Winnti Group

Operation CuckooBees: Cybereason Uncovers Massive Chinese Intellectual Property Theft Operation

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Operation CuckooBees: Cybereason Uncovers Massive Chinese Intellectual Property Theft Operation

Ghost RAT (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Ghost RAT (Malware Family)

Space Pirates: исследуем инструменты и связи новой хакерской группировки

date ORKL added it fromORKL

The original link failed its last check. Original publisher Detailsfor Space Pirates: исследуем инструменты и связи новой хакерской группировки

Hunting In Memory

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Hunting In Memory

ShadowPad: new activity from the Winnti group

date ORKL added it fromORKL

The original link failed its last check. Original publisher Detailsfor ShadowPad: new activity from the Winnti group

SUNBURST (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor SUNBURST (Malware Family)

CHINACHOPPER (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor CHINACHOPPER (Malware Family)

Ave Maria (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Ave Maria (Malware Family)

FlawedAmmyy (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor FlawedAmmyy (Malware Family)

QakBot (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor QakBot (Malware Family)

DanaBot (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor DanaBot (Malware Family)

Chinese hacking group uses new 'Fire Chili' Windows rootkit

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Chinese hacking group uses new 'Fire Chili' Windows rootkit

BazarBackdoor (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor BazarBackdoor (Malware Family)

Clop (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Clop (Malware Family)

Conti (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Conti (Malware Family)

REvil (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor REvil (Malware Family)

SmokeLoader (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor SmokeLoader (Malware Family)

APT 41 - Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor APT 41 - Threat Group Cards: A Threat Actor Encyclopedia

The Origins of APT 41 and ShadowPad Lineage - CYFIRMA

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor The Origins of APT 41 and ShadowPad Lineage - CYFIRMA

Dridex (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Dridex (Malware Family)

IcedID (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor IcedID (Malware Family)

APT and financial attacks on industrial organizations in H1 2023 | Kaspersky ICS CERT EN

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor APT and financial attacks on industrial organizations in H1 2023 | Kaspersky ICS CERT EN

WastedLocker (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor WastedLocker (Malware Family)

MimiKatz (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor MimiKatz (Malware Family)

Axiom, Group 72 - Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Axiom, Group 72 - Threat Group Cards: A Threat Actor Encyclopedia

ZXShell (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor ZXShell (Malware Family)

Familiar Feeling: A Malware Campaign Targeting the Tibetan Diaspora Resurfaces - The Citizen Lab

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Familiar Feeling: A Malware Campaign Targeting the Tibetan Diaspora Resurfaces - The Citizen Lab

Winnti APT41 Targets Japanese Firms in RevivalStone Cyber Espionage Campaign

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Winnti APT41 Targets Japanese Firms in RevivalStone Cyber Espionage Campaign

Ancient ICEFOG APT malware spotted again in new wave of attacks

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Ancient ICEFOG APT malware spotted again in new wave of attacks

PlugX (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor PlugX (Malware Family)

4 malicious campaigns and a new wave of APT41 attacks | Group-IB Blog

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor 4 malicious campaigns and a new wave of APT41 attacks | Group-IB Blog

Suckfly: Revealing the secret life of your code signing certificates – Information Security Newspaper

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Suckfly: Revealing the secret life of your code signing certificates – Information Security Newspaper

Blackfly: Espionage Group Targets Materials Technology

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Blackfly: Espionage Group Targets Materials Technology

NjRAT (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor NjRAT (Malware Family)

Cobalt Strike (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Cobalt Strike (Malware Family)

Quasar RAT (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Quasar RAT (Malware Family)

Winnti Group, Wicked Panda - Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Winnti Group, Wicked Panda - Threat Group Cards: A Threat Actor Encyclopedia

Ryuk (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Ryuk (Malware Family)

Maze (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Maze (Malware Family)

Burning Umbrella

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Burning Umbrella

ICIT Brief – China’s Espionage Dynasty: Economic Death by a Thousand Cuts

date ORKL added it fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor ICIT Brief – China’s Espionage Dynasty: Economic Death by a Thousand Cuts

Egregor (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Egregor (Malware Family)

Study of the Spyder modular backdoor for targeted attacks

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Study of the Spyder modular backdoor for targeted attacks

Operation FishMedley targeting governments, NGOs, and think tanks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation FishMedley targeting governments, NGOs, and think tanks

Glutton: A New Zero-Detection PHP Backdoor from Winnti Targets Cybercrimals

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Glutton: A New Zero-Detection PHP Backdoor from Winnti Targets Cybercrimals

