menuPass

Also reported as Red Apollo, Cicada, POTASSIUM, APT10, CVNX and 32 other names. Linked to China by four sources.

Reports: 1,159
Last reported: 2 August 2026
Known CVEs: 458
Techniques in ATT&CK: 46
Origin: China

ID: G0045
Sources: ATT&CK MISP ETDA Malpedia Microsoft
Merge evidence: 46 alias matches

Reports per quarter

2011 Q2: 1 report
2011 Q3: no reports
2011 Q4: no reports
2012 Q1: no reports
2012 Q2: no reports
2012 Q3: no reports
2012 Q4: no reports
2013 Q1: 1 report
2013 Q2: no reports
2013 Q3: 1 report
2013 Q4: 2 reports
2014 Q1: 2 reports
2014 Q2: no reports
2014 Q3: 2 reports
2014 Q4: no reports
2015 Q1: 2 reports
2015 Q2: no reports
2015 Q3: 8 reports
2015 Q4: 3 reports
2016 Q1: 2 reports
2016 Q2: 4 reports
2016 Q3: 2 reports
2016 Q4: 1 report
2017 Q1: 13 reports
2017 Q2: 19 reports
2017 Q3: 7 reports
2017 Q4: 5 reports
2018 Q1: 12 reports
2018 Q2: 9 reports
2018 Q3: 26 reports
2018 Q4: 9 reports
2019 Q1: 19 reports
2019 Q2: 21 reports
2019 Q3: 10 reports
2019 Q4: 24 reports
2020 Q1: 23 reports
2020 Q2: 35 reports
2020 Q3: 25 reports
2020 Q4: 62 reports
2021 Q1: 57 reports
2021 Q2: 70 reports
2021 Q3: 72 reports
2021 Q4: 61 reports
2022 Q1: 79 reports
2022 Q2: 98 reports
2022 Q3: 63 reports
2022 Q4: 29 reports
2023 Q1: 30 reports
2023 Q2: 15 reports
2023 Q3: 24 reports
2023 Q4: 17 reports
2024 Q1: 15 reports
2024 Q2: 19 reports
2024 Q3: 23 reports
2024 Q4: 16 reports
2025 Q1: 22 reports
2025 Q2: 10 reports
2025 Q3: 11 reports
2025 Q4: 9 reports
2026 Q1: 7 reports
2026 Q2: 59 reports
2026 Q3: 3 reports

Dated reports, 2011 Q2 to 2026 Q3.

Techniques seen in the last two years

T1059.001 14 reports in ATT&CK
T1053.005 13 reports in ATT&CK
T1057 12 reports reports only
T1082 12 reports reports only
T1059.003 11 reports in ATT&CK
T1071.001 11 reports reports only
T1140 11 reports in ATT&CK
T1105 10 reports in ATT&CK
T1204.002 10 reports in ATT&CK
T1566.001 8 reports in ATT&CK

Show all 303 techniques Show fewer

T1012 7 reports reports only
T1016 7 reports in ATT&CK
T1027 7 reports reports only
T1041 7 reports reports only
T1047 7 reports in ATT&CK
T1190 7 reports in ATT&CK
T1219 7 reports reports only
T1055 6 reports reports only
T1112 6 reports reports only
T1132.001 6 reports reports only
T1189 6 reports reports only
T1543.003 6 reports reports only
T1547.001 6 reports reports only
T1566.002 6 reports reports only
T1574.001 6 reports in ATT&CK
T1003.001 5 reports reports only
T1018 5 reports in ATT&CK
T1033 5 reports reports only
T1068 5 reports reports only
T1070.004 5 reports in ATT&CK
T1071 5 reports reports only
T1136.001 5 reports reports only
T1566 5 reports reports only
T1573.001 5 reports reports only
T1583.001 5 reports in ATT&CK
T1005 4 reports in ATT&CK
T1007 4 reports reports only
T1021.001 4 reports in ATT&CK
T1036 4 reports in ATT&CK
T1036.005 4 reports in ATT&CK
T1078 4 reports in ATT&CK
T1083 4 reports in ATT&CK
T1087.001 4 reports reports only
T1087.002 4 reports in ATT&CK
T1095 4 reports reports only
T1136 4 reports reports only
T1482 4 reports reports only
T1572 4 reports reports only
T1583.003 4 reports reports only
T1587.001 4 reports reports only
T1003.002 3 reports in ATT&CK
T1021.002 3 reports reports only
T1027.009 3 reports reports only
T1046 3 reports in ATT&CK
T1055.002 3 reports reports only
T1059 3 reports reports only
T1059.005 3 reports reports only
T1069.002 3 reports reports only
T1102 3 reports reports only
T1124 3 reports reports only
T1129 3 reports reports only
T1133 3 reports reports only
T1204 3 reports reports only
T1486 3 reports reports only
T1497.001 3 reports reports only
T1505.003 3 reports reports only
T1518.001 3 reports reports only
T1555.003 3 reports reports only
T1569.002 3 reports reports only
T1570 3 reports reports only
T1573 3 reports reports only
T1583.004 3 reports reports only
T1608.001 3 reports reports only
T1620 3 reports reports only
T1622 3 reports reports only
T1003 2 reports reports only
T1003.003 2 reports in ATT&CK
T1008 2 reports reports only
T1021 2 reports reports only
T1036.007 2 reports reports only
T1037.001 2 reports reports only
T1049 2 reports in ATT&CK
T1053 2 reports reports only
T1055.004 2 reports reports only
T1055.012 2 reports in ATT&CK
T1056.001 2 reports in ATT&CK
T1059.006 2 reports reports only
T1059.007 2 reports reports only
T1069.001 2 reports reports only
T1070.006 2 reports reports only
T1071.004 2 reports reports only
T1072 2 reports reports only
T1090 2 reports reports only
T1090.001 2 reports reports only
T1098 2 reports reports only
T1098.007 2 reports reports only
T1104 2 reports reports only
T1113 2 reports reports only
T1115 2 reports reports only
T1119 2 reports in ATT&CK
T1127.001 2 reports reports only
T1132 2 reports reports only
T1134.002 2 reports reports only
T1135 2 reports reports only
T1204.001 2 reports reports only
T1210 2 reports in ATT&CK
T1217 2 reports reports only
T1218 2 reports reports only
T1218.007 2 reports reports only
T1496 2 reports reports only
T1505.004 2 reports reports only
T1546.003 2 reports reports only
T1548 2 reports reports only
T1560 2 reports in ATT&CK
T1560.001 2 reports in ATT&CK
T1566.004 2 reports reports only
T1567 2 reports reports only
T1568.002 2 reports reports only
T1571 2 reports reports only
T1573.002 2 reports reports only
T1574 2 reports reports only
T1583 2 reports reports only
T1583.008 2 reports reports only
T1584.004 2 reports reports only
T1585.002 2 reports reports only
T1588.002 2 reports in ATT&CK
T1590 2 reports reports only
T1595 2 reports reports only
T1595.002 2 reports reports only
T1598 2 reports reports only
T1608 2 reports reports only
T1608.002 2 reports reports only
T1608.006 2 reports reports only
T1649 2 reports reports only
T1001.001 1 report reports only
T1001.003 1 report reports only
T1010 1 report reports only
T1014 1 report reports only
T1016.001 1 report reports only
T1020 1 report reports only
T1021.004 1 report in ATT&CK
T1021.005 1 report reports only
T1021.006 1 report reports only
T1027.004 1 report reports only
T1027.007 1 report reports only
T1027.010 1 report reports only
T1027.011 1 report reports only
T1030 1 report reports only
T1036.003 1 report in ATT&CK
T1037 1 report reports only
T1039 1 report in ATT&CK
T1040 1 report reports only
T1048 1 report reports only
T1053.003 1 report reports only
T1055.001 1 report reports only
T1055.003 1 report reports only
T1055.009 1 report reports only
T1056 1 report reports only
T1059.002 1 report reports only
T1059.004 1 report reports only
T1059.009 1 report reports only
T1059.010 1 report reports only
T1059.011 1 report reports only
T1069 1 report reports only
T1069.003 1 report reports only
T1070 1 report reports only
T1070.003 1 report in ATT&CK
T1074 1 report reports only
T1074.001 1 report in ATT&CK
T1074.002 1 report in ATT&CK
T1078.002 1 report reports only
T1078.003 1 report reports only
T1078.004 1 report reports only
T1087 1 report reports only
T1087.004 1 report reports only
T1090.003 1 report reports only
T1091 1 report reports only
T1098.001 1 report reports only
T1098.003 1 report reports only
T1098.004 1 report reports only
T1098.005 1 report reports only
T1098.006 1 report reports only
T1102.002 1 report reports only
T1106 1 report in ATT&CK
T1114 1 report reports only
T1114.001 1 report reports only
T1114.002 1 report reports only
T1114.003 1 report reports only
T1120 1 report reports only
T1123 1 report reports only
T1125 1 report reports only
T1132.002 1 report reports only
T1134 1 report reports only
T1134.001 1 report reports only
T1136.002 1 report reports only
T1137 1 report reports only
T1137.006 1 report reports only
T1195 1 report reports only
T1195.001 1 report reports only
T1195.002 1 report reports only
T1199 1 report in ATT&CK
T1200 1 report reports only
T1201 1 report reports only
T1203 1 report reports only
T1204.004 1 report reports only
T1213 1 report reports only
T1213.001 1 report reports only
T1213.002 1 report reports only
T1213.003 1 report reports only
T1218.014 1 report reports only
T1221 1 report reports only
T1484 1 report reports only
T1484.001 1 report reports only
T1485 1 report reports only
T1489 1 report reports only
T1490 1 report reports only
T1491.002 1 report reports only
T1497 1 report reports only
T1497.003 1 report reports only
T1498 1 report reports only
T1505 1 report reports only
T1518 1 report reports only
T1526 1 report reports only
T1528 1 report reports only
T1529 1 report reports only
T1530 1 report reports only
T1534 1 report reports only
T1537 1 report reports only
T1538 1 report reports only
T1543 1 report reports only
T1543.002 1 report reports only
T1543.004 1 report reports only
T1546 1 report reports only
T1546.004 1 report reports only
T1546.008 1 report reports only
T1546.012 1 report reports only
T1546.015 1 report reports only
T1547 1 report reports only
T1547.002 1 report reports only
T1547.005 1 report reports only
T1547.009 1 report reports only
T1548.002 1 report reports only
T1550 1 report reports only
T1550.001 1 report reports only
T1550.002 1 report reports only
T1552 1 report reports only
T1553.002 1 report in ATT&CK
T1554 1 report reports only
T1555 1 report reports only
T1556 1 report reports only
T1556.002 1 report reports only
T1556.006 1 report reports only
T1556.009 1 report reports only
T1558.003 1 report reports only
T1559 1 report reports only
T1560.002 1 report reports only
T1563.002 1 report reports only
T1564.001 1 report reports only
T1564.003 1 report reports only
T1564.004 1 report reports only
T1564.006 1 report reports only
T1565 1 report reports only
T1565.001 1 report reports only
T1566.003 1 report reports only
T1567.001 1 report reports only
T1567.002 1 report reports only
T1569 1 report reports only
T1574.011 1 report reports only
T1578 1 report reports only
T1580 1 report reports only
T1583.006 1 report reports only
T1584 1 report reports only
T1585 1 report reports only
T1585.003 1 report reports only
T1586.002 1 report reports only
T1587 1 report reports only
T1587.003 1 report reports only
T1588 1 report reports only
T1588.001 1 report reports only
T1588.003 1 report reports only
T1588.004 1 report reports only
T1588.007 1 report reports only
T1589.002 1 report reports only
T1590.005 1 report reports only
T1592 1 report reports only
T1593.002 1 report reports only
T1595.001 1 report reports only
T1602 1 report reports only
T1602.001 1 report reports only
T1602.002 1 report reports only
T1608.003 1 report reports only
T1608.004 1 report reports only
T1608.005 1 report reports only
T1613 1 report reports only
T1614 1 report reports only
T1614.001 1 report reports only
T1615 1 report reports only
T1619 1 report reports only
T1621 1 report reports only
T1627.001 1 report reports only
T1652 1 report reports only
T1654 1 report reports only
T1657 1 report reports only

Counts come from technique IDs in the actor's report text. “Reports only” means reports name the technique but MITRE ATT&CK® does not list it for this actor.

Also listed by ATT&CK

CVEs named in reports

Show all 458 CVEs Show fewer

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

2 August 2026

Analysis of a Phishing Email Attack Case by the Larva-24009 Threat Actor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis of a Phishing Email Attack Case by the Larva-24009 Threat Actor
24 July 2026

Case Study: Targeted Attack Case on an MS-SQL Server Involving the Installation of GotoHTTP and SoftEther VPN

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Case Study: Targeted Attack Case on an MS-SQL Server Involving the Installation of GotoHTTP and SoftEther VPN
15 July 2026

Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident
26 June 2026

AsyncRAT Family Threat Overview

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AsyncRAT Family Threat Overview
25 June 2026

CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure
21 May 2026

GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses
20 May 2026

public-research/potassium/report.md at main · deepfield/public-research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor public-research/potassium/report.md at main · deepfield/public-research
14 May 2026

FrostyNeighbor: Fresh mischief and digital shenanigans

publisher's date ESET Research fromORKLESET

Archived copy on ORKL Detailsfor FrostyNeighbor: Fresh mischief and digital shenanigans
29 April 2026

Bankshot (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Bankshot (Malware Family)
10 April 2026

Another Confluence Bites the Dust: Falling to ELPACO-team Ransomware

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Another Confluence Bites the Dust: Falling to ELPACO-team Ransomware

Show all 1,159 reports Show fewer

6 April 2026

StoneDrill (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor StoneDrill (Malware Family)
6 April 2026

Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan
6 April 2026

Stone Panda, APT 10, menuPass

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Stone Panda, APT 10, menuPass
6 April 2026

ChinaZ Revelations: Revealing ChinaZ Relationships with other Chinese Threat Actor Groups

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor ChinaZ Revelations: Revealing ChinaZ Relationships with other Chinese Threat Actor Groups
6 April 2026

CUCKOO SPEAR Part 2: Threat Actor Arsenal

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor CUCKOO SPEAR Part 2: Threat Actor Arsenal
6 April 2026

APT10: sophisticated multi-layered loader Ecipekac discovered in A41APT campaign

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor APT10: sophisticated multi-layered loader Ecipekac discovered in A41APT campaign
6 April 2026

Oblique RAT (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Oblique RAT (Malware Family)
6 April 2026

What are State Sponsored Cyber Attacks? - Detailed Guide

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor What are State Sponsored Cyber Attacks? - Detailed Guide
6 April 2026

CrowdCasts Monthly: You Have an Adversary Problem

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor CrowdCasts Monthly: You Have an Adversary Problem
6 April 2026

METALJACK (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor METALJACK (Malware Family)
6 April 2026

elf.wellmess (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor elf.wellmess (Malware Family)
6 April 2026

Two Chinese Hackers Associated With the Ministry of State Security Charged with Global Computer Intrusion Campaigns Targeting Intellectual Property and Confidential Business Information

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Two Chinese Hackers Associated With the Ministry of State Security Charged with Global Computer Intrusion Campaigns Targeting Intellectual Property and Confidential Business Information
6 April 2026

SUNBURST (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor SUNBURST (Malware Family)
6 April 2026

Who wasn’t responsible for Olympic Destroyer

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Who wasn’t responsible for Olympic Destroyer
6 April 2026

China-based APT Mustang Panda might still have continued their attack activities against organizations in

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor China-based APT Mustang Panda might still have continued their attack activities against organizations in
6 April 2026

Evilgrab Delivered by Watering Hole Attack on President of Myanmar’s Website

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Evilgrab Delivered by Watering Hole Attack on President of Myanmar’s Website
6 April 2026

Cybereason Blog | Cybersecurity News and Analysis

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Cybereason Blog | Cybersecurity News and Analysis
6 April 2026

Cuckoo Spear – the latest Nation-state Threat Actor targeting Japanese companies

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Cuckoo Spear – the latest Nation-state Threat Actor targeting Japanese companies
6 April 2026

Malware Unpacking With Hardware Breakpoints - Cobalt Strike Shellcode Loader

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Malware Unpacking With Hardware Breakpoints - Cobalt Strike Shellcode Loader
6 April 2026

Poison Ivy (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Poison Ivy (Malware Family)
6 April 2026

Chinese hackers target Indian vaccine makers SII, Bharat Biotech, says security firm

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Chinese hackers target Indian vaccine makers SII, Bharat Biotech, says security firm
6 April 2026

Nightshade Panda, APT 9, Group 27

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Nightshade Panda, APT 9, Group 27
6 April 2026

Hack The Sandbox: Unveiling the Truth Behind Disappearing Artifacts

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Hack The Sandbox: Unveiling the Truth Behind Disappearing Artifacts
6 April 2026

How to Use Ghidra to Analyse Shellcode and Extract Cobalt Strike Command & Control Servers

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor How to Use Ghidra to Analyse Shellcode and Extract Cobalt Strike Command & Control Servers
6 April 2026

Accenture | Let there be change

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Accenture | Let there be change
6 April 2026

CUCKOO SPEAR Part 1: Analyzing NOOPDOOR from an IR Perspective

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor CUCKOO SPEAR Part 1: Analyzing NOOPDOOR from an IR Perspective
6 April 2026

Who Wasn’t Responsible for Olympic Destroyer?

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Who Wasn’t Responsible for Olympic Destroyer?
6 April 2026

Red Apollo

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Red Apollo
6 April 2026

Airbus cyber attack believed to have been conducted by hackers in China

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Airbus cyber attack believed to have been conducted by hackers in China
6 April 2026

Ghidra Tutorial - Using Entropy To Locate Cobalt Strike Decryption Functions

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Ghidra Tutorial - Using Entropy To Locate Cobalt Strike Decryption Functions
6 April 2026

Bitdefender Labs

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Bitdefender Labs
6 April 2026

iTWire - Ransomware gang attacks Texas unit of global steel conglomerate

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor iTWire - Ransomware gang attacks Texas unit of global steel conglomerate
6 April 2026

Council on Foreign Relations

date ORKL added it fromORKL

The original link failed its last check. Original publisher Detailsfor Council on Foreign Relations
6 April 2026

Definitive Dossier of Devilish Debug Details — Part One: PDB Paths and Malware | Mandiant

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Definitive Dossier of Devilish Debug Details — Part One: PDB Paths and Malware | Mandiant
6 April 2026

MimiKatz (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor MimiKatz (Malware Family)
6 April 2026

APT trends report Q1 2019

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor APT trends report Q1 2019
6 April 2026

ChChes – Malware that Communicates with C&C Servers Using Cookie Headers - JPCERT/CC Eyes

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor ChChes – Malware that Communicates with C&C Servers Using Cookie Headers - JPCERT/CC Eyes
6 April 2026

PlugX (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor PlugX (Malware Family)
6 April 2026

PowGoop (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor PowGoop (Malware Family)
6 April 2026

EvilGrab Malware Family Used In Targeted Attacks

date ORKL added it fromORKL

The original link failed its last check. Original publisher Detailsfor EvilGrab Malware Family Used In Targeted Attacks
6 April 2026

Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia
6 April 2026

Cybereason Blog | Cybersecurity News and Analysis

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Cybereason Blog | Cybersecurity News and Analysis
6 April 2026

China Chopper - Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor China Chopper - Threat Group Cards: A Threat Actor Encyclopedia
6 April 2026

Cobalt Strike (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Cobalt Strike (Malware Family)
6 April 2026

Quasar RAT (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Quasar RAT (Malware Family)
6 April 2026

Accenture | Let there be change

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Accenture | Let there be change
6 April 2026

Consequences - The Conti Leaks and future problems

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Consequences - The Conti Leaks and future problems
6 April 2026

Deputy Attorney General Rod J. Rosenstein Announces Charges Against Chinese Hackers

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Deputy Attorney General Rod J. Rosenstein Announces Charges Against Chinese Hackers
6 April 2026

EU imposes the first ever sanctions against cyber-attacks

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor EU imposes the first ever sanctions against cyber-attacks
6 April 2026

Chinese Actors Use ‘3102’ Malware in Attacks on US Government and EU Media

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Chinese Actors Use ‘3102’ Malware in Attacks on US Government and EU Media
6 April 2026

Norway says Chinese group APT31 is behind catastrophic 2018 government hack

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Norway says Chinese group APT31 is behind catastrophic 2018 government hack
6 April 2026

Threat Intelligence Query Examples - Real World Queries for Identifying Malware Infrastructure

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Threat Intelligence Query Examples - Real World Queries for Identifying Malware Infrastructure
27 March 2026

PlugX : Mustang Panda APT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PlugX : Mustang Panda APT
26 February 2026

PlugX Meeting Invitation via MSBuild and GDATA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PlugX Meeting Invitation via MSBuild and GDATA
5 February 2026

The Shadow Campaigns: Uncovering Global Espionage

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Shadow Campaigns: Uncovering Global Espionage
3 February 2026

The Notepad++ supply chain attack — unnoticed execution chains and new IoCs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Notepad++ supply chain attack — unnoticed execution chains and new IoCs
26 January 2026

GOGITTER, GITSHELLPAD, and GOSHELL Analysis | ThreatLabz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GOGITTER, GITSHELLPAD, and GOSHELL Analysis | ThreatLabz
8 January 2026

UAT-7290 targets high value telecommunications infrastructure in South Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UAT-7290 targets high value telecommunications infrastructure in South Asia
4 January 2026

From a New Year's surprise to a bag of coal - Analysis of mystery PowerShell

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From a New Year's surprise to a bag of coal - Analysis of mystery PowerShell
29 December 2025

The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor
19 December 2025

Tracing a Paper Werewolf campaign through AI-generated decoys and Excel XLLs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tracing a Paper Werewolf campaign through AI-generated decoys and Excel XLLs
19 December 2025

Multiple Threat Actors Leveraging CVE-2025-55182 (React2Shell)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Multiple Threat Actors Leveraging CVE-2025-55182 (React2Shell)
18 December 2025

Acronis TRU Alliance {Hunt.io}: Hunting DPRK threats - New Global Lazarus & Kimsuky campaigns

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Acronis TRU Alliance {Hunt.io}: Hunting DPRK threats - New Global Lazarus & Kimsuky campaigns
20 November 2025

APT24's Pivot to Multi-Vector Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT24's Pivot to Multi-Vector Attacks
10 November 2025

State-Sponsored Remote Wipe Tactics Targeting Android Devices

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor State-Sponsored Remote Wipe Tactics Targeting Android Devices
30 October 2025

UNC6384 Weaponizes ZDI-CAN-25373 Vulnerability to Deploy PlugX Against Hungarian and Belgian Diplomatic Entities - Arctic Wolf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UNC6384 Weaponizes ZDI-CAN-25373 Vulnerability to Deploy PlugX Against Hungarian and Belgian Diplomatic Entities - Arctic Wolf
22 October 2025

The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns
2 October 2025

UAT-8099: Chinese-speaking cybercrime group targets high-value IIS for SEO fraud

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UAT-8099: Chinese-speaking cybercrime group targets high-value IIS for SEO fraud
29 September 2025

From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion
24 September 2025

Chinese Hackers RedNovember Target Global Governments Using Pantegana and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese Hackers RedNovember Target Global Governments Using Pantegana and Cobalt Strike
28 August 2025

TAOTH Campaign Exploits End-of-Support Software to Target Traditional Chinese Users and Dissidents

