Suckfly
Also reported as APT22, BRONZE OLIVE, Group 46, Wicked Spider, APT 22 and 2 other names. Linked to China by three sources.
Reports per quarter
Techniques seen in the last two years
- T1027 2 reports reports only
- T1036.005 2 reports reports only
- T1059.001 2 reports reports only
- T1082 2 reports reports only
- T1132.001 2 reports reports only
- T1140 2 reports reports only
- T1204.002 2 reports reports only
- T1547.001 2 reports reports only
- T1566.001 2 reports reports only
- T1573.001 2 reports reports only
Show all 38 techniques Show fewer
- T1001.003 1 report reports only
- T1012 1 report reports only
- T1027.009 1 report reports only
- T1036.007 1 report reports only
- T1041 1 report reports only
- T1055 1 report reports only
- T1055.012 1 report reports only
- T1057 1 report reports only
- T1071.001 1 report reports only
- T1083 1 report reports only
- T1102 1 report reports only
- T1105 1 report reports only
- T1106 1 report reports only
- T1129 1 report reports only
- T1189 1 report reports only
- T1218 1 report reports only
- T1218.007 1 report reports only
- T1218.014 1 report reports only
- T1497.001 1 report reports only
- T1553.002 1 report in ATT&CK
- T1566.002 1 report reports only
- T1574 1 report reports only
- T1574.001 1 report reports only
- T1583.001 1 report reports only
- T1583.003 1 report reports only
- T1587.001 1 report reports only
- T1608.001 1 report reports only
- T1627.001 1 report reports only
Counts come from technique IDs in the actor's report text. “Reports only” means reports name the technique but MITRE ATT&CK® does not list it for this actor.
Also listed by ATT&CK
CVEs named in reports
- CVE-2008-3431 KEV
- CVE-2010-1424
- CVE-2010-2152
- CVE-2010-3915
- CVE-2010-3916
- CVE-2011-1331
- CVE-2011-2462 KEV
- CVE-2011-3544 KEV
- CVE-2012-0158 KEV ransomware
- CVE-2012-5687
- CVE-2013-0707
- CVE-2013-3644
Show all 139 CVEs Show fewer
- CVE-2013-3893 KEV
- CVE-2013-3900 KEV
- CVE-2013-3918 KEV
- CVE-2013-5947
- CVE-2013-5990
- CVE-2014-0810
- CVE-2014-1225
- CVE-2014-2962
- CVE-2014-4019
- CVE-2014-4113 KEV
- CVE-2014-6332 KEV
- CVE-2014-7247
- CVE-2014-8361 KEV
- CVE-2014-9583
- CVE-2015-0554
- CVE-2015-4852 KEV
- CVE-2015-5119 KEV
- CVE-2015-7248
- CVE-2015-7254
- CVE-2016-4117 KEV ransomware
- CVE-2016-5195 KEV
- CVE-2016-7836 KEV
- CVE-2017-0199 KEV ransomware
- CVE-2017-0213 KEV ransomware
- CVE-2017-0261 KEV
- CVE-2017-1182
- CVE-2017-11882 KEV ransomware
- CVE-2017-15944 KEV
- CVE-2017-6327 KEV
- CVE-2017-7269 KEV
- CVE-2018-0798 KEV
- CVE-2018-0802 KEV ransomware
- CVE-2018-1207
- CVE-2018-13379 KEV ransomware
- CVE-2018-20250 KEV ransomware
- CVE-2018-4939 KEV
- CVE-2018-6055
- CVE-2018-6789 KEV ransomware
- CVE-2019-0604 KEV ransomware
- CVE-2019-0708 KEV ransomware
- CVE-2019-0797 KEV
- CVE-2019-0803 KEV ransomware
- CVE-2019-0808 KEV
- CVE-2019-0859 KEV ransomware
- CVE-2019-10149 KEV
- CVE-2019-1040
- CVE-2019-1132 KEV
- CVE-2019-11510 KEV ransomware
- CVE-2019-11580 KEV ransomware
- CVE-2019-11707 KEV
- CVE-2019-11708 KEV
- CVE-2019-1367 KEV ransomware
- CVE-2019-13720 KEV
- CVE-2019-1458 KEV ransomware
- CVE-2019-16098
- CVE-2019-17100
- CVE-2019-18935 KEV ransomware
- CVE-2019-19781 KEV ransomware
- CVE-2019-2215 KEV
- CVE-2019-3396 KEV ransomware
- CVE-2019-3568 KEV
- CVE-2019-5786 KEV
- CVE-2019-6225
- CVE-2019-7286 KEV
- CVE-2019-7287 KEV
- CVE-2019-8518
- CVE-2019-9489
- CVE-2020-0601 KEV
- CVE-2020-0688 KEV ransomware
- CVE-2020-0796 KEV ransomware
- CVE-2020-0986 KEV
- CVE-2020-10189 KEV
- CVE-2020-1350 KEV
- CVE-2020-1380 KEV
- CVE-2020-1472 KEV ransomware
- CVE-2020-15505 KEV
- CVE-2020-1664
- CVE-2020-2021 KEV ransomware
- CVE-2020-2555 KEV
- CVE-2020-3118 KEV
- CVE-2020-5135 KEV ransomware
- CVE-2020-5902 KEV ransomware
- CVE-2020-8193 KEV
- CVE-2020-8195 KEV
- CVE-2020-8196 KEV
- CVE-2020-8468 KEV
- CVE-2020-8515 KEV
- CVE-2021-1675 KEV ransomware
- CVE-2021-22555 KEV
- CVE-2021-26855 KEV ransomware
- CVE-2021-26857 KEV ransomware
- CVE-2021-26858 KEV ransomware
- CVE-2021-27065 KEV ransomware
- CVE-2021-31195
- CVE-2021-31196 KEV
- CVE-2021-31206
- CVE-2021-31207 KEV ransomware
- CVE-2021-34473 KEV ransomware
- CVE-2021-34523 KEV ransomware
- CVE-2021-34527 KEV ransomware
- CVE-2021-4034 KEV ransomware
- CVE-2021-40444 KEV ransomware
- CVE-2021-4104
- CVE-2021-44207 KEV
- CVE-2021-44228 KEV ransomware
- CVE-2021-45046 KEV ransomware
- CVE-2021-45105
- CVE-2022-21587 KEV ransomware
- CVE-2022-24682 KEV ransomware
- CVE-2022-24934
- CVE-2022-27924 KEV ransomware
- CVE-2022-27925 KEV ransomware
- CVE-2022-30333 KEV ransomware
- CVE-2022-37042 KEV ransomware
- CVE-2022-41040 KEV ransomware
- CVE-2022-41082 KEV ransomware