MOONSHINE Exploit Kit and DarkNimbus Backdoor Enabling Earth Minotaur’s Multi-Platform Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MOONSHINE Exploit Kit and DarkNimbus Backdoor Enabling Earth Minotaur’s Multi-Platform Attacks

New Zero-Detection Variant of Melofee Backdoor from Winnti Strikes RHEL 7.9

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Zero-Detection Variant of Melofee Backdoor from Winnti Strikes RHEL 7.9

it didn't turn into a truck, but a widely spread Android botnet

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor it didn't turn into a truck, but a widely spread Android botnet

Virus Bulletin :: TA577 walked just past you: indirect syscalls in Pikabot

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Virus Bulletin :: TA577 walked just past you: indirect syscalls in Pikabot

Взлом SCADA-Систем и Атаки на Российские Компании

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Взлом SCADA-Систем и Атаки на Российские Компании

i-soon-data-leaks-jp

date ORKL added it fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor i-soon-data-leaks-jp

i-soon-data-leaks-en

date ORKL added it fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor i-soon-data-leaks-en

Operation Diplomatic Specter: An Active Chinese Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Diplomatic Specter: An Active Chinese Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia

ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilities

file creation date fromORKL

Archived copy on ORKL Detailsfor ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilities

Attributing i-SOON: Private Contractor Linked to Multiple Chinese State-sponsored Groups

file creation date fromORKL

Archived copy on ORKL Detailsfor Attributing i-SOON: Private Contractor Linked to Multiple Chinese State-sponsored Groups

PowerPoint 簡報

Malpedia library date TeamT5 fromORKL

Archived copy on ORKL Detailsfor PowerPoint 簡報

Persistent Attempts at Cyberespionage Against Southeast Asian Government Target Have Links to Alloy Taurus

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Persistent Attempts at Cyberespionage Against Southeast Asian Government Target Have Links to Alloy Taurus

Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral Movement

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral Movement

Redfly: Espionage Actors Continue to Target Critical Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Redfly: Espionage Actors Continue to Target Critical Infrastructure

My Tea’s not cold. An overview of China’s cyber threat

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor My Tea’s not cold. An overview of China’s cyber threat

RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale

Reptile Malware Targeting Linux Systems

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Reptile Malware Targeting Linux Systems

Mélofée- a new alien malware in the Panda's toolset targeting Linux hosts

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Mélofée- a new alien malware in the Panda's toolset targeting Linux hosts

Mélofée: a new alien malware in the Panda's toolset targeting Linux hosts

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mélofée: a new alien malware in the Panda's toolset targeting Linux hosts

Blackfly: Espionage Group Targets Materials Technology

date in the CCS '25 data Symantec fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Blackfly: Espionage Group Targets Materials Technology

Update to the REF2924 intrusion set and related campaigns

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Update to the REF2924 intrusion set and related campaigns

Update to the REF2924 intrusion set and related campaigns

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Update to the REF2924 intrusion set and related campaigns

Threat Analysis: Active C2 Discovery Using Protocol Emulation Part3 (ShadowPad)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Analysis: Active C2 Discovery Using Protocol Emulation Part3 (ShadowPad)

VB2022-Tracking-the-entire-iceberg.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor VB2022-Tracking-the-entire-iceberg.pdf

Conceptualizing a Continuum of Cyber Threat Attribution

date ORKL added it fromORKL

The original link failed its last check. Original publisher Detailsfor Conceptualizing a Continuum of Cyber Threat Attribution

eset_threat_report_t22021.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor eset_threat_report_t22021.pdf

202209221300_APT41 and Recent Activity_TLPWHITE

file creation date HC3 fromORKL

Archived copy on ORKL Detailsfor 202209221300_APT41 and Recent Activity_TLPWHITE

Tracking the entire iceberg – long‑term APT malware C2 protocol emulation and scanning

Malpedia library date Virus Bulletin fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Tracking the entire iceberg – long‑term APT malware C2 protocol emulation and scanning

2022OverWatchThreatHuntingReport.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor 2022OverWatchThreatHuntingReport.pdf

APT41 World Tour 2021 on a tight schedule

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT41 World Tour 2021 on a tight schedule

APT41 World Tour 2021 on a tight schedule

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT41 World Tour 2021 on a tight schedule

APT41- A Case Sudy

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT41- A Case Sudy

eset_threat_report_t12022

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor eset_threat_report_t12022

