2017

'NotPetya' malware attacks could warrant retaliation, says Nato affiliated-researcher

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 'NotPetya' malware attacks could warrant retaliation, says Nato affiliated-researcher
3 July 2017

NotPetya Technical Analysis Part II: Further Findings

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor NotPetya Technical Analysis Part II: Further Findings
30 June 2017

TeleBots are back: Supply-chain attacks against Ukraine

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TeleBots are back: Supply-chain attacks against Ukraine
30 June 2017

From BlackEnergy to ExPetr

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From BlackEnergy to ExPetr
30 June 2017

TeleBots are back: supply-chain attacks against Ukraine

file creation date ESET fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor TeleBots are back: supply-chain attacks against Ukraine
30 June 2017

From BlackEnergy to ExPetr - Securelist

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor From BlackEnergy to ExPetr - Securelist
30 June 2017

EternalPetya - yet another stolen piece in the package? | Malwarebytes Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor EternalPetya - yet another stolen piece in the package? | Malwarebytes Labs
30 June 2017

TeleBots are back- Supply‑chain attacks against Ukraine

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor TeleBots are back- Supply‑chain attacks against Ukraine
29 June 2017

NonPetya: no evidence it was a "smokescreen"

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor NonPetya: no evidence it was a "smokescreen"
29 June 2017

Ransomware Attacks Continue in Ukraine with Mysterious WannaCry Clone

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware Attacks Continue in Ukraine with Mysterious WannaCry Clone
29 June 2017

EternalPetya and the lost Salsa20 key | Malwarebytes Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor EternalPetya and the lost Salsa20 key | Malwarebytes Labs
29 June 2017

Microsoft Defender for Cloud Archives | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Defender for Cloud Archives | Microsoft Security Blog
28 June 2017

ExPetr/Petya/NotPetya is a Wiper, Not Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ExPetr/Petya/NotPetya is a Wiper, Not Ransomware
28 June 2017

CrowdStrike Protects Against NotPetya Attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CrowdStrike Protects Against NotPetya Attack
28 June 2017

Why NotPetya Kept Me Awake (& You Should Worry Too)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Why NotPetya Kept Me Awake (& You Should Worry Too)
27 June 2017

Schroedinger’s Pet(ya)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Schroedinger’s Pet(ya)
27 June 2017

New Ransomware Variant "Nyetya" Compromises Systems Worldwide

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Ransomware Variant "Nyetya" Compromises Systems Worldwide
27 June 2017

Pnyetya: Yet Another Ransomware Outbreak

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Pnyetya: Yet Another Ransomware Outbreak
27 June 2017

New WannaCryptor-like ransomware attack hits globally: All you need to know

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New WannaCryptor-like ransomware attack hits globally: All you need to know
27 June 2017

Checking out the new Petya variant - SANS Internet Storm Center

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Checking out the new Petya variant - SANS Internet Storm Center
13 June 2017

CrashOverride_revised091118

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor CrashOverride_revised091118
12 June 2017

Open Source Malware - Sharing is caring?

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Open Source Malware - Sharing is caring?
12 June 2017

Industroyer: Biggest threat to industrial control systems since Stuxnet

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Industroyer: Biggest threat to industrial control systems since Stuxnet
12 June 2017

Open Source Malware - Sharing is caring-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Open Source Malware - Sharing is caring-
12 June 2017

CRASHOVERRIDE: Analysis of the Threat to Electric Grid Operations

date in the CCS '25 data Dragos fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor CRASHOVERRIDE: Analysis of the Threat to Electric Grid Operations
10 February 2017

AR-17-20045 Enhanced Analysis of GRIZZLY STEPPE Activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AR-17-20045 Enhanced Analysis of GRIZZLY STEPPE Activity
10 February 2017

Enhanced Analysis of GRIZZLY STEPPE Activity

file creation date US-CERT fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Enhanced Analysis of GRIZZLY STEPPE Activity
5 January 2017

KillDisk now targeting Linux- Demands $250K ransom, but can’t decrypt

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor KillDisk now targeting Linux- Demands $250K ransom, but can’t decrypt
5 January 2017

KillDisk now targeting Linux: Demands $250K ransom, but can’t decrypt

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor KillDisk now targeting Linux: Demands $250K ransom, but can’t decrypt
29 December 2016

GRIZZLY STEPPE - Russian Malicious Cyber Activity

date in the CCS '25 data US-CERT fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor GRIZZLY STEPPE - Russian Malicious Cyber Activity
29 December 2016