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TAOTH Campaign Exploits End-of-Support Software to Target Traditional Chinese Users and Dissidents
27 August 2025

ShadowSilk: A Cross-Border Binary Union for Data Exfiltration | Group-IB Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ShadowSilk: A Cross-Border Binary Union for Data Exfiltration | Group-IB Blog
26 August 2025

TAG-144’s Persistent Grip on South American Organizations

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TAG-144’s Persistent Grip on South American Organizations
25 August 2025

PRC-Nexus Espionage Campaign Hijacks Web Traffic to Target Diplomats

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PRC-Nexus Espionage Campaign Hijacks Web Traffic to Target Diplomats
5 August 2025

Lost in Translation: Threat Actors Use SEO Poisoning and Fake DeepL Sites to Distribute Gh0st RAT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lost in Translation: Threat Actors Use SEO Poisoning and Fake DeepL Sites to Distribute Gh0st RAT
21 July 2025

The SOC files: Rumble in the jungle or APT41’s new target in Africa

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The SOC files: Rumble in the jungle or APT41’s new target in Africa
17 July 2025

Dissecting the ClickFix User-Execution Attack and Its Sophisticated Persistence via ADS

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dissecting the ClickFix User-Execution Attack and Its Sophisticated Persistence via ADS
16 July 2025

Phish and Chips: China-Aligned Espionage Actors Ramp Up Taiwan Semiconductor Industry Targeting | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Phish and Chips: China-Aligned Espionage Actors Ramp Up Taiwan Semiconductor Industry Targeting | Proofpoint US
3 July 2025

Scattered Spider: Rapid7 Insights, Observations, and Recommendations

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Scattered Spider: Rapid7 Insights, Observations, and Recommendations
24 June 2025

Cyber%20Threat%20Intelligence%20Report%202025.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber%20Threat%20Intelligence%20Report%202025.pdf
23 June 2025

Threat Hunting Introduction: Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Hunting Introduction: Cobalt Strike
19 June 2025

Cobalt Strike Operators Leverage PowerShell Loaders Across Chinese, Russian, and Global Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Operators Leverage PowerShell Loaders Across Chinese, Russian, and Global Infrastructure
15 June 2025

Team46 and TaxOff: two sides of the same coin

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Team46 and TaxOff: two sides of the same coin
27 May 2025

Earth Lamia Develops Custom Arsenal to Target Multiple Industries

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Lamia Develops Custom Arsenal to Target Multiple Industries
19 May 2025

Another Confluence Bites the Dust: Falling to ELPACO-team Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Another Confluence Bites the Dust: Falling to ELPACO-team Ransomware
30 April 2025

(Larva-25003) 웹 서버 대상 IIS 악성코드 유포 사례 - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor (Larva-25003) 웹 서버 대상 IIS 악성코드 유포 사례 - ASEC
29 April 2025

Nitrogen Dropping Cobalt Strike – A Combination of “Chemical Elements”

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Nitrogen Dropping Cobalt Strike – A Combination of “Chemical Elements”
24 April 2025

m-trends-2025-en.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor m-trends-2025-en.pdf
17 April 2025

Around the World in 90 Days: State-Sponsored Actors Try ClickFix | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Around the World in 90 Days: State-Sponsored Actors Try ClickFix | Proofpoint US
31 March 2025

Operation HollowQuill: Malware delivered into Russian R&D Networks via Research Decoy PDFs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation HollowQuill: Malware delivered into Russian R&D Networks via Research Decoy PDFs
31 March 2025

The Espionage Toolkit of Earth Alux A Closer Look at its Advanced Techniques

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Espionage Toolkit of Earth Alux A Closer Look at its Advanced Techniques
20 March 2025

UAT-5918 targets critical infrastructure entities in Taiwan

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UAT-5918 targets critical infrastructure entities in Taiwan
20 March 2025

Operation FishMedley targeting governments, NGOs, and think tanks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation FishMedley targeting governments, NGOs, and think tanks
18 March 2025

Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor
13 March 2025

Analyzing OBSCURE#BAT: Threat Actors Lure Victims into Executing Malicious Batch Scripts to Deploy Stealthy Rootkits

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing OBSCURE#BAT: Threat Actors Lure Victims into Executing Malicious Batch Scripts to Deploy Stealthy Rootkits
11 March 2025

Blind Eagle Hacks Colombian Institutions Using NTLM Flaw, RATs and GitHub-Based Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Blind Eagle Hacks Colombian Institutions Using NTLM Flaw, RATs and GitHub-Based Attacks
4 March 2025

비상계엄 테마 APT 공격과 Kimsuky 그룹 연관성 분석

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 비상계엄 테마 APT 공격과 Kimsuky 그룹 연관성 분석
28 February 2025

CrowdStrikeGlobalThreatReport2025.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CrowdStrikeGlobalThreatReport2025.pdf
24 February 2025

The GitVenom campaign: cryptocurrency theft using GitHub

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The GitVenom campaign: cryptocurrency theft using GitHub
20 February 2025

Updated Shadowpad Malware Leads to Ransomware Deployment

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Updated Shadowpad Malware Leads to Ransomware Deployment
20 February 2025

Meet NailaoLocker: a ransomware distributed in Europe by ShadowPad and PlugX backdoors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Meet NailaoLocker: a ransomware distributed in Europe by ShadowPad and PlugX backdoors
20 February 2025

Updated Shadowpad Malware Leads to Ransomware Deployment

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Updated Shadowpad Malware Leads to Ransomware Deployment
13 February 2025

China-linked Espionage Tools Used in Ransomware Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-linked Espionage Tools Used in Ransomware Attacks
4 February 2025

Tracing the Path From SmartApeSG to NetSupport RAT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tracing the Path From SmartApeSG to NetSupport RAT
29 January 2025

CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia
21 January 2025

JSAC2025_1_5_leon-chang_theo-chen_en.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor JSAC2025_1_5_leon-chang_theo-chen_en.pdf
20 January 2025

JSAC2025_2_9_kamekawa_sasada_niwa_en.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor JSAC2025_2_9_kamekawa_sasada_niwa_en.pdf
14 January 2025

Justice Department and FBI Conduct International Operation to Delete Malware Used by China-Backed Hackers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Justice Department and FBI Conduct International Operation to Delete Malware Used by China-Backed Hackers
10 January 2025

Jul-Dec%202024%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Jul-Dec%202024%20Botnet%20Threat%20Update.pdf
9 January 2025

Chinese State-Sponsored RedDelta Targeted Taiwan, Mongolia, and Southeast Asia with Adapted PlugX Infection Chain

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese State-Sponsored RedDelta Targeted Taiwan, Mongolia, and Southeast Asia with Adapted PlugX Infection Chain
7 January 2025

Golang Beacons and VS Code Tunnels: Tracking a Cobalt Strike Server Leveraging Trusted Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Golang Beacons and VS Code Tunnels: Tracking a Cobalt Strike Server Leveraging Trusted Infrastructure
12 December 2024

Under the SADBRIDGE with GOSAR: QUASAR Gets a Golang Rewrite

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Under the SADBRIDGE with GOSAR: QUASAR Gets a Golang Rewrite
4 December 2024

Black Basta Ransomware Campaign Drops Zbot, DarkGate, and Custom Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Black Basta Ransomware Campaign Drops Zbot, DarkGate, and Custom Malware
3 December 2024

Rare Watermark Links Cobalt Strike 4.10 Team Servers to Ongoing Suspicious Activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rare Watermark Links Cobalt Strike 4.10 Team Servers to Ongoing Suspicious Activity
2 December 2024

The Curious Case of an Egg-Cellent Resume

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor The Curious Case of an Egg-Cellent Resume
26 November 2024

Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024
19 November 2024

Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella
12 November 2024

China-Nexus TAG-112 Compromises Tibetan Websites to Distribute Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-Nexus TAG-112 Compromises Tibetan Websites to Distribute Cobalt Strike
12 November 2024

China-Nexus TAG-112 Compromises Tibetan Websites to Distribute Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-Nexus TAG-112 Compromises Tibetan Websites to Distribute Cobalt Strike
31 October 2024

Tricks, Treats, and Threats: Cobalt Strike & the Goblin Lurking in Plain Sight

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tricks, Treats, and Threats: Cobalt Strike & the Goblin Lurking in Plain Sight
30 October 2024

Jumpy Pisces Engages in Play Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Jumpy Pisces Engages in Play Ransomware
24 October 2024

Operation Cobalt Whisper: Threat Actor Targets Multiple Industries Across Hong Kong and Pakistan.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Cobalt Whisper: Threat Actor Targets Multiple Industries Across Hong Kong and Pakistan.
23 October 2024

Threat Spotlight: WarmCookie/BadSpace

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Spotlight: WarmCookie/BadSpace
23 October 2024

Highlighting TA866/Asylum Ambuscade Activity Since 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Highlighting TA866/Asylum Ambuscade Activity Since 2021
10 October 2024

Unmasking Adversary Infrastructure: How Certificates and Redirects Exposed Earth Baxia and PlugX Activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unmasking Adversary Infrastructure: How Certificates and Redirects Exposed Earth Baxia and PlugX Activity
4 October 2024

it didn't turn into a truck, but a widely spread Android botnet

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor it didn't turn into a truck, but a widely spread Android botnet
4 October 2024

Virus Bulletin :: TA577 walked just past you: indirect syscalls in Pikabot

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Virus Bulletin :: TA577 walked just past you: indirect syscalls in Pikabot
24 September 2024

Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdf
22 September 2024

The Russian APT Tool Matrix

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Russian APT Tool Matrix
19 September 2024

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/earth-baxia-uses-spear-phishing-and-geoserver-exploit-to-target-apac/IOCs%20-%20Earth%20Baxia%20Uses%20Spear-Phishing%20and%20GeoServer%20Exploit%20to%20Target%20APAC.txt

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/earth-baxia-uses-spear-phishing-and-geoserver-exploit-to-target-apac/IOCs%20-%20Earth%20Baxia%20Uses%20Spear-Phishing%20and%20GeoServer%20Exploit%20to%20Target%20APAC.txt
19 September 2024

Earth Baxia Uses Spear-Phishing and GeoServer Exploit to Target APAC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Baxia Uses Spear-Phishing and GeoServer Exploit to Target APAC
10 September 2024

DragonRank, a Chinese-speaking SEO manipulator service provider

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DragonRank, a Chinese-speaking SEO manipulator service provider
5 September 2024

BlindEagle Leveraging BlotchyQuasar | ThreatLabz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BlindEagle Leveraging BlotchyQuasar | ThreatLabz
29 August 2024

From Cobalt Strike to Mimikatz: A Deep Dive into the SLOW#TEMPEST Campaign Targeting Chinese Users

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From Cobalt Strike to Mimikatz: A Deep Dive into the SLOW#TEMPEST Campaign Targeting Chinese Users
26 August 2024

BlackSuit Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor BlackSuit Ransomware
23 August 2024

Sailing_the_Seven_SEAs_Deep_Dive_into_Polaris_Arsenal_and_Intelligence_Insights.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sailing_the_Seven_SEAs_Deep_Dive_into_Polaris_Arsenal_and_Intelligence_Insights.pdf
23 August 2024

Pirates_of_The_Nang_Hai_Follow_the_Artifacts_of_Tropic_Trooper,_No_One_Knows.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Pirates_of_The_Nang_Hai_Follow_the_Artifacts_of_Tropic_Trooper,_No_One_Knows.pdf
22 August 2024

AppDomainManager Injectionを悪用したマルウェアによる攻撃について

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AppDomainManager Injectionを悪用したマルウェアによる攻撃について
21 August 2024

Chinese APT abuses MSC files with GrimResource vulnerability

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese APT abuses MSC files with GrimResource vulnerability
12 August 2024

Ongoing Social Engineering Campaign Refreshes Payloads

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ongoing Social Engineering Campaign Refreshes Payloads
4 August 2024

Decoding a Cobalt Strike Downloader Script With CyberChef

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Decoding a Cobalt Strike Downloader Script With CyberChef
1 August 2024

APT41 likely compromised Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT41 likely compromised Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike
25 July 2024

UAC-0057 Attack Detection: A Surge in Adversary Activity Distributing PICASSOLOADER and Cobalt Strike Beacon

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UAC-0057 Attack Detection: A Surge in Adversary Activity Distributing PICASSOLOADER and Cobalt Strike Beacon
22 July 2024

A Beginner's Guide to Hunting Malicious Open Directories - Censys

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Beginner's Guide to Hunting Malicious Open Directories - Censys
18 July 2024

APT41 Has Arisen From the DUST

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT41 Has Arisen From the DUST
16 July 2024

TAG-100 Uses Open-Source Tools in Suspected Global Espionage Campaign, Compromising Two Asia-Pacific Intergovernmental Bodies

Malpedia library date Insikt Group® by Recorded Future® fromORKL

Archived copy on ORKL Detailsfor TAG-100 Uses Open-Source Tools in Suspected Global Espionage Campaign, Compromising Two Asia-Pacific Intergovernmental Bodies
10 July 2024

DodgeBox | ThreatLabz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DodgeBox | ThreatLabz
9 July 2024

Jan-Jun%202024%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Jan-Jun%202024%20Botnet%20Threat%20Update.pdf
2 July 2024

Exposing FakeBat loader: distribution methods and adversary infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Exposing FakeBat loader: distribution methods and adversary infrastructure
1 July 2024

hodur_recon2024.pdf

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor hodur_recon2024.pdf
21 June 2024

GrimResource - Microsoft Management Console for initial access and evasion

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GrimResource - Microsoft Management Console for initial access and evasion
13 June 2024

Operation Celestial Force employs mobile and desktop malware to target Indian entities

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Celestial Force employs mobile and desktop malware to target Indian entities
10 June 2024

IcedID Brings ScreenConnect and CSharp Streamer to ALPHV Ransomware Deployment

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor IcedID Brings ScreenConnect and CSharp Streamer to ALPHV Ransomware Deployment
5 June 2024

SSTIC2024-Article-la_retro-ingnierie_de_code_malveillant_dans_la_cti_-_analyse_de_levolution_dune_chaine_dinfection-meslay.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SSTIC2024-Article-la_retro-ingnierie_de_code_malveillant_dans_la_cti_-_analyse_de_levolution_dune_chaine_dinfection-meslay.pdf
5 June 2024

SSTIC2024 - Rétro-ingénierie de code malveillant dans la CTI

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SSTIC2024 - Rétro-ingénierie de code malveillant dans la CTI
3 June 2024

China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence
23 May 2024

Sharp Dragon Expands Towards Africa and The Caribbean - Check Point Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sharp Dragon Expands Towards Africa and The Caribbean - Check Point Research
23 May 2024

Operation Diplomatic Specter: An Active Chinese Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Diplomatic Specter: An Active Chinese Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia
23 May 2024

Chinese Espionage Campaign Expands to Target Africa and The Caribbean

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese Espionage Campaign Expands to Target Africa and The Caribbean
15 May 2024

Threat actors misusing Quick Assist in social engineering attacks leading to ransomware | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat actors misusing Quick Assist in social engineering attacks leading to ransomware | Microsoft Security Blog
14 May 2024

QakBot attacks with Windows zero-day (CVE-2024-30051)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor QakBot attacks with Windows zero-day (CVE-2024-30051)
10 May 2024

Ongoing Social Engineering Campaign Linked to Black Basta Ransomware Operators

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ongoing Social Engineering Campaign Linked to Black Basta Ransomware Operators
1 May 2024

cyberespionage_report_2023.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor cyberespionage_report_2023.pdf
27 April 2024

Finding Malware: Detecting SOGU with Google Security Operations.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Finding Malware: Detecting SOGU with Google Security Operations.
24 April 2024

Securonix Threat Research Security Advisory: Analysis of Ongoing FROZEN#SHADOW Attack Campaign Leveraging SSLoad Malware and RMM Software for Domain Takeover

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Securonix Threat Research Security Advisory: Analysis of Ongoing FROZEN#SHADOW Attack Campaign Leveraging SSLoad Malware and RMM Software for Domain Takeover
19 April 2024

Asia-24-Chen-Chinese-APT.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Asia-24-Chen-Chinese-APT.pdf
19 April 2024

Wirtschaftsspionage gegen Volkwagen: VW-Konzern wurde jahrelang ausge…

Malpedia library date fromORKL

The title opens archive.today, not the publisher’s page. Archived copy on ORKL Detailsfor Wirtschaftsspionage gegen Volkwagen: VW-Konzern wurde jahrelang ausge…
11 April 2024

GitHub - jeFF0Falltrades/rat_king_parser: A robust, multiprocessing-capable, multi-family RAT config parser/config extractor for AsyncRAT, DcRAT, VenomRAT, QuasarRAT, XWorm, Xeno RAT, and cloned/derivative RAT families.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GitHub - jeFF0Falltrades/rat_king_parser: A robust, multiprocessing-capable, multi-family RAT config parser/config extractor for AsyncRAT, DcRAT, VenomRAT, QuasarRAT, XWorm, Xeno RAT, and cloned/derivative RAT families.
1 April 2024

From OneNote to RansomNote: An Ice Cold Intrusion

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor From OneNote to RansomNote: An Ice Cold Intrusion
19 March 2024

Rewterz Threat Alert – China-Linked Earth Krahang APT Breached 70 Organizations in 23 Nations – Active IOCs - Rewterz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rewterz Threat Alert – China-Linked Earth Krahang APT Breached 70 Organizations in 23 Nations – Active IOCs - Rewterz
18 March 2024

Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks
1 March 2024

Malware Analysis — Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Analysis — Cobalt Strike
9 February 2024

A Beginner's Guide to Tracking Malware Infrastructure - Censys

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Beginner's Guide to Tracking Malware Infrastructure - Censys
30 January 2024

The Endless Struggle Against APT10_ Insights from LODEINFO v0.6.6 - v0.7.3 Analysis - Researcher Blog - ITOCHU Cyber & Intelligence Inc_

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The Endless Struggle Against APT10_ Insights from LODEINFO v0.6.6 - v0.7.3 Analysis - Researcher Blog - ITOCHU Cyber & Intelligence Inc_
26 January 2024

JSAC2024_2_7_hara_shoji_higashi_vickie-su_nick-dai_en.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor JSAC2024_2_7_hara_shoji_higashi_vickie-su_nick-dai_en.pdf
25 January 2024

The Secret Life of RATs: connecting the dots by dissecting multiple backdoors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Secret Life of RATs: connecting the dots by dissecting multiple backdoors
25 January 2024

PowerPoint 簡報

Malpedia library date TeamT5 fromORKL

Archived copy on ORKL Detailsfor PowerPoint 簡報
25 January 2024

Threat Intelligence of Abused Public Post-Exploitation Frameworks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Intelligence of Abused Public Post-Exploitation Frameworks
25 January 2024

PowerPoint Presentation

file creation date fromORKL

Archived copy on ORKL Detailsfor PowerPoint Presentation
24 January 2024

The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis
21 January 2024

A Look into PlugX Kernel driver

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Look into PlugX Kernel driver
15 January 2024

Hunting AsyncRAT & QuasarRAT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hunting AsyncRAT & QuasarRAT
12 January 2024

Q4%202023%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Q4%202023%20Botnet%20Threat%20Update.pdf
9 January 2024

2023 Adversary Infrastructure Report

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023 Adversary Infrastructure Report
8 December 2023

How to Use Ghidra to Analyse Shellcode and Extract Cobalt Strike Command & Control Servers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How to Use Ghidra to Analyse Shellcode and Extract Cobalt Strike Command & Control Servers
6 December 2023

Unmasking the Enigma: A Historical Dive into the World of PlugX Malware | Splunk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unmasking the Enigma: A Historical Dive into the World of PlugX Malware | Splunk
4 December 2023

SQL Brute Force Leads to BlueSky Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor SQL Brute Force Leads to BlueSky Ransomware
19 November 2023

Combining Pivot Points to Identify Malware Infrastructure - Redline, Smokeloader and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Combining Pivot Points to Identify Malware Infrastructure - Redline, Smokeloader and Cobalt Strike
14 November 2023

HostingHunter Series: CHANG WAY TECHNOLOGIES CO. LIMITED

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor HostingHunter Series: CHANG WAY TECHNOLOGIES CO. LIMITED
10 November 2023

The New APT Group DarkCasino and the Global Surge in WinRAR 0-Day Exploits - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.