Operation Earth Berberoka: An Analysis of a Multivector and Multiplatform APT Campaign Targeting Online Gambling Sites

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Earth Berberoka: An Analysis of a Multivector and Multiplatform APT Campaign Targeting Online Gambling Sites

Space Pirates analyzing the tools and connections of a new hacker group

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Space Pirates analyzing the tools and connections of a new hacker group

Space Pirates: analyzing the tools and connections of a new hacker group

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Space Pirates: analyzing the tools and connections of a new hacker group

AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf

PowerPoint Presentation

Malpedia library date Hughes, Jennifer fromORKLCCS '25 data

Archived copy on ORKL Detailsfor PowerPoint Presentation

Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques

Operation CuckooBees- Deep-Dive into Stealthy Winnti Techniques

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Operation CuckooBees- Deep-Dive into Stealthy Winnti Techniques

Operation CuckooBees- A Winnti Malware Arsenal Deep-Dive

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Operation CuckooBees- A Winnti Malware Arsenal Deep-Dive

Operation CuckooBees: A Winnti Malware Arsenal Deep-Dive

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation CuckooBees: A Winnti Malware Arsenal Deep-Dive

Gamer Cheater Hacker Spy

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Gamer Cheater Hacker Spy

Gamer Cheater Hacker Spy

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Gamer Cheater Hacker Spy

Botconf2022-40-LunghiHorejsi.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Botconf2022-40-LunghiHorejsi.pdf

New Milestones for Deep Panda: Log4Shell and Digitally Signed Fire Chili Rootkits

file creation date Fortinet fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor New Milestones for Deep Panda: Log4Shell and Digitally Signed Fire Chili Rootkits

Chinese Hackers Target VMware Horizon Servers with Log4Shell to Deploy Rootkit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese Hackers Target VMware Horizon Servers with Log4Shell to Deploy Rootkit

Chinese Hackers Target VMware Horizon Servers with Log4Shell to Deploy Rootkit

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Chinese Hackers Target VMware Horizon Servers with Log4Shell to Deploy Rootkit

China-Linked Group TAG-28 Targets India’s “The Times Group” and UIDAI (Aadhaar) Government Agency With Winnti Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-Linked Group TAG-28 Targets India’s “The Times Group” and UIDAI (Aadhaar) Government Agency With Winnti Malware

New Milestones for Deep Panda: Log4Shell and Digitally Signed Fire Chili Rootkits

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Milestones for Deep Panda: Log4Shell and Digitally Signed Fire Chili Rootkits

New Milestones for Deep Panda- Log4Shell and Digitally Signed Fire Chili Rootkits

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New Milestones for Deep Panda- Log4Shell and Digitally Signed Fire Chili Rootkits

New Milestones for Deep Panda_ Log4Shell and Digitally Signed Fire Chili Rootkits

date in the CCS '25 data Fortinet fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor New Milestones for Deep Panda_ Log4Shell and Digitally Signed Fire Chili Rootkits

rt-apt41-dual-operation.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor rt-apt41-dual-operation.pdf

Delving Deep: An Analysis of Earth Lusca's Operations

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Delving Deep: An Analysis of Earth Lusca's Operations

Winnti is Coming - Evolution after Prosecution@HITCON2021

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Winnti is Coming - Evolution after Prosecution@HITCON2021

Winnti is Coming - Evolution after Prosecution

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Winnti is Coming - Evolution after Prosecution

FINDING BEACONS IN THE DARK 1650728751599

Malpedia library date BlackBerry fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor FINDING BEACONS IN THE DARK 1650728751599

Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf

Malpedia library date Kaspersky fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf

4 Chinese APT Groups Identified Targeting Mail Server of Afghan Telecommunications Firm Roshan

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor 4 Chinese APT Groups Identified Targeting Mail Server of Afghan Telecommunications Firm Roshan

eset_threat_report_t22021

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor eset_threat_report_t22021

China-Linked Group TAG-28 Targets India’s “The Times Group” and UIDAI (Aadhaar) Government Agency With Winnti Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-Linked Group TAG-28 Targets India’s “The Times Group” and UIDAI (Aadhaar) Government Agency With Winnti Malware

Operation ‘Harvest’_ A Deep Dive into a Long-term Campaign _ McAfee Blogs

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation ‘Harvest’_ A Deep Dive into a Long-term Campaign _ McAfee Blogs