JAR-16-20296A: GRIZZLY STEPPE – Russian Malicious Cyber Activity

file creation date fromORKL

Archived copy on ORKL Detailsfor JAR-16-20296A: GRIZZLY STEPPE – Russian Malicious Cyber Activity
13 December 2016

The rise of TeleBots- Analyzing disruptive KillDisk attacks

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The rise of TeleBots- Analyzing disruptive KillDisk attacks
13 December 2016

The rise of TeleBots: Analyzing disruptive KillDisk attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The rise of TeleBots: Analyzing disruptive KillDisk attacks
13 December 2016

The rise of TeleBots: Analyzing disruptive KillDisk attacks

date in the CCS '25 data RSA fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The rise of TeleBots: Analyzing disruptive KillDisk attacks
21 November 2016

Android malware analysis with Radare- Dissecting the Triada Trojan

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Android malware analysis with Radare- Dissecting the Triada Trojan
17 November 2016

It's Parliamentary: KeyBoy and the targeting of the Tibetan Community

date in the CCS '25 data Citizen Lab fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor It's Parliamentary: KeyBoy and the targeting of the Tibetan Community
17 November 2016

It’s Parliamentary - KeyBoy and the targeting of the Tibetan Community

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor It’s Parliamentary - KeyBoy and the targeting of the Tibetan Community
17 November 2016

It’s Parliamentary: KeyBoy and the targeting of the Tibetan Community - The Citizen Lab

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor It’s Parliamentary: KeyBoy and the targeting of the Tibetan Community - The Citizen Lab
3 November 2016

Industrial Cybersecurity Threat Briefing

file creation date Booz Allen fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Industrial Cybersecurity Threat Briefing
20 September 2016

Russian hacking suspected

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Russian hacking suspected
2 August 2016

Fireeye - ICS Vulnerability Trend Report - 2016.pdf

file creation date fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Fireeye - ICS Vulnerability Trend Report - 2016.pdf
7 July 2016

Unveiling Patchwork

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Unveiling Patchwork
7 July 2016

Unveiling Patchwork the Copy Paste APT

date in the CCS '25 data Cymmetria fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Unveiling Patchwork the Copy Paste APT
4 February 2016

15GlobalThreatReport.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor 15GlobalThreatReport.pdf
1 February 2016

Know Your Enemies 2.0: A Primer on Advanced Persistent Threat Groups

file creation date ICIT fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Know Your Enemies 2.0: A Primer on Advanced Persistent Threat Groups
29 January 2016

Ongoing Sophisticated Malware Campaign Compromising ICS (Update C) | ICS-CERT

date in the CCS '25 data ICS-CERT fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Ongoing Sophisticated Malware Campaign Compromising ICS (Update C) | ICS-CERT
29 January 2016

BE2 Custom Plugins, Router Abuse, and Target Profiles - Securelist

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor BE2 Custom Plugins, Router Abuse, and Target Profiles - Securelist
28 January 2016

BlackEnergy APT Attacks in Ukraine employ spearphishing with Word documents

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor BlackEnergy APT Attacks in Ukraine employ spearphishing with Word documents
28 January 2016

BlackEnergy APT Attacks in Ukraine employ spearphishing with Word documents

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BlackEnergy APT Attacks in Ukraine employ spearphishing with Word documents
27 January 2016

BlackEnergy3_WP_012716_1c

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor BlackEnergy3_WP_012716_1c
20 January 2016

New wave of cyberattacks against Ukrainian power industry

date in the CCS '25 data ESET fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor New wave of cyberattacks against Ukrainian power industry
6 January 2016

Back in BlackEnergy *: 2014 Targeted Attacks in Ukraine and Poland

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Back in BlackEnergy *: 2014 Targeted Attacks in Ukraine and Poland
6 January 2016

BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry
6 January 2016

BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry
3 January 2016

BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry

date in the CCS '25 data ESET fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry
24 November 2015

Cyber war in perspective: Russian aggression against Ukraine

file creation date NATO fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Cyber war in perspective: Russian aggression against Ukraine
30 July 2015

Operation Potao Express: Analysis Of A Cyber-Espionage Toolkit

Malpedia library date ESET fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation Potao Express: Analysis Of A Cyber-Espionage Toolkit
30 July 2015

Operation Potao Express: Analysis of a cyber-espionage toolkit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Potao Express: Analysis of a cyber-espionage toolkit
30 July 2015