- CVE-2022-41328 KEV
- CVE-2022-42475 KEV ransomware
- CVE-2022-47986 KEV ransomware
- CVE-2022-49475
- CVE-2024-0012 KEV ransomware
- CVE-2024-24919 KEV ransomware
- CVE-2025-55182 KEV ransomware
- CVE-2025-55183
- CVE-2025-55184
- CVE-2025-66478
- CVE-2025-67779
KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.
Reports
-
Threat Group Cards: A Threat Actor Encyclopedia
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia
Show all 168 reports Show fewer
-
Wirtschaftsspionage gegen Volkwagen: VW-Konzern wurde jahrelang ausge…
The title opens archive.today, not the publisher’s page. Archived copy on ORKL Detailsfor Wirtschaftsspionage gegen Volkwagen: VW-Konzern wurde jahrelang ausge…
-
MustangPanda%20-%20Enemy%20at%20the%20gate_final.pdf
The original link failed its last check. Original publisher Detailsfor MustangPanda%20-%20Enemy%20at%20the%20gate_final.pdf
-
Advanced Persistent Threats (APTs)
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Advanced Persistent Threats (APTs)
-
yir-cyber-threats-annex-download.pdf
The original link failed its last check. Original publisher Detailsfor yir-cyber-threats-annex-download.pdf
-
Advanced Persistent Threats (APTs)
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Advanced Persistent Threats (APTs)
-
Mustang Panda PlugX - 45.251.240.55 Pivot
The original link failed its last check. Original publisher Detailsfor Mustang Panda PlugX - 45.251.240.55 Pivot
-
Higaisa or Winnti? APT41 backdoors, old and new
The original link failed its last check. Original publisher Detailsfor Higaisa or Winnti? APT41 backdoors, old and new
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor High Value Malicious Domains.
-
Is APT 27 Abusing COVID-19 To Attack People !
The original link failed its last check. Detailsfor Is APT 27 Abusing COVID-19 To Attack People !
-
2020.02.22_APT_threat_report_2019_CN_version
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 2020.02.22_APT_threat_report_2019_CN_version
-
The original link failed its last check. Original publisher Detailsfor Analytics
-
Into the Fog - The Return of ICEFOG APT
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Into the Fog - The Return of ICEFOG APT
-
Advanced Persistent Threat Groups
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Advanced Persistent Threat Groups
-
APT32- New Cyber Espionage Group
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT32- New Cyber Espionage Group
-
The original link failed its last check. Original publisher Detailsfor security_report_20160613.pdf
-
Indian organizations targeted in Suckfly attacks
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Indian organizations targeted in Suckfly attacks
-
Indian organizations targeted in Suckfly attacks | Symantec Connect
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Indian organizations targeted in Suckfly attacks | Symantec Connect
-
Indian organizations targeted in Suckfly attacks
The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Indian organizations targeted in Suckfly attacks
-
Ever Present Persistence - Established Footholds Seen in the Wild
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Ever Present Persistence - Established Footholds Seen in the Wild
-
Ever Present Persistence - Established Footholds Seen in the Wild
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Ever Present Persistence - Established Footholds Seen in the Wild
-
Suckfly: Revealing the secret life of your code signing certificates
The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Suckfly: Revealing the secret life of your code signing certificates
-
Suckfly: Revealing the secret life of your code signing certificates | Symantec Connect Community
The link to CyberMonitor archive on GitHub failed its last check. CyberMonitor archive on GitHub Detailsfor Suckfly: Revealing the secret life of your code signing certificates | Symantec Connect Community
-
Suckfly- Revealing the secret life of your code signing certificates
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Suckfly- Revealing the secret life of your code signing certificates
-
Uncovering the Seven Pointed Dagger
The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Uncovering the Seven Pointed Dagger
-
BSI - IT Security Situation in Germany - 2014 (DE).pdf
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor BSI - IT Security Situation in Germany - 2014 (DE).pdf
-
BKDR_RARSTONE: New RAT to Watch Out For - TrendLabs Security Intelligence Blog
The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor BKDR_RARSTONE: New RAT to Watch Out For - TrendLabs Security Intelligence Blog
Newest first. Details opens the report in Explore.