Operation ‘Harvest’- A Deep Dive into a Long-term Campaign

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Operation ‘Harvest’- A Deep Dive into a Long-term Campaign

Grayfly: Chinese Threat Actor Uses Newly-discovered Sidewalk Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Grayfly: Chinese Threat Actor Uses Newly-discovered Sidewalk Malware

Grayfly- Chinese Threat Actor Uses Newly-discovered Sidewalk Malware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Grayfly- Chinese Threat Actor Uses Newly-discovered Sidewalk Malware

Report2021ThreatHunting

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Report2021ThreatHunting

Earth Baku: An APT Group Targeting Indo-Pacific Countries With New Stealth Loaders and Backdoor

Malpedia library date Trend Micro fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Earth Baku: An APT Group Targeting Indo-Pacific Countries With New Stealth Loaders and Backdoor

The SideWalk may be as dangerous as the CROSSWALK

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The SideWalk may be as dangerous as the CROSSWALK

The SideWalk may be as dangerous as the CROSSWALK

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The SideWalk may be as dangerous as the CROSSWALK

D1T1%20-%20%20ShadowPad%20-%20A%20Masterpiece%20of%20Privately%20Sold%20Malware%20in%20Chinese%20Espionage%20-%20Yi-Jhen%20Hsieh%20&%20Joey%20Chen.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor D1T1%20-%20%20ShadowPad%20-%20A%20Masterpiece%20of%20Privately%20Sold%20Malware%20in%20Chinese%20Espionage%20-%20Yi-Jhen%20Hsieh%20&%20Joey%20Chen.pdf

Shadowpad

Malpedia library date SentinelOne fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Shadowpad

DeadRinger_ Exposing Chinese Threat Actors Targeting Major Telcos

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor DeadRinger_ Exposing Chinese Threat Actors Targeting Major Telcos

DeadRinger- Exposing Chinese Threat Actors Targeting Major Telcos

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor DeadRinger- Exposing Chinese Threat Actors Targeting Major Telcos

DeadRinger: Exposing Chinese Threat Actors Targeting Major Telcos

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DeadRinger: Exposing Chinese Threat Actors Targeting Major Telcos

Threats to the 2020 Tokyo Olympic Games

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threats to the 2020 Tokyo Olympic Games

BIOPASS RAT New Malware Sniffs Victims via Live Streaming

date in the CCS '25 data Trend Micro fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor BIOPASS RAT New Malware Sniffs Victims via Live Streaming

Chinese State-Sponsored Activity Group TAG-22 Targets Nepal, the Philippines, and Taiwan Using Winnti and Other Tooling

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Chinese State-Sponsored Activity Group TAG-22 Targets Nepal, the Philippines, and Taiwan Using Winnti and Other Tooling

Презентация PowerPoint

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Презентация PowerPoint

BIOPASS RAT- New Malware Sniffs Victims via Live Streaming

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor BIOPASS RAT- New Malware Sniffs Victims via Live Streaming

BIOPASS RAT New Malware Sniffs Victims via Live Streaming

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BIOPASS RAT New Malware Sniffs Victims via Live Streaming

eset_threat_report_t12021.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eset_threat_report_t12021.pdf

eset_threat_report_t12021

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor eset_threat_report_t12021

the-operations-of-winnti-group.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor the-operations-of-winnti-group.pdf

China’s “Winnti” Spyder Module

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor China’s “Winnti” Spyder Module

New Linux Backdoor RedXOR Likely Operated by Chinese Nation-State Actor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Linux Backdoor RedXOR Likely Operated by Chinese Nation-State Actor

New Linux Backdoor RedXOR Likely Operated by Chinese Nation-State Actor

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New Linux Backdoor RedXOR Likely Operated by Chinese Nation-State Actor

Linux Backdoor RedXOR Likely Operated by Chinese Nation-State

date in the CCS '25 data Intezer fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Linux Backdoor RedXOR Likely Operated by Chinese Nation-State

Exchange servers under siege from at least 10 APT groups

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Exchange servers under siege from at least 10 APT groups

Exchange servers under siege from at least 10 APT groups

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Exchange servers under siege from at least 10 APT groups

Microsoft Exchange Zero Days - Mitigations and Detections

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Microsoft Exchange Zero Days - Mitigations and Detections

Study of the Spyder modular backdoor for targeted attacks

Malpedia library date Doctor Web, Ltd. fromORKL

Archived copy on ORKL Detailsfor Study of the Spyder modular backdoor for targeted attacks