Operation Potao Express- Analysis of a cyber‑espionage toolkit

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Operation Potao Express- Analysis of a cyber‑espionage toolkit
29 June 2015

FireEye Intelligence: Threat Landscape Overview

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor FireEye Intelligence: Threat Landscape Overview
24 February 2015

rpt-m-trends-2015.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor rpt-m-trends-2015.pdf
17 February 2015

BE2 extraordinary plugins, Siemens targeting, dev fails

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BE2 extraordinary plugins, Siemens targeting, dev fails
12 November 2014

Korplug military targeted attacks: Afghanistan & Tajikistan

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Korplug military targeted attacks: Afghanistan & Tajikistan
12 November 2014

Korplug military targeted attacks- Afghanistan & Tajikistan

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Korplug military targeted attacks- Afghanistan & Tajikistan
12 November 2014

Korplug military targeted attacks: Afghanistan & Tajikistan

date in the CCS '25 data ESET fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Korplug military targeted attacks: Afghanistan & Tajikistan
10 November 2014

Timeline of Sandworm Attacks

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Timeline of Sandworm Attacks
10 November 2014

Timeline of Sandworm Attacks | Security Intelligence Blog

Malpedia library date fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor Timeline of Sandworm Attacks | Security Intelligence Blog
3 November 2014

BE2 Custom Plugins, Router Abuse, and Target Profiles - Securelist

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor BE2 Custom Plugins, Router Abuse, and Target Profiles - Securelist
3 November 2014

BE2 custom plugins, router abuse, and target profiles

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor BE2 custom plugins, router abuse, and target profiles
3 November 2014

BE2 custom plugins, router abuse, and target profiles

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BE2 custom plugins, router abuse, and target profiles
14 October 2014

Sandworm Windows zero-day vulnerability being actively exploited in targeted attacks

Malpedia library date fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor Sandworm Windows zero-day vulnerability being actively exploited in targeted attacks
14 October 2014

CVE-2014-4114: Details on August BlackEnergy PowerPoint Campaigns

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CVE-2014-4114: Details on August BlackEnergy PowerPoint Campaigns
14 October 2014

Sandworm Windows zero-day vulnerability being actively exploited in targeted attacks

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Sandworm Windows zero-day vulnerability being actively exploited in targeted attacks
14 October 2014

Sandworm Briefing Deck

date in the CCS '25 data iSight Partners fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Sandworm Briefing Deck
26 September 2014

BlackEnergy & Quedagh: The convergence of crimeware and APT attacks

date in the CCS '25 data F-Secure fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor BlackEnergy & Quedagh: The convergence of crimeware and APT attacks
15 July 2010

Black DDoS

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Black DDoS
3 March 2010

Black Energy Crypto

Malpedia library date fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor Black Energy Crypto
1 October 2007

Microsoft Word - BlackEnergy DDoS Bot Analysis.doc

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Word - BlackEnergy DDoS Bot Analysis.doc

Newest first. Details opens the report in Explore.

Names and who uses them

Sandworm Team from AT ET
IRIDIUM from AT MI ET MA Microsoft
Seashell Blizzard from AT MI ET MA Microsoft
Quedagh from AT MI ET MA
FROZENBARENTS from AT MI ET MA
APT44 from AT MI MA Microsoft
Sandworm from MI ET MA Microsoft
UAC-0113 from MI ET MA Microsoft
Blue Echidna from MI ET MA Microsoft
ELECTRUM from AT MI MA
IRON VIKING from AT MI MA
TEMP.Noble from MI ET MA
BE2 from ET MA Microsoft
UAC-0082 from MI ET MA

Show all 45 names Show fewer

TeleBots from MI ET MA
VOODOO BEAR from MI MA Microsoft
Voodoo Bear from AT ET
PHANTOM from MA Microsoft
BlackEnergy Lite from MA Microsoft
SANDWORM RELIC from MI MA
UAC-0145 from MI MA
Telebots from AT
BlackEnergy (Group) from AT
Iridium from ET
Iron Viking from ET
CTG-7263 from ET
ATK 14 from ET
UAC-0125 from ET
UAC-0133 from ET
APT 44 from ET
Grey Tornado from ET
Razing Ursa from ET
Energetic Bear from ET
Dragonfly from ET
Crouching Yeti from ET
Group 24 from ET
Koala Team from ET
Iron Liberty from ET
TG-4192 from ET
Electrum from ET
ATK 6 from ET
ITG15 from ET
Bromine from ET
Ghost Blizzard from ET
Blue Kraken from ET