Malpedia library date NSFOCUS fromORKLCCS '25 data

Archived copy on ORKL Detailsfor The New APT Group DarkCasino and the Global Surge in WinRAR 0-Day Exploits - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.
9 November 2023

Modern Asia APT groups TTPs

file creation date Kaspersky fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Modern Asia APT groups TTPs
7 November 2023

New Gootloader Variant “GootBot” Changes the Game in Malware Tactics

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Gootloader Variant “GootBot” Changes the Game in Malware Tactics
6 November 2023

Malware Unpacking With Hardware Breakpoints - Cobalt Strike Shellcode Loader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Unpacking With Hardware Breakpoints - Cobalt Strike Shellcode Loader
1 November 2023

Popping Blisters for research: An overview of past payloads and exploring recent developments

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Popping Blisters for research: An overview of past payloads and exploring recent developments
26 October 2023

CERTFR-2023-CTI-009.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERTFR-2023-CTI-009.pdf
23 October 2023

Cobalt Strike .VBS Loader - Decoding with Advanced CyberChef and Emulation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike .VBS Loader - Decoding with Advanced CyberChef and Emulation
20 October 2023

Cobalt Strike Malware Analysis With CyberChef and Emulation - .HTA Loader Example

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Malware Analysis With CyberChef and Emulation - .HTA Loader Example
18 October 2023

Ghidra Tutorial - Using Entropy To Locate Cobalt Strike Decryption Functions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ghidra Tutorial - Using Entropy To Locate Cobalt Strike Decryption Functions
12 October 2023

Forensic Timeline of an IcedID Infection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Forensic Timeline of an IcedID Infection
12 October 2023

2023%20Q3%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023%20Q3%20Botnet%20Threat%20Update.pdf
10 October 2023

Grayling: Previously Unseen Threat Actor Targets Multiple Organizations in Taiwan

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Grayling: Previously Unseen Threat Actor Targets Multiple Organizations in Taiwan
22 September 2023

Backchannel Diplomacy: APT29's Rapidly Evolving Diplomatic Phishing Operations | Mandiant

Malpedia library date Mandiant fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Backchannel Diplomacy: APT29's Rapidly Evolving Diplomatic Phishing Operations | Mandiant
22 September 2023

Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda
12 September 2023

CERTFR-2023-CTI-007.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERTFR-2023-CTI-007.pdf
8 September 2023

Carderbee Targets Hong Kong in Supply Chain Attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Carderbee Targets Hong Kong in Supply Chain Attack
8 September 2023

Uncovering DDGroup — A long-time threat actor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Uncovering DDGroup — A long-time threat actor
7 September 2023

My Tea’s not cold. An overview of China’s cyber threat

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor My Tea’s not cold. An overview of China’s cyber threat
7 September 2023

aa23-250a-apt-actors-exploit-cve-2022-47966-and-cve-2022-42475.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor aa23-250a-apt-actors-exploit-cve-2022-47966-and-cve-2022-42475.pdf
30 August 2023

Earth Estries Targets Government, Tech for Cyberespionage

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Estries Targets Government, Tech for Cyberespionage
29 August 2023

Diving Deep into UNC4841 Operations Following Barracuda ESG Zero-Day Remediation (CVE-2023-2868) | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Diving Deep into UNC4841 Operations Following Barracuda ESG Zero-Day Remediation (CVE-2023-2868) | Mandiant
28 August 2023

HTML Smuggling Leads to Domain Wide Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor HTML Smuggling Leads to Domain Wide Ransomware
22 August 2023

Analysis of APT Attack Cases Targeting Web Services of Korean Corporations - ASEC

Malpedia library date AhnLab fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Analysis of APT Attack Cases Targeting Web Services of Korean Corporations - ASEC
22 August 2023

Andariel 그룹의 새로운 공격 활동 분석 - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Andariel 그룹의 새로운 공격 활동 분석 - ASEC
22 August 2023

Carderbee: APT Group use Legit Software in Supply Chain Attack Targeting Orgs in Hong Kong

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Carderbee: APT Group use Legit Software in Supply Chain Attack Targeting Orgs in Hong Kong
18 August 2023

Understanding Syscalls: Direct, Indirect, and Cobalt Strike Implementation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Understanding Syscalls: Direct, Indirect, and Cobalt Strike Implementation
18 August 2023

Unmasking CamoFei An In-depth Analysis of an Emerging APT Group Focused on Healthcare Sectors in East Asia

date in the CCS '25 data Team T5 fromCCS '25 data

Detailsfor Unmasking CamoFei An In-depth Analysis of an Emerging APT Group Focused on Healthcare Sectors in East Asia
17 August 2023

Chinese Entanglement | DLL Hijacking in the Asian Gambling Sector

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese Entanglement | DLL Hijacking in the Asian Gambling Sector
16 August 2023

Unmasking CamoFei

file creation date fromORKL

Archived copy on ORKL Detailsfor Unmasking CamoFei
7 August 2023

RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale
2 August 2023

HUI Loader — Malware Analysis Note

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor HUI Loader — Malware Analysis Note
29 July 2023

gcat_threathorizons_full_jul2023.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor gcat_threathorizons_full_jul2023.pdf
11 July 2023

The Spies Who Loved You: Infected USB Drives to Steal Secrets | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Spies Who Loved You: Infected USB Drives to Steal Secrets | Mandiant
11 July 2023

2023%20Q2%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023%20Q2%20Botnet%20Threat%20Update.pdf
7 July 2023

Beyond appearances: unknown actor using APT29’s TTP against Chinese users

Malpedia library date Lab52 fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Beyond appearances: unknown actor using APT29’s TTP against Chinese users
3 July 2023

Chinese Threat Actors Targeting Europe in SmugX Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese Threat Actors Targeting Europe in SmugX Campaign
30 June 2023

Cobalt Strike’s Deployment with Hardware Breakpoint for AMSI Bypass

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike’s Deployment with Hardware Breakpoint for AMSI Bypass
16 June 2023

PicassoLoader and Cobalt Strike Beacon Detection: UAC-0057 aka GhostWriter Hacking Group Attacks the Ukrainian Leading Military Educational Institution

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PicassoLoader and Cobalt Strike Beacon Detection: UAC-0057 aka GhostWriter Hacking Group Attacks the Ukrainian Leading Military Educational Institution
15 June 2023

eSentire Threat Intelligence Malware Analysis: Resident Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eSentire Threat Intelligence Malware Analysis: Resident Campaign
8 June 2023

Threat Intelligence Query Examples - Real World Queries for Identifying Malware Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Intelligence Query Examples - Real World Queries for Identifying Malware Infrastructure
15 May 2023

How To Track Quasar Rat C2 Infrastructure Using TLS Certificates

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How To Track Quasar Rat C2 Infrastructure Using TLS Certificates
15 May 2023

Lancefly: Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lancefly: Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors
11 May 2023

Malware development trick - part 28: Dump lsass.exe. Simple C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development trick - part 28: Dump lsass.exe. Simple C++ example.
3 May 2023

New Mustang Panda’s campaing against Australia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Mustang Panda’s campaing against Australia
24 April 2023

Open-Source Gh0st RAT Still Haunting Inboxes 15 Years After Release

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Open-Source Gh0st RAT Still Haunting Inboxes 15 Years After Release
23 April 2023

Botconf2022-19-FaouCoteCyr.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Botconf2022-19-FaouCoteCyr.pdf
20 April 2023

Malware-Analysis/Cobalt Strike/Indirect Syscalls.md at main · dodo-sec/Malware-Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware-Analysis/Cobalt Strike/Indirect Syscalls.md at main · dodo-sec/Malware-Analysis
12 April 2023

Following the Lazarus group by tracking DeathNote campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Following the Lazarus group by tracking DeathNote campaign
12 April 2023

2023%20Q1%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023%20Q1%20Botnet%20Threat%20Update.pdf
3 April 2023

ALPHV Ransomware Affiliate Targets Vulnerable Backup Installations to Gain Initial Access | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ALPHV Ransomware Affiliate Targets Vulnerable Backup Installations to Gain Initial Access | Mandiant
3 April 2023

Malicious ISO File Leads to Domain Wide Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Malicious ISO File Leads to Domain Wide Ransomware
30 March 2023

Research As A Service | Loginsoft

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Research As A Service | Loginsoft
30 March 2023

1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf
30 March 2023

With KEYPLUG, China’s RedGolf Spies On, Steals From Wide Field of Targets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor With KEYPLUG, China’s RedGolf Spies On, Steals From Wide Field of Targets
30 March 2023

eSentire Threat Intelligence Malware Analysis: BatLoader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eSentire Threat Intelligence Malware Analysis: BatLoader
28 March 2023

Mélofée: a new alien malware in the Panda's toolset targeting Linux hosts

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mélofée: a new alien malware in the Panda's toolset targeting Linux hosts
16 March 2023

Bee-Ware of Trigona, An Emerging Ransomware Strain

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bee-Ware of Trigona, An Emerging Ransomware Strain
10 March 2023

From Royal with Love

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From Royal with Love
9 March 2023

PlugX Malware Being Distributed via Vulnerability Exploitation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PlugX Malware Being Distributed via Vulnerability Exploitation
1 March 2023

OneNote | ThreatLabz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OneNote | ThreatLabz
24 February 2023

Snip3 Crypter | ThreatLabz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Snip3 Crypter | ThreatLabz
24 February 2023

Investigating the PlugX Trojan Disguised as a Legitimate Windows Debugger Tool

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Investigating the PlugX Trojan Disguised as a Legitimate Windows Debugger Tool
23 February 2023

Technical Advisory: Various Threat Actors Targeting ManageEngine Exploit CVE-2022-47966

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Technical Advisory: Various Threat Actors Targeting ManageEngine Exploit CVE-2022-47966
22 February 2023

Hydrochasma: Previously Unknown Group Targets Medical and Shipping Organizations in Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hydrochasma: Previously Unknown Group Targets Medical and Shipping Organizations in Asia
16 February 2023

Invitation to a Secret Event- Uncovering Earth Yako’s Campaigns

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Invitation to a Secret Event- Uncovering Earth Yako’s Campaigns
16 February 2023

Invitation to a Secret Event: Uncovering Earth Yako’s Campaigns

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Invitation to a Secret Event: Uncovering Earth Yako’s Campaigns
13 February 2023

Royal Ransomware Deep Dive

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Royal Ransomware Deep Dive
13 February 2023

Dalbit (m00nlight): Chinese Hacker Group's APT Attack Campaign - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dalbit (m00nlight): Chinese Hacker Group's APT Attack Campaign - ASEC
8 February 2023

Earth Zhulong Familiar Patterns Target Southeast Asian Firms

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Zhulong Familiar Patterns Target Southeast Asian Firms
2 February 2023

Mustang Panda APT Group Uses European Commission-Themed Lure to Deliver PlugX Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mustang Panda APT Group Uses European Commission-Themed Lure to Deliver PlugX Malware
2 February 2023

Hive Ransomware Technical Analysis and Initial Access Discovery

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hive Ransomware Technical Analysis and Initial Access Discovery
30 January 2023

Following the Scent of TrickGate: 6-Year-Old Packer Used to Deploy the Most Wanted Malware - Check Point Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Following the Scent of TrickGate: 6-Year-Old Packer Used to Deploy the Most Wanted Malware - Check Point Research
26 January 2023

Chinese PlugX Malware Hidden in Your USB Devices?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese PlugX Malware Hidden in Your USB Devices?
26 January 2023

JSAC2023_2_LT4.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor JSAC2023_2_LT4.pdf
25 January 2023

JSAC2023_1_6_minakawa-saika-kubokawa_en.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor JSAC2023_1_6_minakawa-saika-kubokawa_en.pdf
24 January 2023

The Year of the Wiper | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Year of the Wiper | FortiGuard Labs
23 January 2023

Black Basta - Technical Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Black Basta - Technical Analysis
9 January 2023

Gootkit Loader Actively Targets Australian Healthcare Industry

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Gootkit Loader Actively Targets Australian Healthcare Industry
9 January 2023

[QuickNote] Another nice PlugX sample

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor [QuickNote] Another nice PlugX sample
9 January 2023

Gootkit Loader Actively Targets Australian Healthcare Industry

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Gootkit Loader Actively Targets Australian Healthcare Industry
5 January 2023

Bluebottle: Campaign Hits Banks in French-speaking Countries in Africa

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bluebottle: Campaign Hits Banks in French-speaking Countries in Africa
27 December 2022

Diving into a PlugX sample of Mustang Panda group

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Diving into a PlugX sample of Mustang Panda group
22 December 2022

RedDelta Targets European Government Organizations and Continues to Iterate Custom PlugX Variant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RedDelta Targets European Government Organizations and Continues to Iterate Custom PlugX Variant
22 December 2022

Threat Horizons - January 2023

file creation date Google's Cybersecurity Action Team (GCAT) fromORKL

Archived copy on ORKL Detailsfor Threat Horizons - January 2023
15 December 2022

Trojanized Windows 10 Operating System Installers Targeted Ukrainian Government | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trojanized Windows 10 Operating System Installers Targeted Ukrainian Government | Mandiant
14 December 2022

Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities
8 December 2022

Breaking the silence - Recent Truebot activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Breaking the silence - Recent Truebot activity
6 December 2022

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog
6 December 2022

Eu_Repo_C_APT_profile_Conti_Wizard_Spider_dc2a733e18.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Eu_Repo_C_APT_profile_Conti_Wizard_Spider_dc2a733e18.pdf
2 December 2022

Blowing Cobalt Strike Out of the Water With Memory Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Blowing Cobalt Strike Out of the Water With Memory Analysis
2 December 2022

Hitching a ride with Mustang Panda

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hitching a ride with Mustang Panda
30 November 2022

PlugXローダーの進化

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PlugXローダーの進化
15 November 2022

Somnia Malware Detection: UAC-0118 aka FRwL Launches Cyber Attacks Against Organizations in Ukraine Using Enhanced Malware Strains

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Somnia Malware Detection: UAC-0118 aka FRwL Launches Cyber Attacks Against Organizations in Ukraine Using Enhanced Malware Strains
9 November 2022

Hack the Real Box: APT41’s New Subgroup Earth Longzhi

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hack the Real Box: APT41’s New Subgroup Earth Longzhi
3 November 2022

Cobalt Strike Analysis and Tutorial: Identifying Beacon Team Servers in the Wild

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Analysis and Tutorial: Identifying Beacon Team Servers in the Wild
3 November 2022

French-speaking gang OPERA1ER APT in Africa | Group-IB Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor French-speaking gang OPERA1ER APT in Africa | Group-IB Blog
31 October 2022

APT10- Tracking down LODEINFO 2022, part II

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT10- Tracking down LODEINFO 2022, part II
31 October 2022

APT10: Tracking down LODEINFO 2022, part I

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT10: Tracking down LODEINFO 2022, part I
31 October 2022

APT10- Tracking down LODEINFO 2022, part I

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT10- Tracking down LODEINFO 2022, part I
31 October 2022

Orion Threat Alert: Qakbot TTPs Arsenal and the Black Basta Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Orion Threat Alert: Qakbot TTPs Arsenal and the Black Basta Ransomware
31 October 2022

APT10: Tracking down LODEINFO 2022, part II

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT10: Tracking down LODEINFO 2022, part II
25 October 2022

Conceptualizing a Continuum of Cyber Threat Attribution

date ORKL added it fromORKL

The original link failed its last check. Original publisher Detailsfor Conceptualizing a Continuum of Cyber Threat Attribution
18 October 2022

APT27 - One Year To Exfiltrate Them All: Intrusion In-Depth Analysis

Malpedia library date Intrinsec fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT27 - One Year To Exfiltrate Them All: Intrusion In-Depth Analysis
13 October 2022

2022%20Q3%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2022%20Q3%20Botnet%20Threat%20Update.pdf
13 October 2022

Microsoft Security Response Center Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Security Response Center Blog
12 October 2022

Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike
6 October 2022

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog
4 October 2022

Rewterz Threat Alert – Witchetty APT Group – Active IOCs - Rewterz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rewterz Threat Alert – Witchetty APT Group – Active IOCs - Rewterz
3 October 2022

Bumblebee: increasing its capacity and evolving its TTPs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bumblebee: increasing its capacity and evolving its TTPs
3 October 2022

Water Labbu Abuses Malicious DApps to Steal Cryptocurrency

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Water Labbu Abuses Malicious DApps to Steal Cryptocurrency
29 September 2022

Witchetty- Group Uses Updated Toolset in Attacks on Governments in Middle East

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Witchetty- Group Uses Updated Toolset in Attacks on Governments in Middle East
29 September 2022

Witchetty: Group Uses Updated Toolset in Attacks on Governments in Middle East

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Witchetty: Group Uses Updated Toolset in Attacks on Governments in Middle East
26 September 2022

Hunting for Unsigned DLLs to Find APTs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hunting for Unsigned DLLs to Find APTs
26 September 2022

BumbleBee: Round Two

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor BumbleBee: Round Two
15 September 2022

Webworm: Espionage Attackers Testing and Using Older Modified RATs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Webworm: Espionage Attackers Testing and Using Older Modified RATs
14 September 2022

Dissecting PlugX to Extract Its Crown Jewels

Malpedia library date Ido Naor fromORKL

Archived copy on ORKL Detailsfor Dissecting PlugX to Extract Its Crown Jewels
13 September 2022

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense
13 September 2022

New Wave of Espionage Activity Targets Asian Governments

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Wave of Espionage Activity Targets Asian Governments
12 September 2022

Dead or Alive? An Emotet Story

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Dead or Alive? An Emotet Story
9 September 2022

MustangPanda%20-%20Enemy%20at%20the%20gate_final.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor MustangPanda%20-%20Enemy%20at%20the%20gate_final.pdf
8 September 2022

THREAT ANALYSIS REPORT: PlugX RAT Loader Evolution

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor THREAT ANALYSIS REPORT: PlugX RAT Loader Evolution
8 September 2022

Lazarus and the tale of three RATs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lazarus and the tale of three RATs
7 September 2022

Cyble - Bumblebee Returns With New Infection Technique

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyble - Bumblebee Returns With New Infection Technique
7 September 2022

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog
7 September 2022

Initial access broker repurposing techniques in targeted attacks against Ukraine

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Initial access broker repurposing techniques in targeted attacks against Ukraine
6 September 2022

Estudio del análisis de Nobelium

file creation date fromORKL

Archived copy on ORKL Detailsfor Estudio del análisis de Nobelium
6 September 2022

incibe-cert_estudio_analisis_nobelium_2022_v1.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor incibe-cert_estudio_analisis_nobelium_2022_v1.pdf
6 September 2022

Malware development tricks: parent PID spoofing. Simple C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development tricks: parent PID spoofing. Simple C++ example.
6 September 2022

#StopRansomware: Vice Society | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor #StopRansomware: Vice Society | CISA
6 September 2022

Worok: The big picture

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Worok: The big picture
1 September 2022

Ransomware Spotlight: Black Basta

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware Spotlight: Black Basta
30 August 2022

Cyber Espionage in the South China Sea | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Espionage in the South China Sea | Proofpoint US
30 August 2022

Rising Tide- Chasing the Currents of Espionage in the South China Sea

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Rising Tide- Chasing the Currents of Espionage in the South China Sea
30 August 2022

Hacker Infrastructure Used in Cisco Breach Discovered Attacking a Top Workforce Management Corporation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hacker Infrastructure Used in Cisco Breach Discovered Attacking a Top Workforce Management Corporation
29 August 2022

Malicious Cookie Stuffing Chrome Extensions with 1.4 Million Users

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Malicious Cookie Stuffing Chrome Extensions with 1.4 Million Users
25 August 2022

BlueSky Ransomware | AD Lateral Movement, Evasion and Fast Encryption Put Threat on the Radar

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BlueSky Ransomware | AD Lateral Movement, Evasion and Fast Encryption Put Threat on the Radar
25 August 2022

MERCURY leveraging Log4j 2 vulnerabilities in unpatched systems to target Israeli organizations | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MERCURY leveraging Log4j 2 vulnerabilities in unpatched systems to target Israeli organizations | Microsoft Security Blog
22 August 2022

A Tale of PivNoxy and Chinoxy Puppeteer | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Tale of PivNoxy and Chinoxy Puppeteer | FortiGuard Labs
19 August 2022

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research
18 August 2022

新APT组织穆伦鲨(MurenShark) 调查报告：袭向土耳其海军的鱼雷 – 绿盟科技技术博客

Malpedia library date NSFOCUS fromORKLCCS '25 data

Archived copy on ORKL Detailsfor 新APT组织穆伦鲨(MurenShark) 调查报告：袭向土耳其海军的鱼雷 – 绿盟科技技术博客
18 August 2022

APT41 World Tour 2021 on a tight schedule

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT41 World Tour 2021 on a tight schedule
18 August 2022

Overview of the Cyber Weapons Used in the Ukraine - Russia War | Trustwave

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Overview of the Cyber Weapons Used in the Ukraine - Russia War | Trustwave
17 August 2022

THREAT ANALYSIS REPORT: Bumblebee Loader – The High Road to Enterprise Domain Control

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor THREAT ANALYSIS REPORT: Bumblebee Loader – The High Road to Enterprise Domain Control
15 August 2022

DCShadow Attacks: Detecting a Rogue Domain Controller

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DCShadow Attacks: Detecting a Rogue Domain Controller
12 August 2022

Monster Libra (TA551/Shathak) pushes IcedID (Bokbot) with Dark VNC and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Monster Libra (TA551/Shathak) pushes IcedID (Bokbot) with Dark VNC and Cobalt Strike
11 August 2022

The Increase in Ransomware Attacks on Local Governments - SecurityScorecard

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Increase in Ransomware Attacks on Local Governments - SecurityScorecard
11 August 2022

LNK forensic and config extraction of a cobalt strike beacon

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor LNK forensic and config extraction of a cobalt strike beacon
8 August 2022

BumbleBee Roasts Its Way to Domain Admin

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor BumbleBee Roasts Its Way to Domain Admin
4 August 2022

Advanced Persistent Threats (APTs)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Advanced Persistent Threats (APTs)
3 August 2022

Flight of the Bumblebee: Email Lures and File Sharing Services Lead to Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Flight of the Bumblebee: Email Lures and File Sharing Services Lead to Malware
2 August 2022

Manjusaka: A Chinese sibling of Sliver and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Manjusaka: A Chinese sibling of Sliver and Cobalt Strike
31 July 2022

Space Invaders- Cyber Threats That Are Out Of This World

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Space Invaders- Cyber Threats That Are Out Of This World
31 July 2022

Space Invaders: Cyber Threats That Are Out Of This World

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Space Invaders: Cyber Threats That Are Out Of This World
30 July 2022

Malware AV evasion - part 8. Encode payload via Z85 algorithm. C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware AV evasion - part 8. Encode payload via Z85 algorithm. C++ example.
29 July 2022

New Qualys Research Report- Evolution of Quasar RAT

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New Qualys Research Report- Evolution of Quasar RAT
28 July 2022

Living Off Windows Defender | LockBit Ransomware Sideloads Cobalt Strike Through Microsoft Security Tool

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Living Off Windows Defender | LockBit Ransomware Sideloads Cobalt Strike Through Microsoft Security Tool
27 July 2022

qualys-wp-stealthy-quasar-evolving-to-lead-the-rat-race-v220727.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor qualys-wp-stealthy-quasar-evolving-to-lead-the-rat-race-v220727.pdf
27 July 2022

Cyble - Targeted Attacks Being Carried Out Via DLL SideLoading

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyble - Targeted Attacks Being Carried Out Via DLL SideLoading
27 July 2022

RL Blog | ReversingLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RL Blog | ReversingLabs
27 July 2022

Gootkit Loader’s Updated Tactics and Fileless Delivery of Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Gootkit Loader’s Updated Tactics and Fileless Delivery of Cobalt Strike
26 July 2022

Mandiant Red Team Emulates FIN11 Tactics To Control Operational Technology Servers | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mandiant Red Team Emulates FIN11 Tactics To Control Operational Technology Servers | Mandiant
26 July 2022

Malicious IIS extensions quietly open persistent backdoors into servers | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malicious IIS extensions quietly open persistent backdoors into servers | Microsoft Security Blog
22 July 2022

Binary Ninja - Reverse Engineering a Cobalt Strike Dropper With Binary Ninja

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Binary Ninja - Reverse Engineering a Cobalt Strike Dropper With Binary Ninja
20 July 2022

Analysis of a trojanized jQuery script: GootLoader unleashed

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis of a trojanized jQuery script: GootLoader unleashed
20 July 2022

Evacuation and Humanitarian Documents used to Spear Phish Ukrainian Entities | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Evacuation and Humanitarian Documents used to Spear Phish Ukrainian Entities | Mandiant
20 July 2022

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense
19 July 2022

Russian APT29 Hackers Use Online Storage Services, DropBox and Google Drive

Malpedia library date Palo Alto fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Russian APT29 Hackers Use Online Storage Services, DropBox and Google Drive
18 July 2022

Russian Ransomware C2 Network Discovered in Censys Data

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Russian Ransomware C2 Network Discovered in Censys Data
13 July 2022

Cobalt Strikes again: UAC-0056 continues to target Ukraine in its latest campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strikes again: UAC-0056 continues to target Ukraine in its latest campaign
13 July 2022

Cobalt Strike Analysis and Tutorial: CS Metadata Encryption and Decryption

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Analysis and Tutorial: CS Metadata Encryption and Decryption
11 July 2022

CERT-UA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERT-UA
7 July 2022

Emotet infection with Cobalt Strike - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet infection with Cobalt Strike - SANS ISC
6 July 2022

CERT-UA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERT-UA
30 June 2022

The SessionManager IIS backdoor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The SessionManager IIS backdoor
30 June 2022

Black Basta Ransomware Operators Expand Their Attack Arsenal With QakBot Trojan and PrintNightmare Exploit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Black Basta Ransomware Operators Expand Their Attack Arsenal With QakBot Trojan and PrintNightmare Exploit
27 June 2022

CB_941_Canhbao_APT_36c5a857fa.pdf

Malpedia library date Socialist Republic of Vietnam fromORKLCCS '25 data

The original link failed its last check. Original publisher Detailsfor CB_941_Canhbao_APT_36c5a857fa.pdf
27 June 2022

Attacks on industrial control systems using ShadowPad | Kaspersky ICS CERT EN

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attacks on industrial control systems using ShadowPad | Kaspersky ICS CERT EN
26 June 2022

Overview of Russian GRU and SVR Cyberespionage Campaigns 1H 2022

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Overview of Russian GRU and SVR Cyberespionage Campaigns 1H 2022
23 June 2022