Cyber Threats 2020: A Year in Retrospect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Threats 2020: A Year in Retrospect

Supply Chain Attacks: Cyber Criminals Target the Weakest Link (White Paper)

file creation date fromORKL

Archived copy on ORKL Detailsfor Supply Chain Attacks: Cyber Criminals Target the Weakest Link (White Paper)

ESET_Threat_Report_Q42020.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET_Threat_Report_Q42020.pdf

Threat Attribution — Chimera -Under the Radar-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Threat Attribution — Chimera -Under the Radar-

Emulation of Kernel Mode Rootkits With Speakeasy

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Emulation of Kernel Mode Rootkits With Speakeasy

Researchers Disclose Undocumented Chinese Malware Used in Recent Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Researchers Disclose Undocumented Chinese Malware Used in Recent Attacks

ptsecurity.com-Higaisa or Winnti APT41 backdoors old and new

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ptsecurity.com-Higaisa or Winnti APT41 backdoors old and new

Researchers Disclose Undocumented Chinese Malware Used in Recent Attacks

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Researchers Disclose Undocumented Chinese Malware Used in Recent Attacks

Higaisa or Winnti? APT41 backdoors, old and new

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Higaisa or Winnti? APT41 backdoors, old and new

Higaisa or Winnti? APT41 backdoors, old and new

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Higaisa or Winnti? APT41 backdoors, old and new

Higaisa or Winnti- APT41 backdoors, old and new

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Higaisa or Winnti- APT41 backdoors, old and new

China's APT hackers move to ransomware attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China's APT hackers move to ransomware attacks

APT27+turns+to+ransomware

Malpedia library date Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT27+turns+to+ransomware

China's APT hackers move to ransomware attacks

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor China's APT hackers move to ransomware attacks

SolarWinds Attribution: Are We Getting Ahead of Ourselves?

Malpedia library date RecordedFuture fromORKL

Archived copy on ORKL Detailsfor SolarWinds Attribution: Are We Getting Ahead of Ourselves?

China cyber attacks- the current threat landscape

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor China cyber attacks- the current threat landscape

Operation StealthyTrident: corporate software under attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation StealthyTrident: corporate software under attack

Dragos_Manufacturing%20Threat%20Perspective_1120.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dragos_Manufacturing%20Threat%20Perspective_1120.pdf

APT_trends_report_Q3_2020_Securelist

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT_trends_report_Q3_2020_Securelist

APT trends report Q3 2020

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT trends report Q3 2020

APT trends report Q3 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q3 2020

ESET_Threat_Report_Q32020

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ESET_Threat_Report_Q32020

Winnti APT group docks in Sri Lanka for new campaign - Malwarebytes Threat Intelligence Report

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Winnti APT group docks in Sri Lanka for new campaign - Malwarebytes Threat Intelligence Report

MosaicRegressor: Lurking in the Shadows of UEFI

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MosaicRegressor: Lurking in the Shadows of UEFI

MosaicRegressor- Lurking in the Shadows of UEFI

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor MosaicRegressor- Lurking in the Shadows of UEFI

VB2020 paper: Earth Akhlut: exploring the tools, tactics, and procedures of an advanced threat actor operating a large infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor VB2020 paper: Earth Akhlut: exploring the tools, tactics, and procedures of an advanced threat actor operating a large infrastructure

Detecting Threats in Real-time With Active C2 Information

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detecting Threats in Real-time With Active C2 Information

APT41- Indictments Put Chinese Espionage Group in the Spotlight

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT41- Indictments Put Chinese Espionage Group in the Spotlight

winnti-2020-rus.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor winnti-2020-rus.pdf

APT41: Indictments Put Chinese Espionage Group in the Spotlight

Malpedia library date Symantec fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT41: Indictments Put Chinese Espionage Group in the Spotlight

2020.09.29_ShadowPad - new activity from the Winnti group

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 2020.09.29_ShadowPad - new activity from the Winnti group

WastedLocker (2020/08/16) - IoC (TT Malware Log)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor WastedLocker (2020/08/16) - IoC (TT Malware Log)

Chinese Hackers Have Pillaged Taiwan's Semiconductor Industry

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Chinese Hackers Have Pillaged Taiwan's Semiconductor Industry

ESET_Threat_Report_Q22020.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET_Threat_Report_Q22020.pdf

ESET_Threat_Report_Q22020

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ESET_Threat_Report_Q22020

What even is Winnti? - Risky Business Media

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What even is Winnti? - Risky Business Media