AT ATT&CK
MI MISP
ET ETDA
MA Malpedia

Origin and Motivation

Origin: Iran fromMISP ETDA Malpedia
Russia fromMISP ETDA Malpedia Microsoft

The sources disagree on origin. MISP, ETDA and Malpedia give Iran (IRIDIUM); MISP, ETDA, Malpedia and Microsoft give Russia (Sandworm, Sandworm Team, Energetic Bear and 2 more).
Motivation: Information theft and espionage fromETDA
Sabotage and destruction fromETDA

The sources disagree on motivation. ETDA gives Information theft and espionage (Iridium); ETDA gives Sabotage and destruction (Sandworm Team, Energetic Bear and TeleBots).

Claimed targets (actor-level, per source)

Sources give these for the actor as a whole, not for a report or campaign.

Countries: Afghanistan fromETDA
Angola fromETDA
Argentina fromETDA
Australia fromETDA
Austria fromETDA
Azerbaijan fromETDA
Belarus fromETDA
Belgium fromETDA
Bulgaria fromETDA
Cambodia fromETDA
Canada fromETDA
China fromETDA

Show all 55 countries Show fewer

Colombia fromETDA
Denmark fromETDA
Egypt fromETDA
France fromETDA
Georgia fromETDA
Germany fromETDA
Ghana fromETDA
Hungary fromETDA
India fromETDA
Iran fromETDA
Israel fromETDA
Italy fromETDA
Kazakhstan fromETDA
Kyrgyzstan fromETDA
Latvia fromETDA
Lithuania fromETDA
Luxembourg fromETDA
Moldova fromETDA
Myanmar fromETDA
Netherlands fromETDA
Nigeria fromETDA
Oman fromETDA
Norway fromETDA
Pakistan fromETDA
Paraguay fromETDA
Peru fromETDA
Poland fromETDA
Portugal fromETDA
Romania fromETDA
Russia fromETDA
Serbia fromETDA
South Korea fromETDA
Spain fromETDA
Sweden fromETDA
Syria fromETDA
Thailand fromETDA
Türkiye fromETDA
United Kingdom fromETDA
Ukraine fromETDA
United States fromETDA
Uzbekistan fromETDA
Vietnam fromETDA
Greece fromETDA
Sectors: Electric fromMISP Malpedia
Energy fromMISP ETDA Malpedia
Industrial fromMISP ETDA Malpedia
Government fromETDA
Oil and gas fromETDA
Technology fromETDA
Education fromETDA
Telecommunications fromETDA
Aviation fromETDA
Construction fromETDA
Defense fromETDA
IT fromETDA

Show all 17 sectors Show fewer

Manufacturing fromETDA
Pharmaceutical fromETDA
Financial fromETDA
Transportation fromETDA
Software companies fromETDA

Malware and Tools

AcidPour fromATT&CK
AcidRain fromATT&CK
Bad Rabbit fromATT&CK
BlackEnergy fromATT&CK Malpedia
CHEMISTGAMES fromATT&CK
Cobalt Strike fromATT&CK
Cyclops Blink fromATT&CK
Empire fromATT&CK
Exaramel for Linux fromATT&CK
Exaramel for Windows fromATT&CK
GreyEnergy fromATT&CK
Impacket fromATT&CK

Show all 40 malware and tools Show fewer

Industroyer fromATT&CK
Industroyer2 fromATT&CK
Invoke-PSImage fromATT&CK
Kapeka fromATT&CK Malpedia
KillDisk fromATT&CK Malpedia
Mimikatz fromATT&CK
Neo-reGeorg fromATT&CK
Net fromATT&CK
NotPetya fromATT&CK
Olympic Destroyer fromATT&CK
P.A.S. Webshell fromATT&CK
PoshC2 fromATT&CK
Prestige fromATT&CK
PsExec fromATT&CK
SDelete fromATT&CK
VPNFilter fromATT&CK
ArguePatch fromMalpedia
BACKORDER fromMalpedia
CaddyWiper fromMalpedia
EternalPetya fromMalpedia
INDUSTROYER2 fromMalpedia
Kalambur fromMalpedia
LocalOlive fromMalpedia
Rhadamanthys fromMalpedia
RoarBAT fromMalpedia
SwiftSlicer fromMalpedia
TeleBot fromMalpedia
TeleDoor fromMalpedia