BRONZE STARLIGHT Ransomware Operations Use HUI Loader

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor BRONZE STARLIGHT Ransomware Operations Use HUI Loader
23 June 2022

Matanbuchus Loader Resurfaces - Cyble

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Matanbuchus Loader Resurfaces - Cyble
21 June 2022

Avos ransomware group expands with new attack arsenal

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Avos ransomware group expands with new attack arsenal
17 June 2022

Malspam pushes Matanbuchus malware, leads to Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malspam pushes Matanbuchus malware, leads to Cobalt Strike
7 June 2022

Cyble - Bumblebee Loader On The Rise

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyble - Bumblebee Loader On The Rise
7 June 2022

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense
7 June 2022

Phishing Campaigns featuring Ursnif Trojan on the Rise

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Phishing Campaigns featuring Ursnif Trojan on the Rise
6 June 2022

Twisted Panda_ Chinese APT espionage operation against Russian’s state-owned defense institutes - Check Point Research

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Twisted Panda_ Chinese APT espionage operation against Russian’s state-owned defense institutes - Check Point Research
4 June 2022

[QuickNote] CobaltStrike SMB Beacon Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor [QuickNote] CobaltStrike SMB Beacon Analysis
3 June 2022

Attack Graph Response to US CERT AA22-152A: Karakurt Data Extortion Group

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attack Graph Response to US CERT AA22-152A: Karakurt Data Extortion Group
2 June 2022

Threat Actors Prey on Eager Travelers | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Actors Prey on Eager Travelers | FortiGuard Labs
2 June 2022

To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions | Mandiant
2 June 2022

Threat Actors Prey on Eager Travelers

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Threat Actors Prey on Eager Travelers
1 June 2022

AA22-152A_Karakurt_Data_Extortion_Group.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AA22-152A_Karakurt_Data_Extortion_Group.pdf
1 June 2022

Karakurt Data Extortion Group | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Karakurt Data Extortion Group | CISA
1 June 2022

CUBA Ransomware Campaign Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CUBA Ransomware Campaign Analysis
31 May 2022

THALES%20THREAT%20HANDBOOK%202022%20Light%20Version_1.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor THALES%20THREAT%20HANDBOOK%202022%20Light%20Version_1.pdf
26 May 2022

eset_threat_report_t12022

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor eset_threat_report_t12022
25 May 2022

SocGholish Campaigns and Initial Access Kit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SocGholish Campaigns and Initial Access Kit
24 May 2022

Emotet Botnet Rises Again | Bitsight

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet Botnet Rises Again | Bitsight
24 May 2022

Twisted Panda- Chinese APT Launch Spy Operation Against Russian Defence Institutes

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Twisted Panda- Chinese APT Launch Spy Operation Against Russian Defence Institutes
24 May 2022

Malware Analysis: Trickbot

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Analysis: Trickbot
23 May 2022

Operation Earth Berberoka: An Analysis of a Multivector and Multiplatform APT Campaign Targeting Online Gambling Sites

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Earth Berberoka: An Analysis of a Multivector and Multiplatform APT Campaign Targeting Online Gambling Sites
20 May 2022

Why Remediation Alone Is Not Enough When Infected by Malware - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Why Remediation Alone Is Not Enough When Infected by Malware - ASEC
20 May 2022

China-based APT Mustang Panda might still have continued their attack activities against organizations in

Malpedia library date VinCSS fromORKLCCS '25 data

Archived copy on ORKL Detailsfor China-based APT Mustang Panda might still have continued their attack activities against organizations in
20 May 2022

Malicious 'pymafka' Package Drops Cobalt Strike | Sonatype

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malicious 'pymafka' Package Drops Cobalt Strike | Sonatype
20 May 2022

Malware Targets InfoSec: Fake PoC Delivers Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Targets InfoSec: Fake PoC Delivers Cobalt Strike
19 May 2022

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog
19 May 2022

Twisted Panda: Chinese APT espionage operation against Russian state-owned defense institutes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Twisted Panda: Chinese APT espionage operation against Russian state-owned defense institutes
19 May 2022

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog
19 May 2022

Bumblebee Malware from TransferXL URLs - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bumblebee Malware from TransferXL URLs - SANS ISC
19 May 2022

Bumblebee Malware from TransferXL URLs - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bumblebee Malware from TransferXL URLs - SANS ISC
18 May 2022

WizardSpider

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor WizardSpider
17 May 2022

Space Pirates: analyzing the tools and connections of a new hacker group

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Space Pirates: analyzing the tools and connections of a new hacker group
17 May 2022

Ransomware Spotlight: RansomEXX

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware Spotlight: RansomEXX
16 May 2022

HUI Loaderの分析 - JPCERT/CC Eyes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor HUI Loaderの分析 - JPCERT/CC Eyes
12 May 2022

New SYK Crypter Distributed Via Discord

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New SYK Crypter Distributed Via Discord
12 May 2022

What malware to look for if you want to prevent a ransomware attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What malware to look for if you want to prevent a ransomware attack
12 May 2022

AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf
12 May 2022

Gootloader.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Gootloader.pdf
12 May 2022

The Goot cause: Detecting Gootloader and its follow-on activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Goot cause: Detecting Gootloader and its follow-on activity
11 May 2022

PowerPoint Presentation

Malpedia library date Hughes, Jennifer fromORKLCCS '25 data

Archived copy on ORKL Detailsfor PowerPoint Presentation
11 May 2022

Operation RestyLink: 日本企業を狙った標的型攻撃キャンペーン

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation RestyLink: 日本企業を狙った標的型攻撃キャンペーン
11 May 2022

TA578 using thread-hijacked emails to push ISO files for Bumblebee malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TA578 using thread-hijacked emails to push ISO files for Bumblebee malware
9 May 2022

Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself | Microsoft Security Blog
9 May 2022

Malware development: persistence - part 4. Windows services. Simple C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development: persistence - part 4. Windows services. Simple C++ example.
9 May 2022

Hiding in Plain Sight: Obscuring C2s by Abusing CDN Services

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hiding in Plain Sight: Obscuring C2s by Abusing CDN Services
9 May 2022

SEO Poisoning - A Gootloader Story

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor SEO Poisoning - A Gootloader Story
6 May 2022

Cobalt Strike Analysis and Tutorial: CS Metadata Encoding and Decoding

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Analysis and Tutorial: CS Metadata Encoding and Decoding
6 May 2022

This New Fileless Malware Hides Shellcode in Windows Event Logs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor This New Fileless Malware Hides Shellcode in Windows Event Logs
5 May 2022

Mustang Panda deploys a new wave of malware targeting Europe

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mustang Panda deploys a new wave of malware targeting Europe
4 May 2022

APT_trends_report_Q2_2022_Securelist

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT_trends_report_Q2_2022_Securelist
4 May 2022

A new secret stash for “fileless” malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A new secret stash for “fileless” malware
4 May 2022

Chinese Naikon Group Back with New Espionage Attack

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Chinese Naikon Group Back with New Espionage Attack
3 May 2022

SOLARDEFLECTION C2 Infrastructure Used by NOBELIUM in Company Brand Misuse

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SOLARDEFLECTION C2 Infrastructure Used by NOBELIUM in Company Brand Misuse
2 May 2022

ショートカットとISOファイルを悪用する攻撃キャンペーン | セキュリティ研究センターブログ

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ショートカットとISOファイルを悪用する攻撃キャンペーン | セキュリティ研究センターブログ
2 May 2022

Moshen Dragon’s Triad-and-Error Approach | Abusing Security Software to Sideload PlugX and ShadowPad

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Moshen Dragon’s Triad-and-Error Approach | Abusing Security Software to Sideload PlugX and ShadowPad
28 April 2022

Chinese APT Bronze President Mounts Spy Campaign on Russian Military

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese APT Bronze President Mounts Spy Campaign on Russian Military
28 April 2022

yir-cyber-threats-annex-download.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor yir-cyber-threats-annex-download.pdf
28 April 2022

Tracking APT29 Phishing Campaigns | Atlassian Trello

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tracking APT29 Phishing Campaigns | Atlassian Trello
27 April 2022

LockBit Ransomware Side-loads Cobalt Strike Beacon with Legitimate VMware Utility

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor LockBit Ransomware Side-loads Cobalt Strike Beacon with Legitimate VMware Utility
27 April 2022

20220427_NP_TLPWHITE_ANSSI_FIN7.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 20220427_NP_TLPWHITE_ANSSI_FIN7.pdf
27 April 2022

Botconf2022-40-LunghiHorejsi.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Botconf2022-40-LunghiHorejsi.pdf
27 April 2022

A lookback under the TA410 umbrella: Its cyberespionage TTPs and activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A lookback under the TA410 umbrella: Its cyberespionage TTPs and activity
27 April 2022

https://documents.trendmicro.com/assets/txt/earth-berberoka-windows-iocs-2.txt

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor https://documents.trendmicro.com/assets/txt/earth-berberoka-windows-iocs-2.txt
27 April 2022

APT trends report Q1 2022

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q1 2022
27 April 2022

A lookback under the TA410 umbrella- Its cyberespionage TTPs and activity

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor A lookback under the TA410 umbrella- Its cyberespionage TTPs and activity
27 April 2022

UNC2452 Merged into APT29 | Russia-Based Espionage Group

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UNC2452 Merged into APT29 | Russia-Based Espionage Group
27 April 2022

New APT Group Earth Berberoka Targets Gambling Websites With Old and New Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New APT Group Earth Berberoka Targets Gambling Websites With Old and New Malware
26 April 2022

How Cybercriminals Abuse Cloud Tunneling Services

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How Cybercriminals Abuse Cloud Tunneling Services
26 April 2022

Conti and Emotet: A constantly destructive duo

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti and Emotet: A constantly destructive duo
25 April 2022

New Core Impact Backdoor Delivered Via VMWare Vulnerability

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Core Impact Backdoor Delivered Via VMWare Vulnerability
25 April 2022

Quantum Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Quantum Ransomware
21 April 2022

Understanding Cobalt Strike Profiles - Updated for Cobalt Strike 4.6

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Understanding Cobalt Strike Profiles - Updated for Cobalt Strike 4.6
19 April 2022

Hive Ransomware Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hive Ransomware Analysis
18 April 2022

A blueprint for evading industry leading endpoint protection in 2022

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A blueprint for evading industry leading endpoint protection in 2022
18 April 2022

PYSA Ransomware: Technical Overview and Protection Strategies

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PYSA Ransomware: Technical Overview and Protection Strategies
18 April 2022

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense
15 April 2022

Blog |Top 10 Malware March 2022

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Blog |Top 10 Malware March 2022
14 April 2022

Orion Threat Alert: Flight of the BumbleBee

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Orion Threat Alert: Flight of the BumbleBee
14 April 2022

Hacking activity of SectorB Group in 2021 – Red Alert

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hacking activity of SectorB Group in 2021 – Red Alert
13 April 2022

Dismantling ZLoader: How malicious ads led to disabled security tools and ransomware | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dismantling ZLoader: How malicious ads led to disabled security tools and ransomware | Microsoft Security Blog
13 April 2022

ESET takes part in global operation to disrupt Zloader botnets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET takes part in global operation to disrupt Zloader botnets
12 April 2022

Ghidra script to handle stack strings – Max Kersten

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ghidra script to handle stack strings – Max Kersten
7 April 2022

You Bet Your Lsass: Hunting LSASS Access | Splunk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor You Bet Your Lsass: Hunting LSASS Access | Splunk
7 April 2022

Advanced Network Detection & Response - MetaDefender NDR - OPSWAT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Advanced Network Detection & Response - MetaDefender NDR - OPSWAT
6 April 2022

GitHub - infinitumitlabs/Karakurt-Hacking-Team-CTI: IOC Data Obtained From Karakurt Hacking Team's Internal Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GitHub - infinitumitlabs/Karakurt-Hacking-Team-CTI: IOC Data Obtained From Karakurt Hacking Team's Internal Infrastructure
5 April 2022

Chinese hackers abuse VLC Media Player to launch malware loader

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Chinese hackers abuse VLC Media Player to launch malware loader
5 April 2022

Cicada: Chinese APT Group Widens Targeting in Recent Espionage Activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cicada: Chinese APT Group Widens Targeting in Recent Espionage Activity
5 April 2022

Cicada- Chinese APT Group Widens Targeting in Recent Espionage Activity

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Cicada- Chinese APT Group Widens Targeting in Recent Espionage Activity
5 April 2022

Chinese hackers abuse VLC Media Player to launch malware loader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese hackers abuse VLC Media Player to launch malware loader
4 April 2022

FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7 | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7 | Mandiant
1 April 2022

Chinese Hackers Target VMware Horizon Servers with Log4Shell to Deploy Rootkit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese Hackers Target VMware Horizon Servers with Log4Shell to Deploy Rootkit
31 March 2022

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research
30 March 2022

Phishing campaign targets Russian govt dissidents with Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Phishing campaign targets Russian govt dissidents with Cobalt Strike
30 March 2022

New Milestones for Deep Panda: Log4Shell and Digitally Signed Fire Chili Rootkits

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Milestones for Deep Panda: Log4Shell and Digitally Signed Fire Chili Rootkits
29 March 2022

From the Front Lines | Hive Ransomware Deploys Novel IPfuscation Technique To Avoid Detection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From the Front Lines | Hive Ransomware Deploys Novel IPfuscation Technique To Avoid Detection
29 March 2022

New spear phishing campaign targets Russian dissidents

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New spear phishing campaign targets Russian dissidents
29 March 2022

Unmasking China’s State Hackers

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Unmasking China’s State Hackers
28 March 2022

CobaltStrike UUID stager

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CobaltStrike UUID stager
25 March 2022

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research
25 March 2022

Mustang Panda's Hodur : Vieux trucs, nouvelle variante de Korplug

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mustang Panda's Hodur : Vieux trucs, nouvelle variante de Korplug
25 March 2022

Dragos_Intel_WP_InitAccess-IndEnvirons-Final.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dragos_Intel_WP_InitAccess-IndEnvirons-Final.pdf
24 March 2022

Chinese APT Combines Fresh Hodur RAT with Complex Anti-Detection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese APT Combines Fresh Hodur RAT with Complex Anti-Detection
24 March 2022

Chinese Threat Actor Scarab Targeting Ukraine

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese Threat Actor Scarab Targeting Ukraine
24 March 2022

Another cyber espionage campaign in the Russia-Ukrainian ongoing cyber attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Another cyber espionage campaign in the Russia-Ukrainian ongoing cyber attacks
23 March 2022

New Mustang Panda hacking campaign targets diplomats, ISPs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Mustang Panda hacking campaign targets diplomats, ISPs
23 March 2022

Mustang Panda’s Hodur: Old tricks, new Korplug variant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mustang Panda’s Hodur: Old tricks, new Korplug variant
22 March 2022

Cobalt Strike: Overview – Part 7

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike: Overview – Part 7
22 March 2022

2022_ThreatDetectionReport_RedCanary.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2022_ThreatDetectionReport_RedCanary.pdf
22 March 2022

JSAC 2022 -Day 1- - JPCERT/CC Eyes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor JSAC 2022 -Day 1- - JPCERT/CC Eyes
21 March 2022

Conti Ransomware V. 3, Including Decryptor, Leaked

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti Ransomware V. 3, Including Decryptor, Leaked
21 March 2022

Conti Affiliate Exposed: New Domain Names, IP Addresses and Email Addresses Uncovered by eSentire

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti Affiliate Exposed: New Domain Names, IP Addresses and Email Addresses Uncovered by eSentire
17 March 2022

Exposing initial access broker with ties to Conti

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Exposing initial access broker with ties to Conti
16 March 2022

Cobalt Strike Analysis and Tutorial: How Malleable C2 Profiles Make Cobalt Strike Difficult to Detect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Analysis and Tutorial: How Malleable C2 Profiles Make Cobalt Strike Difficult to Detect
16 March 2022

Gh0stCringe RAT Being Distributed to Vulnerable Database Servers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Gh0stCringe RAT Being Distributed to Vulnerable Database Servers
16 March 2022

Qakbot infection with Cobalt Strike and VNC activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Qakbot infection with Cobalt Strike and VNC activity
16 March 2022

Qakbot infection with Cobalt Strike and VNC activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Qakbot infection with Cobalt Strike and VNC activity
15 March 2022

Threat Actor UAC-0056 Targeting Ukraine with Fake Translation Software

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Actor UAC-0056 Targeting Ukraine with Fake Translation Software
14 March 2022

Fake antivirus updates used to deploy Cobalt Strike in Ukraine

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Fake antivirus updates used to deploy Cobalt Strike in Ukraine
12 March 2022

Analyzing Malware with Hooks, Stomps, and Return-addresses

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing Malware with Hooks, Stomps, and Return-addresses
11 March 2022

CERT-UA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERT-UA
9 March 2022

CISA updates Conti ransomware alert with nearly 100 domain names

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CISA updates Conti ransomware alert with nearly 100 domain names
8 March 2022

APT41 Targeting U.S. State Government Networks | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT41 Targeting U.S. State Government Networks | Mandiant
7 March 2022

TA416: Activity, Techniques, & Targeting Explained | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TA416: Activity, Techniques, & Targeting Explained | Proofpoint US
7 March 2022

2021 Year In Review

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor 2021 Year In Review
5 March 2022

Malware now using NVIDIA's stolen code signing certificates

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware now using NVIDIA's stolen code signing certificates
4 March 2022

Legitimate Sites used as Cobalt Strike C2s against Indian Government

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Legitimate Sites used as Cobalt Strike C2s against Indian Government
3 March 2022

Cyberattacks are Prominent in the Russia-Ukraine Conflict

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyberattacks are Prominent in the Russia-Ukraine Conflict
1 March 2022

2021trends.pdf

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor 2021trends.pdf
24 February 2022

Nobelium Returns to the Political World Stage | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Nobelium Returns to the Political World Stage | FortiGuard Labs
24 February 2022

New Wave of Emotet - When Project X Turns Into Y

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Wave of Emotet - When Project X Turns Into Y
23 February 2022

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense
23 February 2022

What the Pack(er)? | cyber.wtf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What the Pack(er)? | cyber.wtf
23 February 2022

rt-apt41-dual-operation.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor rt-apt41-dual-operation.pdf
22 February 2022

China Implicated in Prolonged Supply Chain Attack Targeting Taiwan Financial Sector

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China Implicated in Prolonged Supply Chain Attack Targeting Taiwan Financial Sector
22 February 2022

Vulnerable Microsoft SQL Servers targeted with Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Vulnerable Microsoft SQL Servers targeted with Cobalt Strike
22 February 2022

IcedID to Cobalt Strike In Under 20 Minutes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor IcedID to Cobalt Strike In Under 20 Minutes
22 February 2022

China Implicated in Prolonged Supply Chain Attack Targeting Taiwan Financial Sector

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor China Implicated in Prolonged Supply Chain Attack Targeting Taiwan Financial Sector
21 February 2022

Cobalt Strike Being Distributed to Unsecured MS-SQL Servers - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Being Distributed to Unsecured MS-SQL Servers - ASEC
21 February 2022

Chinese hackers linked to months-long attack on Taiwanese financial sector

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese hackers linked to months-long attack on Taiwanese financial sector
21 February 2022

Qbot and Zerologon Lead To Full Domain Compromise

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Qbot and Zerologon Lead To Full Domain Compromise
21 February 2022

Chinese hackers linked to months-long attack on Taiwanese financial sector

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Chinese hackers linked to months-long attack on Taiwanese financial sector
21 February 2022

深度剖析針對臺灣金融業的 Operation Cache Panda 組織型供應鏈攻擊

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 深度剖析針對臺灣金融業的 Operation Cache Panda 組織型供應鏈攻擊
20 February 2022

Detecting Cobalt Strike Beacons

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detecting Cobalt Strike Beacons
18 February 2022

Hackers No Hashing | Huntress

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hackers No Hashing | Huntress
17 February 2022

Adam Kozy Testimony

Malpedia library date Adam Kozy fromORKL

Archived copy on ORKL Detailsfor Adam Kozy Testimony
16 February 2022

Quick Malware Analysis: Emotet Epoch 5 and Cobalt Strike pcap from 2022-02-08

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Quick Malware Analysis: Emotet Epoch 5 and Cobalt Strike pcap from 2022-02-08
15 February 2022

Increase in Emotet Activity and Cobalt Strike Deployment

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Increase in Emotet Activity and Cobalt Strike Deployment
11 February 2022

Threat Roundup for February 4 to February 11

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Roundup for February 4 to February 11
10 February 2022

THREAT ANALYSIS: Cobalt Strike - IcedID, Emotet and QBot

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor THREAT ANALYSIS: Cobalt Strike - IcedID, Emotet and QBot
9 February 2022

VMware Exposing Malware In Linux Based Multi Cloud Environments

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor VMware Exposing Malware In Linux Based Multi Cloud Environments
8 February 2022

Distribution of Kimsuky Group’s xRAT (Quasar RAT) Confirmed

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Distribution of Kimsuky Group’s xRAT (Quasar RAT) Confirmed
8 February 2022

PrivateLoader: The first step in many malware schemes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PrivateLoader: The first step in many malware schemes
3 February 2022

Antlion: Chinese APT Uses Custom Backdoor to Target Financial Institutions in Taiwan

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Antlion: Chinese APT Uses Custom Backdoor to Target Financial Institutions in Taiwan
31 January 2022

Analyzing Malware with Hooks, Stomps and Return-addresses

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing Malware with Hooks, Stomps and Return-addresses
28 January 2022

Log4j Exploit Hits Again: Vulnerable Unifi Network Application (Ubiquiti) at Risk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Log4j Exploit Hits Again: Vulnerable Unifi Network Application (Ubiquiti) at Risk
27 January 2022

What We Can Do against the Chaotic A41APT Campaign（公開版）

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What We Can Do against the Chaotic A41APT Campaign（公開版）
26 January 2022

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog
25 January 2022

Threats Looming Over the Horizon

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threats Looming Over the Horizon
24 January 2022

Cobalt Strike, a Defender’s Guide - Part 2

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Cobalt Strike, a Defender’s Guide - Part 2
20 January 2022

Log4j Exploit Hits Again: Vulnerable VMWare Horizon Servers at Risk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Log4j Exploit Hits Again: Vulnerable VMWare Horizon Servers at Risk
19 January 2022

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog
18 January 2022

2021 Adversary Infrastructure Report

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2021 Adversary Infrastructure Report
16 January 2022

Analyzing a CACTUSTORCH HTA Leading to Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing a CACTUSTORCH HTA Leading to Cobalt Strike
15 January 2022

VMware Horizon Servers Actively Being Hit With Cobalt Strike | Huntress

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor VMware Horizon Servers Actively Being Hit With Cobalt Strike | Huntress
11 January 2022

Threat Analysis Report: DatopLoader Exploits ProxyShell to Deliver QBOT and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Analysis Report: DatopLoader Exploits ProxyShell to Deliver QBOT and Cobalt Strike
11 January 2022

Signed DLL campaigns as a service

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Signed DLL campaigns as a service
9 January 2022

Inspecting a PowerShell Cobalt Strike Beacon

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Inspecting a PowerShell Cobalt Strike Beacon
8 January 2022

Trojanized dnSpy app drops malware cocktail on researchers, devs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trojanized dnSpy app drops malware cocktail on researchers, devs
6 January 2022

A “GULP” of PlugX

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A “GULP” of PlugX
6 January 2022