What even is Winnti-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor What even is Winnti-

ELF Malware Analysis 101- Linux Threats No Longer an Afterthought

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor ELF Malware Analysis 101- Linux Threats No Longer an Afterthought

ELF Malware Analysis 101: Linux Threats No Longer an Afterthought

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ELF Malware Analysis 101: Linux Threats No Longer an Afterthought

SSTIC2020-Slides-pivoter_tel_bernard_ou_comment_monitorer_des_attaquants_ngligents-lunghi.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SSTIC2020-Slides-pivoter_tel_bernard_ou_comment_monitorer_des_attaquants_ngligents-lunghi.pdf

No “Game over” for the Winnti Group _ WeLiveSecurity

date in the CCS '25 data ESET fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor No “Game over” for the Winnti Group _ WeLiveSecurity

No “Game over” for the Winnti Group

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor No “Game over” for the Winnti Group

No “Game over” for the Winnti Group

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor No “Game over” for the Winnti Group

Shadows with a chance of BlackNix

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Shadows with a chance of BlackNix

Shadows with a chance of BlackNix

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Shadows with a chance of BlackNix

ESET_Threat_Report_Q12020

date in the CCS '25 data ESET fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ESET_Threat_Report_Q12020

WINNTI GROUP_ Insights From the Past

date in the CCS '25 data QuoIntelligence fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor WINNTI GROUP_ Insights From the Past

WINNTI GROUP: Insights From the Past

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor WINNTI GROUP: Insights From the Past

WINNTI GROUP- Insights From the Past

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor WINNTI GROUP- Insights From the Past

200407-MWB-COVID-White-Paper_Final

date in the CCS '25 data Malwarebytes fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 200407-MWB-COVID-White-Paper_Final

report-bb-decade-of-the-rats

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor report-bb-decade-of-the-rats

Shadows in the Rain

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Shadows in the Rain

Shadows in the Rain

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Shadows in the Rain

Cyber Threats 2019: A Year in Retrospect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Threats 2019: A Year in Retrospect

GitHub Repository- winnti-sniff

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor GitHub Repository- winnti-sniff

Uncovering DRBControl: Inside the Cyberespionage Campaign Targeting Gambling Operations

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Uncovering DRBControl: Inside the Cyberespionage Campaign Targeting Gambling Operations

Uncovering DRBControl- Inside the Cyberespionage Campaign Targeting Gambling Operations

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Uncovering DRBControl- Inside the Cyberespionage Campaign Targeting Gambling Operations

Winnti Group targeting universities in Hong Kong

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Winnti Group targeting universities in Hong Kong

Winnti Group targeting universities in Hong Kong

date in the CCS '25 data ESET fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Winnti Group targeting universities in Hong Kong

Winnti Group targeting universities in Hong Kong

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Winnti Group targeting universities in Hong Kong

Deutsches Chemieunternehmen gehackt

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Deutsches Chemieunternehmen gehackt

The malware analyst’s guide to PE timestamps

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The malware analyst’s guide to PE timestamps

An Overhead View of the Royal Road

file creation date fromORKL

Archived copy on ORKL Detailsfor An Overhead View of the Royal Road

Cyber-Reports-2020-01-A-one-sided-Affair.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber-Reports-2020-01-A-one-sided-Affair.pdf

Group-IB_Hi-Tech_Crime_Trends_2019-2020_en

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Group-IB_Hi-Tech_Crime_Trends_2019-2020_en

BfV Cyber-Brief Nr. 01/2019

file creation date Bundesamt für Verfassungsschutz fromORKL

The original link failed its last check. Original publisher Detailsfor BfV Cyber-Brief Nr. 01/2019

Group-IB_Hi-Tech_Crime_Trends_2019-2020

date in the CCS '25 data Group-IB fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Group-IB_Hi-Tech_Crime_Trends_2019-2020

APT cases exploiting vulnerabilities in region‑specific software

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT cases exploiting vulnerabilities in region‑specific software

APT cases exploiting vulnerabilities in region‑specific software

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT cases exploiting vulnerabilities in region‑specific software

mobile-malware-report.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor mobile-malware-report.pdf

Winnti Group's skip-2.0: A Microsoft SQL Server backdoor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Winnti Group's skip-2.0: A Microsoft SQL Server backdoor

Winnti Group’s skip‑2.0_ A Microsoft SQL Server backdoor

date in the CCS '25 data ESET fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Winnti Group’s skip‑2.0_ A Microsoft SQL Server backdoor