NOBELIUM’s EnvyScout infection chain goes in the registry, targeting embassies

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor NOBELIUM’s EnvyScout infection chain goes in the registry, targeting embassies
29 December 2021

AQUATIC PANDA in Possession of Log4Shell Exploit Tools | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AQUATIC PANDA in Possession of Log4Shell Exploit Tools | CrowdStrike
16 December 2021

Winnti is Coming - Evolution after Prosecution@HITCON2021

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Winnti is Coming - Evolution after Prosecution@HITCON2021
16 December 2021

Intelligence Insights: December 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Intelligence Insights: December 2021
14 December 2021

Espionage Campaign Targets Telecoms Organizations across Middle East and Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Espionage Campaign Targets Telecoms Organizations across Middle East and Asia
14 December 2021

Tropic Trooper Targets Transportation and Government Organizations

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tropic Trooper Targets Transportation and Government Organizations
10 December 2021

What We Think | Business & Technology Insights

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What We Think | Business & Technology Insights
7 December 2021

Emotet now drops Cobalt Strike, fast forwards ransomware attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet now drops Cobalt Strike, fast forwards ransomware attacks
6 December 2021

Nickel

Malpedia library date Notice of Pleadings fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Nickel
6 December 2021

NICKEL targeting government organizations across Latin America and Europe | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor NICKEL targeting government organizations across Latin America and Europe | Microsoft Security Blog
6 December 2021

Suspected Russian Activity Targeting Government and Business Entities Around the Globe | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Suspected Russian Activity Targeting Government and Business Entities Around the Globe | Mandiant
2 December 2021

CERTFR-2021-CTI-011.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERTFR-2021-CTI-011.pdf
30 November 2021

Yanluowang: Further Insights on New Ransomware Threat

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Yanluowang: Further Insights on New Ransomware Threat
29 November 2021

CONTInuing the Bazar Ransomware Story

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor CONTInuing the Bazar Ransomware Story
29 November 2021

Kitten.gif: Meet the Sabbath Ransomware Affiliate Program, Again

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Kitten.gif: Meet the Sabbath Ransomware Affiliate Program, Again
19 November 2021

Squirrelwaffle Exploits ProxyShell and ProxyLogon to Hijack Email Chains

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Squirrelwaffle Exploits ProxyShell and ProxyLogon to Hijack Email Chains
18 November 2021

Threat Spotlight: BlackMatter, LockBit, and THOR - Cisco Umbrella

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Spotlight: BlackMatter, LockBit, and THOR - Cisco Umbrella
18 November 2021

Iranian targeting of IT sector on the rise | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Iranian targeting of IT sector on the rise | Microsoft Security Blog
17 November 2021

DNS Over HTTPS for Cobalt Strike - Black Hills Information Security, Inc.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DNS Over HTTPS for Cobalt Strike - Black Hills Information Security, Inc.
17 November 2021

Cobalt Strike: Decrypting Obfuscated Traffic – Part 4

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike: Decrypting Obfuscated Traffic – Part 4
17 November 2021

Analyzing ProxyShell-related Incidents via Trend Micro Managed XDR

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing ProxyShell-related Incidents via Trend Micro Managed XDR
16 November 2021

Attackers use domain fronting technique to target Myanmar with Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attackers use domain fronting technique to target Myanmar with Cobalt Strike
15 November 2021

ProxyShell, QBot, and Conti ransomware combined in a series of cyber attacks - Truesec

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ProxyShell, QBot, and Conti ransomware combined in a series of cyber attacks - Truesec
13 November 2021

Threat Spotlight - Domain Fronting

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Spotlight - Domain Fronting
12 November 2021

A multi-stage PowerShell based attack targets Kazakhstan

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A multi-stage PowerShell based attack targets Kazakhstan
11 November 2021

Quakbot Strikes with QuakNightmare Exploitation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Quakbot Strikes with QuakNightmare Exploitation
10 November 2021

Walking on APT31 infrastructure footprints

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Walking on APT31 infrastructure footprints
9 November 2021

THREAT ANALYSIS REPORT: From Shathak Emails to the Conti Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor THREAT ANALYSIS REPORT: From Shathak Emails to the Conti Ransomware
5 November 2021

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog
3 November 2021

Cobalt Strike: Using Process Memory To Decrypt Traffic – Part 3

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike: Using Process Memory To Decrypt Traffic – Part 3
2 November 2021

Detecting CONTI CobaltStrike Lateral Movement Techniques - Part 2 | Cyb3rSn0rlax

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Detecting CONTI CobaltStrike Lateral Movement Techniques - Part 2 | Cyb3rSn0rlax
2 November 2021

Cybercrime underground flush with shipping companies’ credentials

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cybercrime underground flush with shipping companies’ credentials
1 November 2021

Accenture | Security Solutions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Accenture | Security Solutions
1 November 2021

From Zero to Domain Admin

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor From Zero to Domain Admin
29 October 2021

12 targeted for involvement in ransomware attacks against critical infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 12 targeted for involvement in ransomware attacks against critical infrastructure
29 October 2021

Національна поліція України

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Національна поліція України
27 October 2021

Cobalt Strike: Using Known Private Keys To Decrypt Traffic – Part 2

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike: Using Known Private Keys To Decrypt Traffic – Part 2
26 October 2021

Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf

Malpedia library date Kaspersky fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf
26 October 2021

SQUIRRELWAFFLE Leverages malspam to deliver Qakbot, Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SQUIRRELWAFFLE Leverages malspam to deliver Qakbot, Cobalt Strike
26 October 2021

EP 103- Cloud Hopper

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor EP 103- Cloud Hopper
26 October 2021

Detecting CONTI CobaltStrike Lateral Movement Techniques - Part 1 | Cyb3rSn0rlax

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Detecting CONTI CobaltStrike Lateral Movement Techniques - Part 1 | Cyb3rSn0rlax
25 October 2021

OverWatch Elite's Call Escalation Vital to Containing Attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OverWatch Elite's Call Escalation Vital to Containing Attack
21 October 2021

Stopping GRACEFUL SPIDER: Falcon Complete’s Fast Response to Recent SolarWinds Serv-U Exploit Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Stopping GRACEFUL SPIDER: Falcon Complete’s Fast Response to Recent SolarWinds Serv-U Exploit Campaign
21 October 2021

Cobalt Strike: Using Known Private Keys To Decrypt Traffic – Part 1

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike: Using Known Private Keys To Decrypt Traffic – Part 1
19 October 2021

Malicious campaign uses a barrage of commodity RATs to target Afghanistan and India

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malicious campaign uses a barrage of commodity RATs to target Afghanistan and India
18 October 2021

Harvester: Nation-State-Backed Group Uses New Toolset to Target Victims in South Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Harvester: Nation-State-Backed Group Uses New Toolset to Target Victims in South Asia
18 October 2021

Case Study: From BazarLoader to Network Reconnaissance

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Case Study: From BazarLoader to Network Reconnaissance
18 October 2021

IcedID to XingLocker Ransomware in 24 hours

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor IcedID to XingLocker Ransomware in 24 hours
18 October 2021

Microsoft Word - exorcist whitepaper.docx

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Word - exorcist whitepaper.docx
15 October 2021

Memory Forensics R&D Illustrated: Detecting Mimikatz's Skeleton Key Attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Memory Forensics R&D Illustrated: Detecting Mimikatz's Skeleton Key Attack
14 October 2021

Investigation into the state of NIM malware Part 2

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Investigation into the state of NIM malware Part 2
13 October 2021

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog
12 October 2021

Cobalt Strike | Defining Cobalt Strike Components & BEACON

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike | Defining Cobalt Strike Components & BEACON
11 October 2021

Secure AI Build Resilience & Accelerate Value with Accenture

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure AI Build Resilience & Accelerate Value with Accenture
8 October 2021

SQUIRRELWAFFLE – Analysing The Main Loader | 0ffset

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SQUIRRELWAFFLE – Analysing The Main Loader | 0ffset
7 October 2021

SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot
6 October 2021

sneak-peek-ch1-2-finding-beacons-in-the-dark.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor sneak-peek-ch1-2-finding-beacons-in-the-dark.pdf
5 October 2021

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog
4 October 2021

BazarLoader and the Conti Leaks

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor BazarLoader and the Conti Leaks
4 October 2021

Malware Gh0stTimes Used by BlackTech - JPCERT/CC Eyes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Gh0stTimes Used by BlackTech - JPCERT/CC Eyes
3 October 2021

PowerPoint-Präsentation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PowerPoint-Präsentation
1 October 2021

SQUIRRELWAFFLE – Analysing the Custom Packer | 0ffset

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SQUIRRELWAFFLE – Analysing the Custom Packer | 0ffset
30 September 2021

Masters of Mimicry: new APT group ChamelGang and its arsenal

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Masters of Mimicry: new APT group ChamelGang and its arsenal
30 September 2021

How CrowdStrike Threat Hunters Identified a Confluence Exploit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How CrowdStrike Threat Hunters Identified a Confluence Exploit
30 September 2021

Masters of Mimicry: new APT group ChamelGang and its arsenal

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Masters of Mimicry: new APT group ChamelGang and its arsenal
29 September 2021

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense
28 September 2021

The Squirrelwaffle: New Loader Delivers Cobalt Strikes |Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Squirrelwaffle: New Loader Delivers Cobalt Strikes |Blog
28 September 2021

4 Chinese APT Groups Identified Targeting Mail Server of Afghan Telecommunications Firm Roshan

date in the CCS '25 data Recorded Future fromCCS '25 data

The original link failed its last check. Detailsfor 4 Chinese APT Groups Identified Targeting Mail Server of Afghan Telecommunications Firm Roshan
27 September 2021

A Virtual Baffle to Battle SquirrelWaffle

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Virtual Baffle to Battle SquirrelWaffle
26 September 2021

Insights into Ransomware Spread Using Exchange 1-Day Vulnerabilities 1-2 - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Insights into Ransomware Spread Using Exchange 1-Day Vulnerabilities 1-2 - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.
24 September 2021

Examining the Cring Ransomware Techniques

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Examining the Cring Ransomware Techniques
21 September 2021

Ransomware Hackers Attack a Top Safety Testing Org. Using Tactics and Techniques Borrowed from Chinese Espionage Groups

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware Hackers Attack a Top Safety Testing Org. Using Tactics and Techniques Borrowed from Chinese Espionage Groups
21 September 2021

The Squirrel Strikes Back: Analysis of the newly emerged cobalt-strike loader “SquirrelWaffle”

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Squirrel Strikes Back: Analysis of the newly emerged cobalt-strike loader “SquirrelWaffle”
21 September 2021

A Ransomware Near Miss: ProxyShell, a RAT, and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Ransomware Near Miss: ProxyShell, a RAT, and Cobalt Strike
21 September 2021

Scanning VirusTotal's firehose | Sky Blueteam

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Scanning VirusTotal's firehose | Sky Blueteam
20 September 2021

Water Basilisk Uses New HCrypt Variant to Flood Victims with RAT Payloads

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Water Basilisk Uses New HCrypt Variant to Flood Victims with RAT Payloads
17 September 2021

4 Popular Defensive Evasion Techniques in 2021 | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 4 Popular Defensive Evasion Techniques in 2021 | CrowdStrike
17 September 2021

The default: 63 6f 62 61 6c 74 strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The default: 63 6f 62 61 6c 74 strike
16 September 2021

Pointer: Hunting Cobalt Strike globally

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Pointer: Hunting Cobalt Strike globally
15 September 2021

Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability | Microsoft Security Blog
14 September 2021

Full-Spectrum Cobalt Strike Detection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Full-Spectrum Cobalt Strike Detection
13 September 2021

BazarLoader to Conti Ransomware in 32 Hours

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor BazarLoader to Conti Ransomware in 32 Hours
10 September 2021

Rendering Threats: A Network Perspective

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rendering Threats: A Network Perspective
10 September 2021

Indonesian intelligence agency compromised in suspected Chinese hack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Indonesian intelligence agency compromised in suspected Chinese hack
9 September 2021

Remote Code Execution Zero-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Remote Code Execution Zero-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs
9 September 2021

Grayfly: Chinese Threat Actor Uses Newly-discovered Sidewalk Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Grayfly: Chinese Threat Actor Uses Newly-discovered Sidewalk Malware
8 September 2021

Hook Heaps and Live Free

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hook Heaps and Live Free
6 September 2021

Quick analysis CobaltStrike loader and shellcode

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Quick analysis CobaltStrike loader and shellcode
3 September 2021

The State of SSL/TLS Certificate Usage in Malware C&C Communications

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The State of SSL/TLS Certificate Usage in Malware C&C Communications
2 September 2021

Advanced Persistent Threats (APTs)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Advanced Persistent Threats (APTs)
31 August 2021

Cobalt Strike and Ransomware – Tracking An Effective Ransomware Campaign - BreakPoint Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike and Ransomware – Tracking An Effective Ransomware Campaign - BreakPoint Labs
30 August 2021

奇安信威胁情报中心

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 奇安信威胁情报中心
29 August 2021

Cobalt Strike, a Defender's Guide

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Cobalt Strike, a Defender's Guide
27 August 2021

Blog Archive

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Blog Archive
27 August 2021

https://www.aon.com/cyber-solutions/aon_cyber_labs/cobalt-strike-configuration-extractor-and-parser/

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor https://www.aon.com/cyber-solutions/aon_cyber_labs/cobalt-strike-configuration-extractor-and-parser/
24 August 2021

The SideWalk may be as dangerous as the CROSSWALK

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The SideWalk may be as dangerous as the CROSSWALK
24 August 2021

Earth Baku Returns: Uncovering the Upgraded Toolset Behind the APT Group’s New Cyberespionage Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Baku Returns: Uncovering the Upgraded Toolset Behind the APT Group’s New Cyberespionage Campaign
23 August 2021

D1T1%20-%20%20ShadowPad%20-%20A%20Masterpiece%20of%20Privately%20Sold%20Malware%20in%20Chinese%20Espionage%20-%20Yi-Jhen%20Hsieh%20&%20Joey%20Chen.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor D1T1%20-%20%20ShadowPad%20-%20A%20Masterpiece%20of%20Privately%20Sold%20Malware%20in%20Chinese%20Espionage%20-%20Yi-Jhen%20Hsieh%20&%20Joey%20Chen.pdf
23 August 2021

210823.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 210823.pdf
19 August 2021

An insider insights into Conti operations – Part Two

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor An insider insights into Conti operations – Part Two
19 August 2021

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog
18 August 2021

How to Detect Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How to Detect Cobalt Strike
17 August 2021

An insider insights into Conti operations – Part One

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor An insider insights into Conti operations – Part One
15 August 2021

The Ransomware Threat (White Paper)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Ransomware Threat (White Paper)
10 August 2021

UNC215: Spotlight on a Chinese Espionage Campaign in Israel | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UNC215: Spotlight on a Chinese Espionage Campaign in Israel | Mandiant
9 August 2021

APT Cobalt Strike Campaign targeting Slovakia (DEF CON talk)

Malpedia library date IstroSec fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT Cobalt Strike Campaign targeting Slovakia (DEF CON talk)
5 August 2021

Red Canary Intel: When Dridex and Cobalt Strike give you Grief

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Red Canary Intel: When Dridex and Cobalt Strike give you Grief
5 August 2021

Detecting Cobalt Strike Government-Sponsored Threat Groups (APT32)

date in the CCS '25 data SecureWorks fromCCS '25 data

Detailsfor Detecting Cobalt Strike Government-Sponsored Threat Groups (APT32)
4 August 2021

How PROPHET SPIDER Exploits Oracle WebLogic | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How PROPHET SPIDER Exploits Oracle WebLogic | CrowdStrike
4 August 2021

Hotcobalt - New Cobalt Strike DoS Vulnerability That Lets You Halt Operations - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hotcobalt - New Cobalt Strike DoS Vulnerability That Lets You Halt Operations - SentinelLabs
3 August 2021

DeadRinger: Exposing Chinese Threat Actors Targeting Major Telcos

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DeadRinger: Exposing Chinese Threat Actors Targeting Major Telcos
1 August 2021

BazarCall to Conti Ransomware via Trickbot and Cobalt Strike

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor BazarCall to Conti Ransomware via Trickbot and Cobalt Strike
29 July 2021

BazaCall: Phony call centers lead to exfiltration and ransomware | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BazaCall: Phony call centers lead to exfiltration and ransomware | Microsoft Security Blog
27 July 2021

THOR: Previously Unseen PlugX Variant Deployed During Microsoft Exchange Server Attacks by PKPLUG Group

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor THOR: Previously Unseen PlugX Variant Deployed During Microsoft Exchange Server Attacks by PKPLUG Group
27 July 2021

report-old-dogs-new-tricks.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor report-old-dogs-new-tricks.pdf
25 July 2021

Guide to Named Pipes and Hunting for Cobalt Strike Pipes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Guide to Named Pipes and Hunting for Cobalt Strike Pipes
22 July 2021

Cobalt Strike Hunting — simple PCAP and Beacon Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Hunting — simple PCAP and Beacon Analysis
21 July 2021

LuminousMoth – PlugX, File Exfiltration and Persistence Revisited

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor LuminousMoth – PlugX, File Exfiltration and Persistence Revisited
19 July 2021

IcedID and Cobalt Strike vs Antivirus

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor IcedID and Cobalt Strike vs Antivirus
15 July 2021

Threats to the 2020 Tokyo Olympic Games

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threats to the 2020 Tokyo Olympic Games
14 July 2021

LuminousMoth APT: Sweeping attacks for the chosen few

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor LuminousMoth APT: Sweeping attacks for the chosen few
14 July 2021

Investigating a Suspicious Service - MDSec

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Investigating a Suspicious Service - MDSec
14 July 2021

How we protect users from 0-day attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How we protect users from 0-day attacks
13 July 2021

Attacks Against the Government Sector (White Paper)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attacks Against the Government Sector (White Paper)
12 July 2021

Automation to Combat Evolving Obfuscation – Cipher Tech Solutions, Inc.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Automation to Combat Evolving Obfuscation – Cipher Tech Solutions, Inc.
9 July 2021

Hancitor tries XLL as initial malware file - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hancitor tries XLL as initial malware file - SANS ISC
8 July 2021

Decoding Cobalt Strike: Understanding payloads

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Decoding Cobalt Strike: Understanding payloads
7 July 2021

https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/diving-deeper-into-the-kaseya-vsa-attack-revil-returns-and-other-hackers-are-riding-their-coattails/

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/diving-deeper-into-the-kaseya-vsa-attack-revil-returns-and-other-hackers-are-riding-their-coattails/
7 July 2021

BIOPASS RAT New Malware Sniffs Victims via Live Streaming

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BIOPASS RAT New Malware Sniffs Victims via Live Streaming
7 July 2021

Ryuk Ransomware Now Targeting Webservers

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Ryuk Ransomware Now Targeting Webservers
5 July 2021

Tracking Cobalt Strike: A Trend Micro Vision One Investigation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tracking Cobalt Strike: A Trend Micro Vision One Investigation
2 July 2021

Dridex Document to Cobalt Strike – Malware Book Reports

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dridex Document to Cobalt Strike – Malware Book Reports
1 July 2021

Backdoored client from Mongolian CA MonPass

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Backdoored client from Mongolian CA MonPass
1 July 2021

Mongolian certificate authority hacked eight times, compromised with malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mongolian certificate authority hacked eight times, compromised with malware
29 June 2021

Cobalt Strike: Favorite APT Tool to Crimeware | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike: Favorite APT Tool to Crimeware | Proofpoint US
29 June 2021

What We Think | Business & Technology Insights

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What We Think | Business & Technology Insights
28 June 2021

Hancitor Continues to Push Cobalt Strike

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Hancitor Continues to Push Cobalt Strike
22 June 2021

Response When Minutes Matter: Falcon Complete Disrupts WIZARD SPIDER eCrime Operators

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Response When Minutes Matter: Falcon Complete Disrupts WIZARD SPIDER eCrime Operators
20 June 2021

From Word to Lateral Movement in 1 Hour

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor From Word to Lateral Movement in 1 Hour
17 June 2021

Analysis of Hancitor – When Boring Begets Beacon

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis of Hancitor – When Boring Begets Beacon
16 June 2021

Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise
16 June 2021

Threat Activity Group RedFoxtrot Linked to China’s PLA Unit 69010; Targets Bordering Asian Countries

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Activity Group RedFoxtrot Linked to China’s PLA Unit 69010; Targets Bordering Asian Countries
16 June 2021

Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise
16 June 2021

Національна поліція України

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Національна поліція України
16 June 2021

Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise
4 June 2021

Fresh Phish: Colonial Pipeline Ransomware Hack Unleashes Flood of Related Phishing Attempts

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Fresh Phish: Colonial Pipeline Ransomware Hack Unleashes Flood of Related Phishing Attempts
2 June 2021

China-Linked Threat Group Targets Taiwan Critical Infrastructure, Smokescreen Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-Linked Threat Group Targets Taiwan Critical Infrastructure, Smokescreen Ransomware
2 June 2021

RedDelta PlugX Undergoing Changes and Overlapping Again with Mustang Panda PlugX Infrastructure

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedDelta PlugX Undergoing Changes and Overlapping Again with Mustang Panda PlugX Infrastructure
1 June 2021

New sophisticated email-based attack from NOBELIUM | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New sophisticated email-based attack from NOBELIUM | Microsoft Security Blog
1 June 2021

Looks like the page you're looking for doesn't exist or has moved.

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Looks like the page you're looking for doesn't exist or has moved.
1 June 2021

NobleBaron | New Poisoned Installers Could Be Used In Supply Chain Attacks - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor NobleBaron | New Poisoned Installers Could Be Used In Supply Chain Attacks - SentinelLabs
1 June 2021

Justice Department Announces Court-Authorized Seizure of Domain Names Used in Furtherance of Spear-Phishing Campaign Posing as U.S. Agency for International Development

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Justice Department Announces Court-Authorized Seizure of Domain Names Used in Furtherance of Spear-Phishing Campaign Posing as U.S. Agency for International Development
28 May 2021

Sophisticated Spearphishing Campaign Targets Government Organizations, IGOs, and NGOs | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sophisticated Spearphishing Campaign Targets Government Organizations, IGOs, and NGOs | CISA
28 May 2021

MAR 10339794-1.v1 – Cobalt Strike Beacon | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MAR 10339794-1.v1 – Cobalt Strike Beacon | CISA
28 May 2021

Breaking down NOBELIUM’s latest early-stage toolset | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Breaking down NOBELIUM’s latest early-stage toolset | Microsoft Security Blog
27 May 2021

Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns

Malpedia library date Volexity fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns
26 May 2021

A Deep Dive into Packing Software CryptOne

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Deep Dive into Packing Software CryptOne
25 May 2021

mtrends-2018.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor mtrends-2018.pdf
25 May 2021

Cobalt Strikes Again: An Analysis of Obfuscated Malware | Huntress

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strikes Again: An Analysis of Obfuscated Malware | Huntress
21 May 2021

Microsoft社のデジタル署名を悪用した「Cobalt Strike loader」による標的型攻撃〜攻撃者グループAPT41 | LAC WATCH

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft社のデジタル署名を悪用した「Cobalt Strike loader」による標的型攻撃〜攻撃者グループAPT41 | LAC WATCH
21 May 2021

Leveraging Microsoft Teams to cover up Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Leveraging Microsoft Teams to cover up Cobalt Strike
19 May 2021

Enterprise Scale Threat Hunting: C2 Beacon Detection with Unsupervised ML and KQL — Part 2

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Enterprise Scale Threat Hunting: C2 Beacon Detection with Unsupervised ML and KQL — Part 2
19 May 2021

Look how many cybercriminals love Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Look how many cybercriminals love Cobalt Strike
17 May 2021

Case Study: Incident Response is a relationship-driven business

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Case Study: Incident Response is a relationship-driven business
17 May 2021

Mustang Panda PlugX - 45.251.240.55 Pivot

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Mustang Panda PlugX - 45.251.240.55 Pivot
16 May 2021

HSE Conti 40521 UPDATE

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor HSE Conti 40521 UPDATE
14 May 2021

From ZLoader to DarkSide: A Ransomware Story

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From ZLoader to DarkSide: A Ransomware Story
13 May 2021

Threat Thursday- SombRAT — Always Leave Yourself a Backdoor

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Threat Thursday- SombRAT — Always Leave Yourself a Backdoor
12 May 2021

Enterprise Scale Threat Hunting: C2 Beacon Detection with Unsupervised ML and KQL — Part 1

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Enterprise Scale Threat Hunting: C2 Beacon Detection with Unsupervised ML and KQL — Part 1
12 May 2021

Conti Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Conti Ransomware
11 May 2021

Campo, a New Attack Campaign Targeting Japan - Mal-Eats

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Campo, a New Attack Campaign Targeting Japan - Mal-Eats
11 May 2021

Shining a Light on DARKSIDE Ransomware Operations

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Shining a Light on DARKSIDE Ransomware Operations
10 May 2021

日本を狙う新たな攻撃キャンペーン Campo の全体像 - Mal-Eats

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 日本を狙う新たな攻撃キャンペーン Campo の全体像 - Mal-Eats
7 May 2021

Stats from Hunting Cobalt Strike Beacons

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Stats from Hunting Cobalt Strike Beacons
7 May 2021

PowerPoint 簡報

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PowerPoint 簡報
7 May 2021

Lemon Duck spreads its wings: Actors target Microsoft Exchange servers, incorporate new TTPs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lemon Duck spreads its wings: Actors target Microsoft Exchange servers, incorporate new TTPs
6 May 2021

CTIR_casestudy_2.pdf

file creation date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor CTIR_casestudy_2.pdf
6 May 2021

Proxylogon: A Coinminer, a Ransomware, and a Botnet Join the Party

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Proxylogon: A Coinminer, a Ransomware, and a Botnet Join the Party
6 May 2021

CTIR_casestudy_1.pdf

file creation date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor CTIR_casestudy_1.pdf
5 May 2021

Notorious Cybercriminals Evil Corp Actually Russian Spies? - Trulysuper

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Notorious Cybercriminals Evil Corp Actually Russian Spies? - Trulysuper
5 May 2021

Analysis of top non-HTTP/S threats | Zscaler Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis of top non-HTTP/S threats | Zscaler Blog
4 May 2021

Improving network-based detection of in-the-wild Cobalt Strike C2 servers while reducing the risk…

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Improving network-based detection of in-the-wild Cobalt Strike C2 servers while reducing the risk…
2 May 2021

Trickbot Brief: Creds and Beacons

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Trickbot Brief: Creds and Beacons
29 April 2021

the-operations-of-winnti-group.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor the-operations-of-winnti-group.pdf
29 April 2021

UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat | Mandiant
28 April 2021

Water Pamola Attacked Online Shops Via Malicious Orders

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Water Pamola Attacked Online Shops Via Malicious Orders
28 April 2021

Microsoft Word - Appendix_Water-Pamola-Attacked-Online-Shops.docx

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Word - Appendix_Water-Pamola-Attacked-Online-Shops.docx
27 April 2021

APT trends report Q1 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q1 2021
27 April 2021

Locked, Loaded, and in the Wrong Hands: Legitimate Tools Weaponized for Ransomware in 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Locked, Loaded, and in the Wrong Hands: Legitimate Tools Weaponized for Ransomware in 2021
27 April 2021

Hello Ransomware Uses Updated China Chopper Web Shell, SharePoint Vulnerability

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hello Ransomware Uses Updated China Chopper Web Shell, SharePoint Vulnerability
26 April 2021

New ICS Threat Activity Group- TALONITE

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New ICS Threat Activity Group- TALONITE
26 April 2021

Anatomy of Cobalt Strike’s DLL Stager

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Anatomy of Cobalt Strike’s DLL Stager
26 April 2021

New ICS Threat Activity Group: TALONITE

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New ICS Threat Activity Group: TALONITE
20 April 2021

CobaltStrike Stager Utilizing Floating Point Math

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CobaltStrike Stager Utilizing Floating Point Math
19 April 2021

Analysing a malware PCAP with IcedID and Cobalt Strike traffic

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysing a malware PCAP with IcedID and Cobalt Strike traffic
14 April 2021

April 2021 Forensic Quiz: Answers and Analysis - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor April 2021 Forensic Quiz: Answers and Analysis - SANS ISC
14 April 2021

HydroJiin Malware Campaign | ThreatLabZ | Zscaler Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor HydroJiin Malware Campaign | ThreatLabZ | Zscaler Blog
12 April 2021

A Different Kind of Zoombomb

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Different Kind of Zoombomb
7 April 2021

Using Kaitai Struct to Parse Cobalt Strike Beacon Configs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Using Kaitai Struct to Parse Cobalt Strike Beacon Configs
5 April 2021

TrickBot Crews New CobaltStrike Loader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot Crews New CobaltStrike Loader
2 April 2021

Study of targeted attacks on Russian research institutes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Study of targeted attacks on Russian research institutes
1 April 2021

Hancitor’s Use of Cobalt Strike and a Noisy Network Ping Tool

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hancitor’s Use of Cobalt Strike and a Noisy Network Ping Tool
1 April 2021

APT10_ sophisticated multi-layered loader Ecipekac discovered in A41APT campaign _ Securelist

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT10_ sophisticated multi-layered loader Ecipekac discovered in A41APT campaign _ Securelist
1 April 2021

COVID-19 Phishing With a Side of Cobalt Strike - DomainTools | Start Here. Know Now.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor COVID-19 Phishing With a Side of Cobalt Strike - DomainTools | Start Here. Know Now.
31 March 2021

2021-Threat-Detection-Report.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2021-Threat-Detection-Report.pdf
30 March 2021

Yet Another Cobalt Strike Stager: GUID Edition

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Yet Another Cobalt Strike Stager: GUID Edition
29 March 2021

Sodinokibi (aka REvil) Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Sodinokibi (aka REvil) Ransomware
29 March 2021

RedEcho group parks domains after public exposure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RedEcho group parks domains after public exposure
21 March 2021

report-bb-2021-threat-report.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor report-bb-2021-threat-report.pdf
18 March 2021

Cobalt Strike – Post-Exploitation Attackers Toolkit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike – Post-Exploitation Attackers Toolkit
18 March 2021

SilverFish_TLPWHITE.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SilverFish_TLPWHITE.pdf
16 March 2021

Detecting Cobalt Strike with memory signatures

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detecting Cobalt Strike with memory signatures
16 March 2021

Technical Analysis of Operation Diànxùn

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Technical Analysis of Operation Diànxùn
11 March 2021

Myanmar – Multi-stage malware attack targets elected lawmakers – Qurium Media Foundation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Myanmar – Multi-stage malware attack targets elected lawmakers – Qurium Media Foundation
11 March 2021

You Don't Know the HAFNIUM of it...

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor You Don't Know the HAFNIUM of it...
10 March 2021

NimzaLoader: TA800’s New Initial Access Malware | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor NimzaLoader: TA800’s New Initial Access Malware | Proofpoint US
10 March 2021

Exchange servers under siege from at least 10 APT groups

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Exchange servers under siege from at least 10 APT groups
9 March 2021

Cloud Federated Credential Abuse & Cobalt Strike: Threat Research February 2021 | Splunk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cloud Federated Credential Abuse & Cobalt Strike: Threat Research February 2021 | Splunk
8 March 2021

Bazar Drops the Anchor

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Bazar Drops the Anchor
8 March 2021

How Symantec Stops Microsoft Exchange Server Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How Symantec Stops Microsoft Exchange Server Attacks
1 March 2021

Nimar Loader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Nimar Loader
1 March 2021

Investigation into the state of Nim malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Investigation into the state of Nim malware
28 February 2021

China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions
28 February 2021

Cyber Threats 2020: A Year in Retrospect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Threats 2020: A Year in Retrospect
26 February 2021

New Ransomware Tactic: Adversaries Target ESXi Servers | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Ransomware Tactic: Adversaries Target ESXi Servers | CrowdStrike
25 February 2021

So Unchill: Melting UNC2198 ICEDID to Ransomware Operations | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor So Unchill: Melting UNC2198 ICEDID to Ransomware Operations | Mandiant
25 February 2021

Intezer-2020-Go-Malware-Round-Up.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Intezer-2020-Go-Malware-Round-Up.pdf
25 February 2021

APT10: Tracking down the stealth activity of the A41APT campaign

file creation date Niwa Yusuke fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT10: Tracking down the stealth activity of the A41APT campaign
24 February 2021

investigations/2021-02-24_vietnam at master · AmnestyTech/investigations

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor investigations/2021-02-24_vietnam at master · AmnestyTech/investigations
24 February 2021

A41APT case ~Analysis of the Stealth APT Campaign Threatening Japan

Malpedia library date Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor A41APT case ~Analysis of the Stealth APT Campaign Threatening Japan
24 February 2021

c2fs_jsac2021_submit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor c2fs_jsac2021_submit
23 February 2021

Report2021GTR.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Report2021GTR.pdf
22 February 2021

Gh0stRat Anti-Debugging : Nested SEH (try - catch) to Decrypt and Load its Payload

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Gh0stRat Anti-Debugging : Nested SEH (try - catch) to Decrypt and Load its Payload
17 February 2021

Supply Chain Attacks: Cyber Criminals Target the Weakest Link (White Paper)

file creation date fromORKL

Archived copy on ORKL Detailsfor Supply Chain Attacks: Cyber Criminals Target the Weakest Link (White Paper)
9 February 2021

Extracting the Cobalt Strike Config from a TEARDROP Loader | Securehat

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Extracting the Cobalt Strike Config from a TEARDROP Loader | Securehat
5 February 2021

CinaRAT Resurfaces With New Evasive Techniques

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CinaRAT Resurfaces With New Evasive Techniques
3 February 2021

Excel spreadsheets push SystemBC malware - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Excel spreadsheets push SystemBC malware - SANS ISC
2 February 2021

How Vietnam-based hacking operation OceanLotus targets journalists - Committee to Protect Journalists

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How Vietnam-based hacking operation OceanLotus targets journalists - Committee to Protect Journalists
1 February 2021

Relay Attacks via Cobalt Strike Beacons

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Relay Attacks via Cobalt Strike Beacons
1 February 2021

Operation NightScout: Supply-chain attack targets online gaming in Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation NightScout: Supply-chain attack targets online gaming in Asia
1 February 2021

BlueCrab 랜섬웨어, 기업 환경에서는 CobaltStrike 해킹툴 설치 - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BlueCrab 랜섬웨어, 기업 환경에서는 CobaltStrike 해킹툴 설치 - ASEC
31 January 2021

Bazar, No Ryuk?

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Bazar, No Ryuk?
29 January 2021

Chopper ASPX Web Shell Used in Targeted Attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chopper ASPX Web Shell Used in Targeted Attack
28 January 2021

지속적으로 탐지 우회를 시도 중인 BlueCrab 랜섬웨어 - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 지속적으로 탐지 우회를 시도 중인 BlueCrab 랜섬웨어 - ASEC
28 January 2021

Tailoring Cobalt Strike on Target

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tailoring Cobalt Strike on Target
20 January 2021

Investigation into PlugX Uncovers Unique APT Technique

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Investigation into PlugX Uncovers Unique APT Technique
20 January 2021

Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop
18 January 2021

Raindrop: New Malware Discovered in SolarWinds Investigation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Raindrop: New Malware Discovered in SolarWinds Investigation
15 January 2021

Detecting Malicious C2 Activity -SpawnAs & SMB Lateral Movement in CobaltStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detecting Malicious C2 Activity -SpawnAs & SMB Lateral Movement in CobaltStrike
15 January 2021

CRACKING A SOFT CELL IS HARDER THAN YOU THINK

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CRACKING A SOFT CELL IS HARDER THAN YOU THINK
14 January 2021

Higaisa or Winnti? APT41 backdoors, old and new

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Higaisa or Winnti? APT41 backdoors, old and new
13 January 2021

Microsoft Word - Global Perspective of the SideWinder APT (pre-release final).docx

Malpedia library date AlienVault fromORKLCCS '25 data

The original link failed its last check. Original publisher Detailsfor Microsoft Word - Global Perspective of the SideWinder APT (pre-release final).docx
11 January 2021

Trickbot Still Alive and Well

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Trickbot Still Alive and Well
10 January 2021

MAN1, Moskal, Hancitor and a side of Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MAN1, Moskal, Hancitor and a side of Ransomware
9 January 2021

Malware Development: Leveraging Beacon Object Files for Remote Process Injection via Thread Hijacking

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Development: Leveraging Beacon Object Files for Remote Process Injection via Thread Hijacking
7 January 2021

Adversary Infrustructure Report 2020 - A Defender's View

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Adversary Infrustructure Report 2020 - A Defender's View
6 January 2021

Hunting for GetSystem commands in offensive security tools

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hunting for GetSystem commands in offensive security tools
5 January 2021

Earth Wendigo Injects JavaScript Backdoor for Mailbox Exfiltration

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Wendigo Injects JavaScript Backdoor for Mailbox Exfiltration
4 January 2021

China's APT hackers move to ransomware attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China's APT hackers move to ransomware attacks
4 January 2021

Malleable C2 Profiles and You

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malleable C2 Profiles and You
4 January 2021

nao-sec.org

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor nao-sec.org
28 December 2020

“灵猫”组织针对中东地区的攻击活动分析报告

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor “灵猫”组织针对中东地区的攻击活动分析报告
26 December 2020

Analyzing APT19 malware using a step-by-step method – CYBER GEEKS

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing APT19 malware using a step-by-step method – CYBER GEEKS
26 December 2020

Spoofing JARM signatures. I am the Cobalt Strike server now!

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Spoofing JARM signatures. I am the Cobalt Strike server now!
24 December 2020

China cyber attacks- the current threat landscape

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor China cyber attacks- the current threat landscape
21 December 2020

Active Directory 侵害と推奨対策

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Active Directory 侵害と推奨対策
21 December 2020

What We Have Learned So Far about the “Sunburst”/SolarWinds Hack | FortiGuard labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What We Have Learned So Far about the “Sunburst”/SolarWinds Hack | FortiGuard labs
18 December 2020

RAT used by Chinese cyberspies infiltrating Indian businesses

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RAT used by Chinese cyberspies infiltrating Indian businesses
15 December 2020

Tactics, Techniques, and Procedures (TTPs) Used in the SolarWinds Breach

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tactics, Techniques, and Procedures (TTPs) Used in the SolarWinds Breach
14 December 2020

Threat Brief: SolarStorm and SUNBURST Customer Coverage

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Brief: SolarStorm and SUNBURST Customer Coverage
13 December 2020

From ThreatHunting to Campaign Tracking

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor From ThreatHunting to Campaign Tracking
13 December 2020

[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor [HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx
11 December 2020

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog
10 December 2020

Operation StealthyTrident: corporate software under attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation StealthyTrident: corporate software under attack
10 December 2020

Cyber Actors Target K-12 Distance Learning Education to Cause Disruptions and Steal Data | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Actors Target K-12 Distance Learning Education to Cause Disruptions and Steal Data | CISA
10 December 2020

Threat Brief: FireEye Red Team Tool Breach

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Brief: FireEye Red Team Tool Breach
10 December 2020

Attack Activities by Quasar Family

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Attack Activities by Quasar Family
10 December 2020

Attack Activities by Quasar Family - JPCERT/CC Eyes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attack Activities by Quasar Family - JPCERT/CC Eyes
10 December 2020

No pandas, just people: The current state of China’s cybercrime underground

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor No pandas, just people: The current state of China’s cybercrime underground
9 December 2020

Recent Qakbot (Qbot) activity - SANS Internet Storm Center

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Recent Qakbot (Qbot) activity - SANS Internet Storm Center
9 December 2020

Microsoft Word - eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations-wp.docx

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Word - eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations-wp.docx
9 December 2020

Quarterly Report: Incident Response trends from Fall 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Quarterly Report: Incident Response trends from Fall 2020
9 December 2020

APT group targeting governmental agencies in East Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT group targeting governmental agencies in East Asia
9 December 2020

New Malware Arsenal Abusing Cloud Platforms in Middle East Espionage Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Malware Arsenal Abusing Cloud Platforms in Middle East Espionage Campaign
9 December 2020

APT group targeting governmental agencies in East Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT group targeting governmental agencies in East Asia
9 December 2020

Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf
4 December 2020

Snakes & Ladders: the offensive use of Python on Windows

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Snakes & Ladders: the offensive use of Python on Windows
30 November 2020

Threat actor leverages coin miner techniques to stay under the radar – here’s how to spot them | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat actor leverages coin miner techniques to stay under the radar – here’s how to spot them | Microsoft Security Blog
30 November 2020

eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations.pdf
28 November 2020

Hunting Koadic Pt. 2 - JARM Fingerprinting

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hunting Koadic Pt. 2 - JARM Fingerprinting
27 November 2020

Investigation with a twist: an accidental APT attack and averted data destruction

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Investigation with a twist: an accidental APT attack and averted data destruction
26 November 2020

Cybereason vs. Egregor Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cybereason vs. Egregor Ransomware
25 November 2020

Egregor RaaS Continues the Chaos with Cobalt Strike and Rclone - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Egregor RaaS Continues the Chaos with Cobalt Strike and Rclone - SentinelLabs
23 November 2020

Group-IB_Hi-Tech_Crime_Trends_2020-2021_en

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Group-IB_Hi-Tech_Crime_Trends_2020-2021_en
23 November 2020

TA416's Golang PlugX Malware Loader | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TA416's Golang PlugX Malware Loader | Proofpoint US
20 November 2020

PowerPoint Presentation

file creation date Ganesan, Brittany (OS/ASA) (CTR) fromORKL

Archived copy on ORKL Detailsfor PowerPoint Presentation
20 November 2020

Weaponizing Open Source Software for Targeted Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Weaponizing Open Source Software for Targeted Attacks
20 November 2020

The malware that usually installs ransomware and you need to remove right away

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The malware that usually installs ransomware and you need to remove right away
19 November 2020

APT Exploits Microsoft Zerologon Bug: Targets Japanese Companies

Malpedia library date Threatpost fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT Exploits Microsoft Zerologon Bug: Targets Japanese Companies
17 November 2020

Easily Identify Malicious Servers on the Internet with JARM - Salesforce Engineering Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Easily Identify Malicious Servers on the Internet with JARM - Salesforce Engineering Blog
17 November 2020

Japan-Linked Organizations Targeted in Long-Running and Sophisticated Attack Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Japan-Linked Organizations Targeted in Long-Running and Sophisticated Attack Campaign
17 November 2020

Japan-Linked Organizations Targeted in Long-Running and Sophisticated Attack Campaign _ Symantec Blogs

date in the CCS '25 data Symantec fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Japan-Linked Organizations Targeted in Long-Running and Sophisticated Attack Campaign _ Symantec Blogs
17 November 2020

Japan-Linked Organizations Targeted in Long-Running and Sophisticated Attack Campaign

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Japan-Linked Organizations Targeted in Long-Running and Sophisticated Attack Campaign
15 November 2020

From virus alert to PowerShell Encrypted Loader – Trustnet

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From virus alert to PowerShell Encrypted Loader – Trustnet
12 November 2020

Dragos_Manufacturing%20Threat%20Perspective_1120.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dragos_Manufacturing%20Threat%20Perspective_1120.pdf
9 November 2020

Fake Microsoft Teams updates lead to Cobalt Strike deployment

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Fake Microsoft Teams updates lead to Cobalt Strike deployment
6 November 2020

When Threat Actors Fly Under the Radar: Vatet, PyXie and Defray777

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor When Threat Actors Fly Under the Radar: Vatet, PyXie and Defray777
6 November 2020

OceanLotus: Extending Cyber Espionage Operations Through Fake Websites

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OceanLotus: Extending Cyber Espionage Operations Through Fake Websites
5 November 2020

Ryuk Speed Run, 2 Hours to Ransom

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Ryuk Speed Run, 2 Hours to Ransom
4 November 2020

Trick or Threat: Ryuk Ransomware Targets Health Care Industry

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trick or Threat: Ryuk Ransomware Targets Health Care Industry
3 November 2020

APT trends report Q3 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q3 2020
3 November 2020

Attackers Exploiting WebLogic Servers via CVE-2020-14882 to install Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attackers Exploiting WebLogic Servers via CVE-2020-14882 to install Cobalt Strike
30 October 2020

research-team/IOCs/WizardSpider-UNC1878-Ryuk.csv at master · ThreatConnect-Inc/research-team

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor research-team/IOCs/WizardSpider-UNC1878-Ryuk.csv at master · ThreatConnect-Inc/research-team
29 October 2020

A Bazar start: How one hospital thwarted a Ryuk ransomware outbreak

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Bazar start: How one hospital thwarted a Ryuk ransomware outbreak
28 October 2020

Unhappy Hour Special: KEGTAP and SINGLEMALT With a Ransomware Chaser | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unhappy Hour Special: KEGTAP and SINGLEMALT With a Ransomware Chaser | Mandiant
20 October 2020

Incident readiness: preparing a proactive response to attacks

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Incident readiness: preparing a proactive response to attacks
18 October 2020

Ryuk in 5 Hours

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Ryuk in 5 Hours
11 October 2020

CyberThreatIntel/China/APT/Chimera/Analysis.md at master · StrangerealIntel/CyberThreatIntel

Malpedia library date Github (StrangerealIntel) fromORKLCCS '25 data

The original link failed its last check. Original publisher Detailsfor CyberThreatIntel/China/APT/Chimera/Analysis.md at master · StrangerealIntel/CyberThreatIntel
8 October 2020

Ryuk's Return

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Ryuk's Return
8 October 2020

Lined up in the sights of Vietnamese hackers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lined up in the sights of Vietnamese hackers
2 October 2020

bazarloader.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor bazarloader.pdf
1 October 2020

Potential for China Cyber Response to Heightened U.S.–China Tensions | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Potential for China Cyber Response to Heightened U.S.–China Tensions | CISA
1 October 2020

Alert (AA20-275A)- Potential for China Cyber Response to Heightened U.S.-China Tensions

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Alert (AA20-275A)- Potential for China Cyber Response to Heightened U.S.-China Tensions
30 September 2020

VB2020-20.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor VB2020-20.pdf
30 September 2020

VB2020 paper: Operation LagTime IT: colourful Panda footprint

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor VB2020 paper: Operation LagTime IT: colourful Panda footprint
29 September 2020

Getting the Bacon from Cobalt Strike's Beacon | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Getting the Bacon from Cobalt Strike's Beacon | CrowdStrike
29 September 2020

GitHub - Apr4h/CobaltStrikeScan: Scan files or process memory for CobaltStrike beacons and parse their configuration

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GitHub - Apr4h/CobaltStrikeScan: Scan files or process memory for CobaltStrike beacons and parse their configuration
24 September 2020