Winnti Group’s skip‑2.0- A Microsoft SQL Server backdoor

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Winnti Group’s skip‑2.0- A Microsoft SQL Server backdoor

ESET_Winnti

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ESET_Winnti

HELO Winnti_ Attack or Scan

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor HELO Winnti_ Attack or Scan

HELO Winnti- Attack or Scan-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor HELO Winnti- Attack or Scan-

APT41: A Dual Espionage and Cyber Crime Operation

file creation date FireEye fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor APT41: A Dual Espionage and Cyber Crime Operation

APT-41.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor APT-41.pdf

report_APT41

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor report_APT41

TLP-WHITE-CERT-EU-MEMO-190725-1.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor TLP-WHITE-CERT-EU-MEMO-190725-1.pdf

Attacking the Heart of the German Industry

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Attacking the Heart of the German Industry

Winnti analysis

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Winnti analysis

GitHub - br-data/2019-winnti-analyse: Scripts and rulesets for analysing the Winnti malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GitHub - br-data/2019-winnti-analyse: Scripts and rulesets for analysing the Winnti malware

Winnti: Attacking the Heart of the German Industry

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Winnti: Attacking the Heart of the German Industry

Winnti_ Attacking the Heart of the German Industry

date in the CCS '25 data BR and NDR fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Winnti_ Attacking the Heart of the German Industry

Threat Group Cards: A Threat Actor Encyclopedia

file creation date ThaiCERT fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Threat Group Cards: A Threat Actor Encyclopedia

Threat Group Cards: A Threat Actor Encyclopedia

file creation date Martijn van der Heide fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia

HiddenWasp Malware Stings Targeted Linux Systems

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor HiddenWasp Malware Stings Targeted Linux Systems

HiddenWasp Malware Stings Targeted Linux Systems

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor HiddenWasp Malware Stings Targeted Linux Systems

HiddenWasp Malware Stings Targeted Linux Systems

date in the CCS '25 data Intezer fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor HiddenWasp Malware Stings Targeted Linux Systems

TeamViewer Confirms Undisclosed Breach From 2016

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor TeamViewer Confirms Undisclosed Breach From 2016

TeamViewer Confirms Undisclosed Breach From 2016

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TeamViewer Confirms Undisclosed Breach From 2016

Winnti: More than just Windows and Gates

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Winnti: More than just Windows and Gates

Winnti_ More than just Windows and Gates

date in the CCS '25 data Chronicle fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Winnti_ More than just Windows and Gates

C/C++ Runtime Library Code Tampering in Supply Chain

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor C/C++ Runtime Library Code Tampering in Supply Chain

Bayer hit by cyberattack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bayer hit by cyberattack

Bayer points finger at Wicked Panda in cyberattack

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Bayer points finger at Wicked Panda in cyberattack

mpressioncss_ta_report_2019.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor mpressioncss_ta_report_2019.pdf

Gaming industry still in the scope of attackers in Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Gaming industry still in the scope of attackers in Asia

Gaming industry still in the scope of attackers in Asia

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Gaming industry still in the scope of attackers in Asia

Gaming-Industry.Asia

date in the CCS '25 data ESET fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Gaming-Industry.Asia

(C)0ld Case : From Aerospace to China’s interests.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor (C)0ld Case : From Aerospace to China’s interests.

Meet CrowdStrike’s Adversary of the Month for July- WICKED SPIDER

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Meet CrowdStrike’s Adversary of the Month for July- WICKED SPIDER

Wicked Spider Adversary | Threat Actor Profile | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Wicked Spider Adversary | Threat Actor Profile | CrowdStrike

Nmap Script to scan for Winnti infections

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Nmap Script to scan for Winnti infections

GitHub - TKCERT/winnti-nmap-script: Nmap Script to scan for Winnti infections

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GitHub - TKCERT/winnti-nmap-script: Nmap Script to scan for Winnti infections

Burning Umbrella: An Intelligence Report on the Winnti Umbrella and Associated State-Sponsored Attackers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Burning Umbrella: An Intelligence Report on the Winnti Umbrella and Associated State-Sponsored Attackers

Burning Umbrella

date in the CCS '25 data 401TRG fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Burning Umbrella

GitHub - TKCERT/winnti-detector: Network detector for Winnti malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GitHub - TKCERT/winnti-detector: Network detector for Winnti malware

Suricata rules to detect Winnti communication

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Suricata rules to detect Winnti communication