Federal Agency Compromised by Malicious Cyber Actor | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Federal Agency Compromised by Malicious Cyber Actor | CISA
22 September 2020

Detecting Threats in Real-time With Active C2 Information

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detecting Threats in Real-time With Active C2 Information
18 September 2020

U.S. Justice Department Charges APT41 Hackers over Global Cyberattacks

Malpedia library date Trend Micro fromORKLCCS '25 data

Archived copy on ORKL Detailsfor U.S. Justice Department Charges APT41 Hackers over Global Cyberattacks
18 September 2020

APT41: Indictments Put Chinese Espionage Group in the Spotlight

Malpedia library date Symantec fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT41: Indictments Put Chinese Espionage Group in the Spotlight
17 September 2020

200917-1.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 200917-1.pdf
15 September 2020

Back Despite Disruption: RedDelta Resumes Operations

Malpedia library date Insikt Group® fromORKL

Archived copy on ORKL Detailsfor Back Despite Disruption: RedDelta Resumes Operations
11 September 2020

Research Roundup: Activity on Previously Identified APT33 Domains | ThreatConnect

Malpedia library date ThreatConnect fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Research Roundup: Activity on Previously Identified APT33 Domains | ThreatConnect
1 September 2020

Quarterly Report: Incident Response trends in Summer 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Quarterly Report: Incident Response trends in Summer 2020
31 August 2020

NetWalker Ransomware in 1 Hour

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor NetWalker Ransomware in 1 Hour
20 August 2020

TA410

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor TA410
19 August 2020

調查局 08/19 公布中國對台灣政府機關駭侵事件說明

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 調查局 08/19 公布中國對台灣政府機關駭侵事件說明
16 August 2020

WastedLocker (2020/08/16) - IoC (TT Malware Log)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor WastedLocker (2020/08/16) - IoC (TT Malware Log)
10 August 2020

FBI says an Iranian hacking group is attacking F5 networking devices

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor FBI says an Iranian hacking group is attacking F5 networking devices
4 August 2020

us-20-Chen-Operation-Chimera-APT-Operation-Targets-Semiconductor-Vendors.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor us-20-Chen-Operation-Chimera-APT-Operation-Targets-Semiconductor-Vendors.pdf
29 July 2020

ESET_Threat_Report_Q22020.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET_Threat_Report_Q22020.pdf
29 July 2020

APT trends report Q2 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q2 2020
26 July 2020

In-Memory shellcode decoding to evade AVs/EDRs

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor In-Memory shellcode decoding to evade AVs/EDRs
20 July 2020

What even is Winnti? - Risky Business Media

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What even is Winnti? - Risky Business Media
15 July 2020

Chinese state hackers target Hong Kong Catholic Church

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese state hackers target Hong Kong Catholic Church
7 July 2020

Cobalt Strike stagers used by FIN6 :: MWLab — Ladislav's Malware Lab

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike stagers used by FIN6 :: MWLab — Ladislav's Malware Lab
1 July 2020

Accenture | Let there be change

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Accenture | Let there be change
24 June 2020

BRONZE VINEWOOD Targets Supply Chains _ Secureworks

date in the CCS '25 data SecureWorks fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor BRONZE VINEWOOD Targets Supply Chains _ Secureworks
24 June 2020

BRONZE VINEWOOD Targets Supply Chains

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor BRONZE VINEWOOD Targets Supply Chains
23 June 2020

Sodinokibi: Ransomware Attackers also Scanning for PoS Software, Leveraging Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sodinokibi: Ransomware Attackers also Scanning for PoS Software, Leveraging Cobalt Strike
23 June 2020

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research
22 June 2020

IndigoDrop spreads via military-themed lures to deliver Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor IndigoDrop spreads via military-themed lures to deliver Cobalt Strike
22 June 2020

Inside a TrickBot Cobalt Strike Attack Server - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Inside a TrickBot Cobalt Strike Attack Server - SentinelLabs
22 June 2020

VenomRAT - new, hackforums grade, reincarnation of QuasarRAT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor VenomRAT - new, hackforums grade, reincarnation of QuasarRAT
19 June 2020

Targeted Attack Leverages India-China Border Dispute

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Targeted Attack Leverages India-China Border Dispute
18 June 2020

P01_P10_eng

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor P01_P10_eng
15 June 2020

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research
14 June 2020

Deep-dive: The DarkHotel APT

Malpedia library date Bushido Token fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Deep-dive: The DarkHotel APT
10 June 2020

FlowCloud Version 4.1.3 Malware Analysis | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor FlowCloud Version 4.1.3 Malware Analysis | Proofpoint US
8 June 2020

TA410_ The Group Behind LookBack Attacks Against U.S. Utilities Sector Returns with New Malware _ Proofpoint US

date in the CCS '25 data Proofpoint fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor TA410_ The Group Behind LookBack Attacks Against U.S. Utilities Sector Returns with New Malware _ Proofpoint US
8 June 2020

TA410: Malware Attacks Against U.S. Utilities Sector | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TA410: Malware Attacks Against U.S. Utilities Sector | Proofpoint US
8 June 2020

TA410- The Group Behind LookBack Attacks Against U.S. Utilities Sector Returns with New Malware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor TA410- The Group Behind LookBack Attacks Against U.S. Utilities Sector Returns with New Malware
4 June 2020

COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group
3 June 2020

Cycldek: Bridging the (air) gap

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cycldek: Bridging the (air) gap
3 June 2020

SSTIC2020-Slides-pivoter_tel_bernard_ou_comment_monitorer_des_attaquants_ngligents-lunghi.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SSTIC2020-Slides-pivoter_tel_bernard_ou_comment_monitorer_des_attaquants_ngligents-lunghi.pdf
2 June 2020

Mustang Panda Recent Activity: Dll-Sideloading trojans with temporal C2 servers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mustang Panda Recent Activity: Dll-Sideloading trojans with temporal C2 servers
29 May 2020

New RAT in Macro-Based Docs Using AppLocker Bypass | blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New RAT in Macro-Based Docs Using AppLocker Bypass | blog
27 May 2020

mpressioncss_ta_report_2019_4.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor mpressioncss_ta_report_2019_4.pdf
27 May 2020

210527.pdf

Malpedia library date FBI fromORKLCCS '25 data

Archived copy on ORKL Detailsfor 210527.pdf
25 May 2020

mpressioncss_ta_report_2019_4

date in the CCS '25 data Team T5 fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor mpressioncss_ta_report_2019_4
21 May 2020

No “Game over” for the Winnti Group

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor No “Game over” for the Winnti Group
21 May 2020

Iranian Chafer APT Targeted Air Transportation and Government in Kuwait and Saudi Arabia

date in the CCS '25 data Bitdefender fromCCS '25 data

Detailsfor Iranian Chafer APT Targeted Air Transportation and Government in Kuwait and Saudi Arabia
20 May 2020

What happened between the BigBadWolf and the Tiger?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What happened between the BigBadWolf and the Tiger?
14 May 2020

APT group planted backdoors targeting high profile networks in Central Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT group planted backdoors targeting high profile networks in Central Asia
14 May 2020

The energy reserves in the Eastern Mediterranean Sea and a malicious campaign of APT10 against Turkey

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The energy reserves in the Eastern Mediterranean Sea and a malicious campaign of APT10 against Turkey
14 May 2020

The energy reserves in the Eastern Mediterranean Sea and a malicious campaign of APT10 against Turkey

Malpedia library date Lab52 fromORKLCCS '25 data

Archived copy on ORKL Detailsfor The energy reserves in the Eastern Mediterranean Sea and a malicious campaign of APT10 against Turkey
11 May 2020

The Anatomy of an APT Attack and CobaltStrike Beacon’s Encoded Configuration - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Anatomy of an APT Attack and CobaltStrike Beacon’s Encoded Configuration - SentinelLabs
7 May 2020

Sodinokibi / REvil / Maze ransomware (TTPs & IOC)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sodinokibi / REvil / Maze ransomware (TTPs & IOC)
1 May 2020

Operation Cloud Hopper & RedLeaves

Malpedia library date LIFARS fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation Cloud Hopper & RedLeaves
27 April 2020

Master of RATs - How to create your own Tracker

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Master of RATs - How to create your own Tracker
24 April 2020

Ursnif via LOLbins

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Ursnif via LOLbins
2 April 2020

Catching APT41 exploiting a zero-day vulnerability

date in the CCS '25 data Darktrace fromCCS '25 data

The original link failed its last check. Detailsfor Catching APT41 exploiting a zero-day vulnerability
25 March 2020

APT41 Initiates Intrusion Campaign Using Multiple Exploits

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT41 Initiates Intrusion Campaign Using Multiple Exploits
25 March 2020

Trickbot to Ryuk in Two Hours

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trickbot to Ryuk in Two Hours
22 March 2020

Mustang Panda joins the COVID-19 bandwagon

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mustang Panda joins the COVID-19 bandwagon
22 March 2020

COVID-19 Themes Are Being Utilized by Threat Actors of Varying Sophistication

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor COVID-19 Themes Are Being Utilized by Threat Actors of Varying Sophistication
20 March 2020

Bitdefender Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bitdefender Labs
20 March 2020

Analysis Of Exploitation: CVE-2020-10189

Malpedia library date RECON InfoSec fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Analysis Of Exploitation: CVE-2020-10189
19 March 2020

Phân tích mã độc lợi dụng dịch Covid-19 để phát tán giả mạo “Chỉ thị của thủ tướng Nguyễn Xuân Phúc” - Phần

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Phân tích mã độc lợi dụng dịch Covid-19 để phát tán giả mạo “Chỉ thị của thủ tướng Nguyễn Xuân Phúc” - Phần
19 March 2020

Is APT 27 Abusing COVID-19 To Attack People !

date in the CCS '25 data Yoroi fromCCS '25 data

The original link failed its last check. Detailsfor Is APT 27 Abusing COVID-19 To Attack People !
12 March 2020

Vicious Panda: The COVID Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Vicious Panda: The COVID Campaign
10 March 2020

Phân tích mã độc lợi dụng dịch Covid-19 để phát tán giả mạo “Chỉ thị của thủ tướng Nguyễn Xuân Phúc” - Phần 1 - VinCSS Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Phân tích mã độc lợi dụng dịch Covid-19 để phát tán giả mạo “Chỉ thị của thủ tướng Nguyễn Xuân Phúc” - Phần 1 - VinCSS Blog
5 March 2020

Human-operated ransomware attacks: A preventable disaster | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Human-operated ransomware attacks: A preventable disaster | Microsoft Security Blog
3 March 2020

Cyber Threats 2019: A Year in Retrospect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Threats 2019: A Year in Retrospect
2 March 2020

the adversary playbook for the long-standing espionage activity of a Chinese nation-state adversary

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor the adversary playbook for the long-standing espionage activity of a Chinese nation-state adversary
19 February 2020

Lexfo-WhitePaper-The_Lazarus_Constellation.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lexfo-WhitePaper-The_Lazarus_Constellation.pdf
18 February 2020

Operation DRBControl: Uncovering a Cyberespionage Campaign Targeting Gambling Companies in Southeast Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation DRBControl: Uncovering a Cyberespionage Campaign Targeting Gambling Companies in Southeast Asia
18 February 2020

Building a bypass with MSBuild

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Building a bypass with MSBuild
17 February 2020

CLAMBLING - A New Backdoor Base On Dropbox (EN)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CLAMBLING - A New Backdoor Base On Dropbox (EN)
31 January 2020

RL Blog | ReversingLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RL Blog | ReversingLabs
29 January 2020

nao-sec.org

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor nao-sec.org
17 January 2020

JSAC2020_0_JPCERT_en.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor JSAC2020_0_JPCERT_en.pdf
10 January 2020

Cyber-Reports-2020-01-A-one-sided-Affair.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber-Reports-2020-01-A-one-sided-Affair.pdf
9 January 2020

TA428 Group abusing recent conflict between Iran and USA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TA428 Group abusing recent conflict between Iran and USA
1 January 2020

Microsoft Word - Threat Intelligence and the Limits of Malware Analysis_smc1.docx

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Word - Threat Intelligence and the Limits of Malware Analysis_smc1.docx
17 December 2019

Rancor: Cyber Espionage Group Uses New Custom Malware to Attack Southeast Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rancor: Cyber Espionage Group Uses New Custom Malware to Attack Southeast Asia
12 December 2019

Cyber Threat Landscape in Japan – Revealing Threat in the Shadow

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Cyber Threat Landscape in Japan – Revealing Threat in the Shadow
12 December 2019

[CB19] Cyber Threat Landscape in Japan – Revealing Threat in the Shadow by Chi En Shen (Ashley) Oleg Bondarenko

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor [CB19] Cyber Threat Landscape in Japan – Revealing Threat in the Shadow by Chi En Shen (Ashley) Oleg Bondarenko
12 December 2019

GALLIUM: Targeting global telecom

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GALLIUM: Targeting global telecom
9 December 2019

Group-IB_Hi-Tech_Crime_Trends_2019-2020_en

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Group-IB_Hi-Tech_Crime_Trends_2019-2020_en
29 November 2019

Group-IB_Hi-Tech_Crime_Trends_2019-2020

date in the CCS '25 data Group-IB fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Group-IB_Hi-Tech_Crime_Trends_2019-2020
29 November 2019

Aarhus_miniseminar_291118.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Aarhus_miniseminar_291118.pdf
19 November 2019

cds19-executive-s08-achievement-unlocked.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor cds19-executive-s08-achievement-unlocked.pdf
16 November 2019

Fresh PlugX October 2019

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Fresh PlugX October 2019
11 November 2019

APT cases exploiting vulnerabilities in region‑specific software

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT cases exploiting vulnerabilities in region‑specific software
11 November 2019

APT cases exploiting vulnerabilities in region‑specific software

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT cases exploiting vulnerabilities in region‑specific software
6 November 2019

a long‑term attack against China

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor a long‑term attack against China
5 November 2019

CobaltStrike - beacon.dll : Your No Ordinary MZ Header

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CobaltStrike - beacon.dll : Your No Ordinary MZ Header
4 November 2019

腾讯iOA官网(腾讯自研自用的一体化办公安全平台）-免费使用

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 腾讯iOA官网(腾讯自研自用的一体化办公安全平台）-免费使用
31 October 2019

Analytics

Malpedia library date Positive Technologies fromORKLCCS '25 data

The original link failed its last check. Original publisher Detailsfor Analytics
24 October 2019

apt10deob

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor apt10deob
3 October 2019

Context Identifies new AVIVORE threat group

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Context Identifies new AVIVORE threat group
3 October 2019

New threat group behind Airbus cyber attacks, claim researchers

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New threat group behind Airbus cyber attacks, claim researchers
3 October 2019

VB2019-A Vine Climbing Over Great Firewall A Long-Term Attack to China

file creation date fromORKL

Archived copy on ORKL Detailsfor VB2019-A Vine Climbing Over Great Firewall A Long-Term Attack to China
3 October 2019

New threat group behind Airbus cyber attacks, claim researchers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New threat group behind Airbus cyber attacks, claim researchers
3 October 2019

PKPLUG: Chinese Cyber Espionage Group Attacking Southeast Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PKPLUG: Chinese Cyber Espionage Group Attacking Southeast Asia
3 October 2019

AVIVORE – Hunting Global Aerospace through the Supply Chain | Context Information Security

Malpedia library date fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor AVIVORE – Hunting Global Aerospace through the Supply Chain | Context Information Security
3 October 2019

AVIVORE – Hunting Global Aerospace through the Supply Chain

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor AVIVORE – Hunting Global Aerospace through the Supply Chain
3 October 2019

AVIVORE - Hunting Global Aerospace through the Supply Chain

date in the CCS '25 data Contextis fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor AVIVORE - Hunting Global Aerospace through the Supply Chain
22 September 2019

Rancor: The Year of The Phish

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rancor: The Year of The Phish
18 September 2019

Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers

file creation date Cybereason fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers
18 September 2019

Two Birds, One STONE PANDA

file creation date Crowdstrike fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Two Birds, One STONE PANDA
17 September 2019

Cryptocurrency miners aren’t dead yet: Documenting the voracious but simple “Panda”

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cryptocurrency miners aren’t dead yet: Documenting the voracious but simple “Panda”
4 September 2019

APT41: A Dual Espionage and Cyber Crime Operation

file creation date FireEye fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor APT41: A Dual Espionage and Cyber Crime Operation
13 August 2019

APT-41.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor APT-41.pdf
1 August 2019

report_APT41

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor report_APT41
1 August 2019

ClearSky-2019-H1-Cyber-Events-Summary-Report.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ClearSky-2019-H1-Cyber-Events-Summary-Report.pdf
23 July 2019

Chinese APT Uses Poison Ivy Malware to Target Government | Proofpoint US

Malpedia library date Proofpoint fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Chinese APT Uses Poison Ivy Malware to Target Government | Proofpoint US
15 July 2019

Is there a pattern-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Is there a pattern-
25 June 2019

Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers
25 June 2019

OPERATION SOFT CELL- A WORLDWIDE CAMPAIGN AGAINST TELECOMMUNICATIONS PROVIDERS

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor OPERATION SOFT CELL- A WORLDWIDE CAMPAIGN AGAINST TELECOMMUNICATIONS PROVIDERS
25 June 2019

Operation Soft Cell_ A Worldwide Campaign Against Telecommunications Providers

date in the CCS '25 data Cybereason fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation Soft Cell_ A Worldwide Campaign Against Telecommunications Providers
13 June 2019

Hunting and detecting Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hunting and detecting Cobalt Strike
10 June 2019

Threat Spotlight_ MenuPass_QuasarRAT Backdoor

date in the CCS '25 data Cylance fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Threat Spotlight_ MenuPass_QuasarRAT Backdoor
10 June 2019

Blog | Arctic Wolf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Blog | Arctic Wolf
10 June 2019

Threat Spotlight- MenuPass-QuasarRAT Backdoor

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Threat Spotlight- MenuPass-QuasarRAT Backdoor
4 June 2019

An APT Blueprint Gaining New Visibility into Financial Threats

date in the CCS '25 data Bitdefender fromCCS '25 data

Detailsfor An APT Blueprint Gaining New Visibility into Financial Threats
3 June 2019

Into the Fog - The Return of ICEFOG APT

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Into the Fog - The Return of ICEFOG APT
24 May 2019

Uncovering New Activity By APT10 | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Uncovering New Activity By APT10 | FortiGuard Labs
24 May 2019

Uncovering new Activity by APT10

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Uncovering new Activity by APT10
24 May 2019

Uncovering New Activity By APT10

date in the CCS '25 data enSilo fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Uncovering New Activity By APT10
13 May 2019

APT_trends_report_Q1_2019_Securelist

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT_trends_report_Q1_2019_Securelist
10 May 2019

Exploring Mimikatz - Part 1 - WDigest

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Exploring Mimikatz - Part 1 - WDigest
8 May 2019

2019-data-breach-investigations-report.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2019-data-breach-investigations-report.pdf
25 April 2019

중국 기반 해커, 국내 에너지 기관 공격

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor 중국 기반 해커, 국내 에너지 기관 공격
24 April 2019

Sea Lotus APT organization's attack techniques against China in the first quarter of 2019 revealed

date in the CCS '25 data Weixin fromCCS '25 data

Detailsfor Sea Lotus APT organization's attack techniques against China in the first quarter of 2019 revealed
15 April 2019

Cobalt Strike. Walkthrough for Red Teamers | Pen Test Partners

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike. Walkthrough for Red Teamers | Pen Test Partners
10 April 2019

rpt-mtrends-2019.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor rpt-mtrends-2019.pdf
4 April 2019

Mimikatz Credential Theft Techniques | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mimikatz Credential Theft Techniques | CrowdStrike
1 April 2019

mpressioncss_ta_report_2019.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor mpressioncss_ta_report_2019.pdf
27 March 2019

Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.
27 March 2019

Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.
24 March 2019

An OceanLotus (APT32) Backdoor – One Night in Norfolk

Malpedia library date One Night in Norfolk fromORKLCCS '25 data

Archived copy on ORKL Detailsfor An OceanLotus (APT32) Backdoor – One Night in Norfolk
19 March 2019

SectorM04 Targeting Singapore – An Analysis – Red Alert

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SectorM04 Targeting Singapore – An Analysis – Red Alert
14 March 2019

Attacker Tracking Users Seeking Pakistani Passport

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Attacker Tracking Users Seeking Pakistani Passport
3 March 2019

rpt-mtrends-2019

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor rpt-mtrends-2019
27 February 2019

SECR_001_EN-1901%20-%20NETSCOUT%20Threat%20Intelligence%20Report%202H%202018.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor SECR_001_EN-1901%20-%20NETSCOUT%20Threat%20Intelligence%20Report%202H%202018.pdf
27 February 2019

New Global Cyber Attack on Point of Sale Systems

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Global Cyber Attack on Point of Sale Systems
26 February 2019

Identifying Cobalt Strike team servers in the wild

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Identifying Cobalt Strike team servers in the wild
25 February 2019

Defeating Compiler-Level Obfuscations Used in APT10 Malware

date in the CCS '25 data Carbon Black fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Defeating Compiler-Level Obfuscations Used in APT10 Malware
14 February 2019

Quasar Open-Source Remote Administration Tool | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Quasar Open-Source Remote Administration Tool | CISA
12 February 2019

APT Groups Moving Down the Supply Chain

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT Groups Moving Down the Supply Chain
12 February 2019

2018 Master Table

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 2018 Master Table
6 February 2019

APT10 Targeted Norwegian MSP and US Companies in Sustained Campaign

date in the CCS '25 data Recorded Future fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT10 Targeted Norwegian MSP and US Companies in Sustained Campaign
6 February 2019

APT10 Targeted Norwegian MSP and US Companies in Sustained Campaign

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT10 Targeted Norwegian MSP and US Companies in Sustained Campaign
15 January 2019

2018_ A Year of Cyber Attacks – HACKMAGEDDON

date in the CCS '25 data Hackmageddon fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 2018_ A Year of Cyber Attacks – HACKMAGEDDON
7 January 2019

ChinaZ Revelations: Revealing ChinaZ Relationships with other Chinese Threat Actor Groups

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ChinaZ Revelations: Revealing ChinaZ Relationships with other Chinese Threat Actor Groups
7 January 2019

The APT Chronicles_December 2018 edition

date in the CCS '25 data FireEye fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The APT Chronicles_December 2018 edition
4 January 2019

GitHub - gentilkiwi/mimikatz: A little tool to play with Windows security

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GitHub - gentilkiwi/mimikatz: A little tool to play with Windows security
28 December 2018

%28U%29%20FBI%20FLASH%20-%20%20Chinese%20APT10%20intrusion%20activities%20target%20-%2020190102.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor %28U%29%20FBI%20FLASH%20-%20%20Chinese%20APT10%20intrusion%20activities%20target%20-%2020190102.pdf
20 December 2018

Chinese Hackers Indicted - Members of APT 10 Group Targeted Intellectual Property and Confidential Business Information

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Chinese Hackers Indicted - Members of APT 10 Group Targeted Intellectual Property and Confidential Business Information
20 December 2018

Chinese Hackers Indicted | Federal Bureau of Investigation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese Hackers Indicted | Federal Bureau of Investigation
5 December 2018

APT review of the year

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT review of the year
19 November 2018

Not So Cozy: An Uncomfortable Examination of a Suspected APT29 Phishing Campaign | Mandiant

Malpedia library date FireEye fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Not So Cozy: An Uncomfortable Examination of a Suspected APT29 Phishing Campaign | Mandiant
18 November 2018

CozyBear – In from the Cold?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CozyBear – In from the Cold?
17 October 2018

Cyber-Espionage Campaign Targeting the Naval Industry (“MartyMcFly”)

date in the CCS '25 data Yoroi fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Cyber-Espionage Campaign Targeting the Naval Industry (“MartyMcFly”)
1 October 2018

CDS2018-Technical-S5-ATT&CKing FIN7_The Value of Using Frameworks for Threat Intelligence-FINAL_clean

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor CDS2018-Technical-S5-ATT&CKing FIN7_The Value of Using Frameworks for Threat Intelligence-FINAL_clean
1 October 2018

VB2018 - Who Was Not Responsible for Olympic Destroyer

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor VB2018 - Who Was Not Responsible for Olympic Destroyer
19 September 2018

Hex-Rays Microcode API vs. Obfuscating Compiler – Hex Rays

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hex-Rays Microcode API vs. Obfuscating Compiler – Hex Rays
14 September 2018

APT10 Targeting Japanese Corporations Using Updated TTPs

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT10 Targeting Japanese Corporations Using Updated TTPs
13 September 2018

APT10 Targeting Japanese Corporations Using Updated TTPs

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT10 Targeting Japanese Corporations Using Updated TTPs
13 September 2018

APT10 Targets Japanese Corporations | UPPERCUT backdoor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT10 Targets Japanese Corporations | UPPERCUT backdoor
31 August 2018

Who is Mr An, and was he working for APT10-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Who is Mr An, and was he working for APT10-
31 August 2018

Who is Mr An, and was he working for APT10

date in the CCS '25 data Intrusion Truth fromCCS '25 data

Detailsfor Who is Mr An, and was he working for APT10
30 August 2018

Two Birds, One STONE PANDA

date in the CCS '25 data IntrusionTruth fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Two Birds, One STONE PANDA
30 August 2018

Two Birds, One STONE PANDA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Two Birds, One STONE PANDA
30 August 2018

Two Birds, One STONE PANDA

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Two Birds, One STONE PANDA
21 August 2018

Operation Red Signature Targets South Korean Companies

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Red Signature Targets South Korean Companies
20 August 2018

Chinese Cyberespionage Originating From Tsinghua University Infrastructure

file creation date fromORKL

Archived copy on ORKL Detailsfor Chinese Cyberespionage Originating From Tsinghua University Infrastructure
16 August 2018

Chinese Cyberespionage Originating From Tsinghua University Infrastructure

date in the CCS '25 data Recorded Future fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Chinese Cyberespionage Originating From Tsinghua University Infrastructure
16 August 2018

Chinese Cyberespionage Originating From Tsinghua University Infrastructure

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Chinese Cyberespionage Originating From Tsinghua University Infrastructure
15 August 2018

APT10 was managed by the Tianjin bureau of the Chinese Ministry of State Security

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT10 was managed by the Tianjin bureau of the Chinese Ministry of State Security
15 August 2018

APT10 was managed by the Tianjin bureau of the Chinese Ministry of State Security

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT10 was managed by the Tianjin bureau of the Chinese Ministry of State Security
9 August 2018

More on Huaying Haitai and Laoying Baichaun, the companies associated with APT10. Is there a state connection-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor More on Huaying Haitai and Laoying Baichaun, the companies associated with APT10. Is there a state connection-
9 August 2018

More on Huaying Haitai and Laoying Baichaun, the companies associated with APT10. Is there a state connection

date in the CCS '25 data Intrusion Truth fromCCS '25 data

Detailsfor More on Huaying Haitai and Laoying Baichaun, the companies associated with APT10. Is there a state connection
6 August 2018

Who is Mr Zhang-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Who is Mr Zhang-
3 August 2018

Volatility Plugin for Detecting Cobalt Strike Beacon - JPCERT/CC Eyes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Volatility Plugin for Detecting Cobalt Strike Beacon - JPCERT/CC Eyes
2 August 2018

The Gorgon Group: Slithering Between Nation State and Cybercrime

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Gorgon Group: Slithering Between Nation State and Cybercrime
2 August 2018

Who is Mr Gao-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Who is Mr Gao-
31 July 2018

Malicious document targets Vietnamese officials

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malicious document targets Vietnamese officials
30 July 2018

Who is Mr Zheng-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Who is Mr Zheng-
25 July 2018

Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions
17 July 2018

Who was behind this unprecedented Cyber attack on Western infrastructure-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Who was behind this unprecedented Cyber attack on Western infrastructure-
17 July 2018

A deep dive down the Vermin RAThole

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A deep dive down the Vermin RAThole
7 June 2018

Patchwork APT Group Targets US Think Tanks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Patchwork APT Group Targets US Think Tanks
6 June 2018

Sofacy Group’s Parallel Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sofacy Group’s Parallel Attacks
21 May 2018

APT攻撃者グループ menuPass(APT10) による新たな攻撃を確認 | LAC WATCH

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT攻撃者グループ menuPass(APT10) による新たな攻撃を確認 | LAC WATCH
15 May 2018

BSides IR in Heterogeneous Environment

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor BSides IR in Heterogeneous Environment
9 May 2018

Malware Analysis – PlugX – Part 2

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Analysis – PlugX – Part 2
3 May 2018

Burning Umbrella: An Intelligence Report on the Winnti Umbrella and Associated State-Sponsored Attackers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Burning Umbrella: An Intelligence Report on the Winnti Umbrella and Associated State-Sponsored Attackers
25 April 2018

M-TRENDS2018

file creation date FireEye fromORKL

Archived copy on ORKL Detailsfor M-TRENDS2018
20 April 2018

Hogfish Redleaves Malware Threat Analysis I Accenture

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Hogfish Redleaves Malware Threat Analysis I Accenture
17 April 2018

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research
29 March 2018

ChessMaster Adds Updated Tools to Its Arsenal

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor ChessMaster Adds Updated Tools to Its Arsenal
29 March 2018

ChessMaster Adds Updated Tools to Its Arsenal

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor ChessMaster Adds Updated Tools to Its Arsenal
29 March 2018

ChessMaster Adds Updated Tools to Its Arsenal - TrendLabs Security Intelligence Blog

date in the CCS '25 data ESET fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ChessMaster Adds Updated Tools to Its Arsenal - TrendLabs Security Intelligence Blog
13 March 2018

Time of death? A therapeutic postmortem of connected medicine

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Time of death? A therapeutic postmortem of connected medicine
28 February 2018

Chafer: Latest Attacks Reveal Heightened Ambitions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chafer: Latest Attacks Reveal Heightened Ambitions
26 February 2018

Who Wasn’t Responsible for Olympic Destroyer-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Who Wasn’t Responsible for Olympic Destroyer-
26 February 2018

Who Wasn’t Responsible for Olympic Destroyer?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Who Wasn’t Responsible for Olympic Destroyer?
4 February 2018

ChessMaster Makes its Move: A Look into the Campaign's Cyberespionage Arsenal

file creation date Trend Micro fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor ChessMaster Makes its Move: A Look into the Campaign's Cyberespionage Arsenal
4 February 2018

Malware Analysis – PlugX

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Analysis – PlugX
1 February 2018

Bitdefender Labs

Malpedia library date Bitdefender fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Bitdefender Labs
29 January 2018

VERMIN: Quasar RAT and Custom Malware Used In Ukraine

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor VERMIN: Quasar RAT and Custom Malware Used In Ukraine
4 January 2018

Malware-Traffic-Analysis.net - 2018-01-04 - PCRAT/Gh0st infection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware-Traffic-Analysis.net - 2018-01-04 - PCRAT/Gh0st infection
19 December 2017

North Korea Bitten by Bitcoin Bug: Financially motivated campaigns reveal new dimension of the Lazarus Group | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor North Korea Bitten by Bitcoin Bug: Financially motivated campaigns reveal new dimension of the Lazarus Group | Proofpoint US
18 December 2017

PlugXと攻撃者グループ "DragonOK"の関連性 | LAC WATCH

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PlugXと攻撃者グループ "DragonOK"の関連性 | LAC WATCH
4 December 2017

New method of macro malware disguised as defense-related files

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New method of macro malware disguised as defense-related files
1 December 2017

Advanced Persistent Threat Groups

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Advanced Persistent Threat Groups
9 November 2017

How the Mimikatz Hacker Tool Stole the World's Passwords

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How the Mimikatz Hacker Tool Stole the World's Passwords
15 September 2017

Deep Analysis of New Poison Ivy/PlugX Variant - Part II

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Deep Analysis of New Poison Ivy/PlugX Variant - Part II
23 August 2017

Deep Analysis of New Poison Ivy Variant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Deep Analysis of New Poison Ivy Variant
21 August 2017

Cyberespionage Group Turla Deploys Backdoor Ahead of G20 Task Force Summit

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Cyberespionage Group Turla Deploys Backdoor Ahead of G20 Task Force Summit
21 August 2017

Cyberespionage Group Turla Deploys Backdoor Ahead of G20 Task Force Summit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyberespionage Group Turla Deploys Backdoor Ahead of G20 Task Force Summit
27 July 2017

ChessMaster Makes its Move- A Look into the Campaign’s Cyberespionage Arsenal

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor ChessMaster Makes its Move- A Look into the Campaign’s Cyberespionage Arsenal
27 July 2017

chessmaster-cyber-espionage-campaign

date in the CCS '25 data Trend Micro fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor chessmaster-cyber-espionage-campaign
27 July 2017

ChessMaster Makes its Move: A Look into its Arsenal

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor ChessMaster Makes its Move: A Look into its Arsenal
27 June 2017

Paranoid PlugX

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Paranoid PlugX
6 June 2017

Privileges and Credentials: Phished at the Request of Counsel | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Privileges and Credentials: Phished at the Request of Counsel | Mandiant
6 June 2017

Privileges and Credentials: Phished at the Request of Counsel | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Privileges and Credentials: Phished at the Request of Counsel | Mandiant
8 May 2017

BfV Cyber-Brief Nr. 2/2017

file creation date Bundesamt für Verfassungsschutz fromORKL

The original link failed its last check. Original publisher Detailsfor BfV Cyber-Brief Nr. 2/2017
27 April 2017

Intrusions Affecting Multiple Victims Across Multiple Sectors | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Intrusions Affecting Multiple Victims Across Multiple Sectors | CISA
27 April 2017

IR-ALERT-MED-17-093-01C Intrusions Affecting Multiple Victims Across Multiple Sectors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor IR-ALERT-MED-17-093-01C Intrusions Affecting Multiple Victims Across Multiple Sectors
27 April 2017

Alert (TA17-117A)- Intrusions Affecting Multiple Victims Across Multiple Sectors

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Alert (TA17-117A)- Intrusions Affecting Multiple Victims Across Multiple Sectors
21 April 2017

Researchers claim China trying to hack South Korea missile defense efforts

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Researchers claim China trying to hack South Korea missile defense efforts
21 April 2017

Researchers claim China trying to hack South Korea missile defense efforts

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Researchers claim China trying to hack South Korea missile defense efforts
18 April 2017

Coming Soon…

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Coming Soon…
6 April 2017

APT10 (MenuPass Group)- New Tools, Global Campaign Latest Manifestation of Longstanding Threat

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT10 (MenuPass Group)- New Tools, Global Campaign Latest Manifestation of Longstanding Threat
6 April 2017

Operation Cloud Hopper: Technical Annex

file creation date fromORKL

Archived copy on ORKL Detailsfor Operation Cloud Hopper: Technical Annex
6 April 2017

APT10 (MenuPass Group): New Tools, Global Campaign Latest Manifestation of Longstanding Threat

Malpedia library date FireEye fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT10 (MenuPass Group): New Tools, Global Campaign Latest Manifestation of Longstanding Threat
6 April 2017

Chinese Nation-State Hackers Target U.S in Operation TradeSecret

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Chinese Nation-State Hackers Target U.S in Operation TradeSecret
4 April 2017

Operation Cloud Hopper

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation Cloud Hopper
3 April 2017

cloud-hopper-report-final-upda_72977

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor cloud-hopper-report-final-upda_72977
3 April 2017

Operation Cloud Hopper

date in the CCS '25 data PWC fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Operation Cloud Hopper
3 April 2017

RedLeaves - Malware Based on Open Source RAT - JPCERT/CC Eyes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RedLeaves - Malware Based on Open Source RAT - JPCERT/CC Eyes
3 April 2017

オープンソースのRATを改良したマルウエアRedLeaves(2017-04-03) - JPCERT/CC Eyes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor オープンソースのRATを改良したマルウエアRedLeaves(2017-04-03) - JPCERT/CC Eyes
27 February 2017

The Deception Project: A New Japanese-Centric Threat

date in the CCS '25 data Cylance fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor The Deception Project: A New Japanese-Centric Threat
27 February 2017

The Deception Project- A New Japanese-Centric Threat

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Deception Project- A New Japanese-Centric Threat
27 February 2017

Endpoint Protection - Symantec Enterprise

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Endpoint Protection - Symantec Enterprise
25 February 2017

[HackCon] Silent Rifle Response Against Advanced Threat

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor [HackCon] Silent Rifle Response Against Advanced Threat
24 February 2017

ChChes - Malware that Communicates with C&C Servers Using Cookie Headers

file creation date JPCERT fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor ChChes - Malware that Communicates with C&C Servers Using Cookie Headers
17 February 2017

JPCERT/CC Blog: ChChes – Malware that Communicates with C&C Servers Using Cookie Headers

date in the CCS '25 data RSA fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor JPCERT/CC Blog: ChChes – Malware that Communicates with C&C Servers Using Cookie Headers
16 February 2017

menuPass Returns with New Malware and New Attacks Against Japanese Academics and Organizations

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor menuPass Returns with New Malware and New Attacks Against Japanese Academics and Organizations
16 February 2017

menuPass Returns with New Malware and New Attacks Against Japanese Academics and Organizations

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor menuPass Returns with New Malware and New Attacks Against Japanese Academics and Organizations
16 February 2017

menuPass Returns with New Malware and New Attacks Against Japanese Academics and Organizations

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor menuPass Returns with New Malware and New Attacks Against Japanese Academics and Organizations
10 February 2017

PowerSploitを悪用して感染するマルウエア(2017-02-10) - JPCERT/CC Eyes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PowerSploitを悪用して感染するマルウエア(2017-02-10) - JPCERT/CC Eyes
30 January 2017

Downeks and Quasar RAT Used in Recent Targeted Attacks Against Governments

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Downeks and Quasar RAT Used in Recent Targeted Attacks Against Governments
26 January 2017

Malware ChChes interacts with C & C server using Cookie header

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Malware ChChes interacts with C & C server using Cookie header
26 January 2017

Cookieヘッダーを用いてC&CサーバとやりとりするマルウエアChChes(2017-01-26) - JPCERT/CC Eyes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cookieヘッダーを用いてC&CサーバとやりとりするマルウエアChChes(2017-01-26) - JPCERT/CC Eyes
22 November 2016

Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy
25 August 2016

Unpacking the spyware disguised as antivirus | Malwarebytes Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unpacking the spyware disguised as antivirus | Malwarebytes Labs
28 July 2016

ICIT-Brief-China-Espionage-Dynasty

date in the CCS '25 data Debra Obyrne fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ICIT-Brief-China-Espionage-Dynasty
13 June 2016

security_report_20160613.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor security_report_20160613.pdf
22 April 2016

New Poison Ivy RAT Variant Targets Hong Kong Pro-Democracy Activists

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Poison Ivy RAT Variant Targets Hong Kong Pro-Democracy Activists
13 April 2016

The Four Element Sword Engagement

file creation date Arbor fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor The Four Element Sword Engagement
7 April 2016

Taiwan Presidential Election: A Case Study on Thematic Targeting - Cyber security updates

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Taiwan Presidential Election: A Case Study on Thematic Targeting - Cyber security updates
17 March 2016

Taiwan Presidential Election: A Case Study on Thematic Targeting

date in the CCS '25 data PWC fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Taiwan Presidential Election: A Case Study on Thematic Targeting
4 February 2016

15GlobalThreatReport.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor 15GlobalThreatReport.pdf
15 December 2015

Newcomers in the Derusbi family

Malpedia library date fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor Newcomers in the Derusbi family
16 October 2015

Targeted Malware Attacks against NGO Linked to Attacks on Burmese Government Websites - The Citizen Lab

date in the CCS '25 data RSA fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Targeted Malware Attacks against NGO Linked to Attacks on Burmese Government Websites - The Citizen Lab
8 October 2015

VB2015_Catching_the_silent_whisper

Malpedia library date mpun@fortinet.com, ericleung@fortinet.com, ntan@fortinet.com fromORKL

Archived copy on ORKL Detailsfor VB2015_Catching_the_silent_whisper
23 September 2015

Chinese Actors Use ‘3102’ Malware in Attacks on US Government and EU Media

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese Actors Use ‘3102’ Malware in Attacks on US Government and EU Media
23 September 2015

Chinese Actors Use ‘3102’ Malware in Attacks on US Government and EU Media

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Chinese Actors Use ‘3102’ Malware in Attacks on US Government and EU Media
15 September 2015

Targeted Attack Distributes PlugX in Russia | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Targeted Attack Distributes PlugX in Russia | Proofpoint US
1 September 2015

Research, News, and Perspectives

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Research, News, and Perspectives
20 August 2015

Microsoft Word - ASERT Threat Intelligence Brief 2015-05 PlugX Threat Activity in Myanmar.docx

date in the CCS '25 data Arbor Networks fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Microsoft Word - ASERT Threat Intelligence Brief 2015-05 PlugX Threat Activity in Myanmar.docx
20 August 2015

New activity of the Blue Termite APT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New activity of the Blue Termite APT
10 August 2015

HTExploitTelemetry

Malpedia library date FireEye fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor HTExploitTelemetry
1 August 2015

Uncovering the Seven Pointed Dagger

Malpedia library date Arbor Networks fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Uncovering the Seven Pointed Dagger
27 February 2015

The Anthem Hack: All Roads Lead to China | ThreatConnect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Anthem Hack: All Roads Lead to China | ThreatConnect
24 February 2015

Microsoft Word - 2015-02-XX -Scanbox II - TLPWHITE.docx

date in the CCS '25 data PWC fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Microsoft Word - 2015-02-XX -Scanbox II - TLPWHITE.docx
19 September 2014

Recent Watering Hole Attacks Attributed to APT Group “th3bug” Using Poison Ivy

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Recent Watering Hole Attacks Attributed to APT Group “th3bug” Using Poison Ivy
30 August 2014

Poison Ivy Malware Analysis | FireEye

file creation date fromORKL

Archived copy on ORKL Detailsfor Poison Ivy Malware Analysis | FireEye
12 March 2014

A Detailed Examination of the Siesta Campaign « A Detailed Examination of the Siesta Campaign | FireEye Inc

date in the CCS '25 data FireEye fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor A Detailed Examination of the Siesta Campaign « A Detailed Examination of the Siesta Campaign | FireEye Inc
12 March 2014

A Detailed Examination of the Siesta Campaign

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor A Detailed Examination of the Siesta Campaign
16 October 2013

CrowdCasts Monthly- You Have an Adversary Problem

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor CrowdCasts Monthly- You Have an Adversary Problem
16 October 2013

CrowdCasts Monthly: You Have an Adversary Problem

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor CrowdCasts Monthly: You Have an Adversary Problem
19 September 2013

2Q Report on Targeted Attack Campaigns

file creation date Trend Micro fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 2Q Report on Targeted Attack Campaigns
27 February 2013

BKDR_RARSTONE: New RAT to Watch Out For - TrendLabs Security Intelligence Blog

Malpedia library date fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor BKDR_RARSTONE: New RAT to Watch Out For - TrendLabs Security Intelligence Blog
29 June 2011

Inside a Back Door Attack

Malpedia library date fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor Inside a Back Door Attack

Newest first. Details opens the report in Explore.

Names and who uses them

menuPass from AT ET
Red Apollo from AT MI ET MA Microsoft
Cicada from AT MI ET MA
POTASSIUM from AT MI MA Microsoft
APT10 from AT MI MA Microsoft
CVNX from AT MI ET MA
Purple Typhoon from MI ET MA Microsoft
HOGFISH from AT MI MA
BRONZE RIVERSIDE from AT MI MA
TA429 from MI ET MA
Granite Taurus from MI ET MA
STONE PANDA from MI MA Microsoft
Stone Panda from AT ET
Menupass Team from MI MA

Show all 38 names Show fewer

happyyongzi from MI MA
Cloud Hopper from MI MA
ATK41 from MI MA
APT 10 from ET
menuPass Team from ET
Potassium from ET
Hogfish from ET
Happyyongzi from ET
Bronze Riverside from ET
CTG-5938 from ET
ATK 41 from ET
ITG01 from ET
Earth Kasha from ET
Cuckoo Spear from ET
GOLEM from Microsoft
Evilgrab from Microsoft
AEON from Microsoft
LIVESAFE from Microsoft
ChChes from Microsoft
Haymaker from Microsoft
Webmonder from Microsoft
Foxtrot from Microsoft
Foxmail from Microsoft
MenuPass from Microsoft

AT ATT&CK
MI MISP
ET ETDA
MA Malpedia

Origin and Motivation

Origin: China fromMISP ETDA Malpedia Microsoft
Motivation: Information theft and espionage fromETDA

Claimed targets (actor-level, per source)

Sources give these for the actor as a whole, not for a report or campaign.

Countries: Australia fromETDA
Belgium fromETDA
Brazil fromETDA
Canada fromETDA
China fromETDA
Finland fromETDA
France fromETDA
Germany fromETDA
Hong Kong fromETDA
India fromETDA
Israel fromETDA
Italy fromETDA

Show all 29 countries Show fewer

Japan fromETDA
Montenegro fromETDA
Netherlands fromETDA
Norway fromETDA
Philippines fromETDA
Singapore fromETDA
South Africa fromETDA
South Korea fromETDA
Sweden fromETDA
Switzerland fromETDA
Taiwan fromETDA
Thailand fromETDA
Türkiye fromETDA
United Arab Emirates fromETDA
United Kingdom fromETDA
United States fromETDA
Vietnam fromETDA
Sectors: Aerospace fromETDA
Defense fromETDA
Energy fromETDA
Financial fromETDA
Government fromETDA
Healthcare fromETDA
High-Tech fromETDA
IT fromETDA
Media fromETDA
NGOs fromETDA
Pharmaceutical fromETDA
Telecommunications fromETDA

Show all 13 sectors Show fewer

MSPs fromETDA

Malware and Tools

AdFind fromATT&CK
ChChes fromATT&CK
Cobalt Strike fromATT&CK
Ecipekac fromATT&CK
EvilGrab fromATT&CK
FYAnti fromATT&CK
HUI Loader fromATT&CK
Impacket fromATT&CK
Mimikatz fromATT&CK
Net fromATT&CK
P8RAT fromATT&CK
Ping fromATT&CK

Show all 26 malware and tools Show fewer

PlugX fromATT&CK
PoisonIvy fromATT&CK
PowerSploit fromATT&CK
PsExec fromATT&CK
QuasarRAT fromATT&CK
RedLeaves fromATT&CK
SNUGRIDE fromATT&CK
SodaMaster fromATT&CK
UPPERCUT fromATT&CK
certutil fromATT&CK
cmd fromATT&CK
esentutl fromATT&CK
pwdump fromATT&CK
MimiKatz fromMalpedia