GitHub - TKCERT/winnti-suricata-lua: Suricata rules to detect Winnti communication

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GitHub - TKCERT/winnti-suricata-lua: Suricata rules to detect Winnti communication

An intrusion campaign targeting Chinese language news sites

file creation date Citizen Lab fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor An intrusion campaign targeting Chinese language news sites

Recent Winnti Infrastructure and Samples _ ClearSky Cybersecurity

date in the CCS '25 data ClearSky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Recent Winnti Infrastructure and Samples _ ClearSky Cybersecurity

Winnti (LEAD/APT17) Evolution - Going Open Source

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Winnti (LEAD/APT17) Evolution - Going Open Source

Winnti Evolution - Going Open Source

date in the CCS '25 data ProtectWise fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Winnti Evolution - Going Open Source

Insider_Information

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Insider_Information

Examining a Possible Member of the Winnti Group

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Examining a Possible Member of the Winnti Group

Of Pigs and Malware- Examining a Possible Member of the Winnti Group

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Of Pigs and Malware- Examining a Possible Member of the Winnti Group

Winnti Abuses GitHub for C&C Communications

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Winnti Abuses GitHub for C&C Communications

Winnti Abuses GitHub for C&C Communications

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Winnti Abuses GitHub for C&C Communications

Detecting threat actors in recent German industrial attacks with Windows Defender ATP – Microsoft Secure

date in the CCS '25 data Microsoft fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Detecting threat actors in recent German industrial attacks with Windows Defender ATP – Microsoft Secure

Detecting threat actors in recent German industrial attacks with Windows Defender ATP

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Detecting threat actors in recent German industrial attacks with Windows Defender ATP

Digitally Signed Malware Targeting Gaming Companies

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Digitally Signed Malware Targeting Gaming Companies

A Universal Windows Bootkit

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor A Universal Windows Bootkit

A Universal Windows Bootkit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Universal Windows Bootkit

Suckfly: Revealing the secret life of your code signing certificates

file creation date Symantec fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Suckfly: Revealing the secret life of your code signing certificates

Endpoint Protection - Symantec Enterprise

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Endpoint Protection - Symantec Enterprise

Suckfly: Revealing the secret life of your code signing certificates | Symantec Connect Community

date in the CCS '25 data Symantec fromORKLCCS '25 data

The link to CyberMonitor archive on GitHub failed its last check. CyberMonitor archive on GitHub Detailsfor Suckfly: Revealing the secret life of your code signing certificates | Symantec Connect Community

Suckfly- Revealing the secret life of your code signing certificates

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Suckfly- Revealing the secret life of your code signing certificates

Network detector for Winnti malware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Network detector for Winnti malware

Evolution of Cyber Threats in the Corporate Sector

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Evolution of Cyber Threats in the Corporate Sector

I am HDRoot! Part 2

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor I am HDRoot! Part 2

I am HDRoot! Part 2

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor I am HDRoot! Part 2

I am HDRoot! Part 1

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor I am HDRoot! Part 1

I am HDRoot! Part 1

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor I am HDRoot! Part 1

Games are over- Winnti is now targeting pharmaceutical companies

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Games are over- Winnti is now targeting pharmaceutical companies

Games are over - Securelist

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Games are over - Securelist

Games are over: Winnti is now targeting pharmaceutical companies

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Games are over: Winnti is now targeting pharmaceutical companies

WINNTI Analysis

date in the CCS '25 data Novetta fromCCS '25 data

The link to Mirror on Box failed its last check. Detailsfor WINNTI Analysis

WINNTI Analysis

Malpedia library date Novetta fromORKL

The original link failed its last check. Original publisher Detailsfor WINNTI Analysis

Backdoor.Winnti attackers have a skeleton in their closet?

date in the CCS '25 data Symantec fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Backdoor.Winnti attackers have a skeleton in their closet?

Threat Group-3279 Targets the Video Game Industry | Secureworks

date in the CCS '25 data SecureWorks fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Threat Group-3279 Targets the Video Game Industry | Secureworks

Winnti FAQ. More Than Just a Game

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Winnti FAQ. More Than Just a Game

Winnti FAQ. More Than Just a Game

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Winnti FAQ. More Than Just a Game

Winnti. More than just a game

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Winnti. More than just a game

Winnti. More than just a game

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Winnti. More than just a game

Kaspersky Lab

Malpedia library date Kaspersky fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Kaspersky Lab