OilRig

Also reported as IRN2, Helix Kitten, Evasive Serpens, Hazel Sandstorm, EUROPIUM and 22 other names. Linked to Iran by three sources.

Reports: 403
Last reported: 10 August 2026
Known CVEs: 303
Techniques in ATT&CK: 81
Origin: Iran

ID: G0049
Sources: ATT&CK MISP ETDA Malpedia
Merge evidence: 30 alias matches

Reports per quarter

2013 Q1: 1 report
2013 Q2: 1 report
2013 Q3: no reports
2013 Q4: no reports
2014 Q1: no reports
2014 Q2: no reports
2014 Q3: no reports
2014 Q4: no reports
2015 Q1: no reports
2015 Q2: no reports
2015 Q3: no reports
2015 Q4: no reports
2016 Q1: no reports
2016 Q2: 4 reports
2016 Q3: no reports
2016 Q4: 3 reports
2017 Q1: 16 reports
2017 Q2: 8 reports
2017 Q3: 13 reports
2017 Q4: 18 reports
2018 Q1: 15 reports
2018 Q2: 5 reports
2018 Q3: 11 reports
2018 Q4: 6 reports
2019 Q1: 16 reports
2019 Q2: 26 reports
2019 Q3: 21 reports
2019 Q4: 11 reports
2020 Q1: 20 reports
2020 Q2: 6 reports
2020 Q3: 16 reports
2020 Q4: 7 reports
2021 Q1: 9 reports
2021 Q2: 9 reports
2021 Q3: 8 reports
2021 Q4: 6 reports
2022 Q1: 7 reports
2022 Q2: 14 reports
2022 Q3: 10 reports
2022 Q4: no reports
2023 Q1: 7 reports
2023 Q2: 3 reports
2023 Q3: 3 reports
2023 Q4: 8 reports
2024 Q1: 3 reports
2024 Q2: 7 reports
2024 Q3: 4 reports
2024 Q4: 7 reports
2025 Q1: 1 report
2025 Q2: 5 reports
2025 Q3: no reports
2025 Q4: no reports
2026 Q1: 3 reports
2026 Q2: 61 reports
2026 Q3: 4 reports

Dated reports, 2013 Q1 to 2026 Q3.

Techniques seen in the last two years

T1041 6 reports reports only
T1105 6 reports in ATT&CK
T1059.003 4 reports in ATT&CK
T1070.004 4 reports in ATT&CK
T1071.001 4 reports in ATT&CK
T1074.001 4 reports reports only
T1082 4 reports in ATT&CK
T1112 4 reports in ATT&CK
T1140 4 reports in ATT&CK
T1190 4 reports reports only

Show all 277 techniques Show fewer

T1547.001 4 reports reports only
T1573.001 4 reports reports only
T1003.001 3 reports in ATT&CK
T1008 3 reports in ATT&CK
T1020 3 reports reports only
T1021.001 3 reports in ATT&CK
T1027 3 reports reports only
T1033 3 reports in ATT&CK
T1046 3 reports in ATT&CK
T1047 3 reports in ATT&CK
T1053 3 reports reports only
T1059 3 reports in ATT&CK
T1059.001 3 reports in ATT&CK
T1102.002 3 reports reports only
T1132.001 3 reports reports only
T1490 3 reports reports only
T1543.003 3 reports in ATT&CK
T1546 3 reports reports only
T1566.002 3 reports in ATT&CK
T1567 3 reports reports only
T1567.002 3 reports reports only
T1583 3 reports reports only
T1608 3 reports reports only
T1010 2 reports reports only
T1016 2 reports in ATT&CK
T1021 2 reports reports only
T1036.004 2 reports reports only
T1053.005 2 reports in ATT&CK
T1055 2 reports reports only
T1057 2 reports in ATT&CK
T1059.006 2 reports reports only
T1059.007 2 reports reports only
T1069 2 reports reports only
T1071 2 reports reports only
T1078 2 reports in ATT&CK
T1083 2 reports reports only
T1087 2 reports reports only
T1090 2 reports reports only
T1091 2 reports reports only
T1098 2 reports reports only
T1102 2 reports reports only
T1106 2 reports reports only
T1119 2 reports in ATT&CK
T1120 2 reports in ATT&CK
T1134 2 reports reports only
T1134.001 2 reports reports only
T1135 2 reports reports only
T1137 2 reports reports only
T1189 2 reports reports only
T1195 2 reports in ATT&CK
T1204 2 reports reports only
T1204.001 2 reports in ATT&CK
T1204.002 2 reports in ATT&CK
T1213 2 reports reports only
T1219 2 reports in ATT&CK
T1480 2 reports reports only
T1485 2 reports reports only
T1486 2 reports reports only
T1489 2 reports reports only
T1505.003 2 reports in ATT&CK
T1518.001 2 reports reports only
T1547.009 2 reports reports only
T1559 2 reports reports only
T1560.001 2 reports reports only
T1566 2 reports reports only
T1566.001 2 reports in ATT&CK
T1566.003 2 reports in ATT&CK
T1569.002 2 reports reports only
T1571 2 reports reports only
T1573 2 reports reports only
T1573.002 2 reports in ATT&CK
T1574.001 2 reports reports only
T1583.001 2 reports in ATT&CK
T1583.003 2 reports reports only
T1585.002 2 reports reports only
T1587.001 2 reports in ATT&CK
T1595.002 2 reports reports only
T1622 2 reports reports only
T1001 1 report reports only
T1003.002 1 report reports only
T1005 1 report in ATT&CK
T1007 1 report in ATT&CK
T1012 1 report in ATT&CK
T1016.001 1 report reports only
T1018 1 report reports only
T1021.002 1 report reports only
T1021.004 1 report in ATT&CK
T1021.005 1 report reports only
T1021.006 1 report reports only
T1025 1 report in ATT&CK
T1027.007 1 report reports only
T1027.009 1 report reports only
T1027.013 1 report in ATT&CK
T1030 1 report reports only
T1036 1 report in ATT&CK
T1036.005 1 report in ATT&CK
T1037 1 report reports only
T1037.001 1 report reports only
T1039 1 report reports only
T1040 1 report reports only
T1048 1 report reports only
T1048.001 1 report reports only
T1048.003 1 report in ATT&CK
T1049 1 report in ATT&CK
T1053.003 1 report reports only
T1055.001 1 report reports only
T1055.002 1 report reports only
T1055.003 1 report reports only
T1055.004 1 report reports only
T1055.009 1 report reports only
T1055.012 1 report reports only
T1056 1 report reports only
T1056.001 1 report in ATT&CK
T1056.002 1 report reports only
T1059.002 1 report reports only
T1059.004 1 report reports only
T1059.005 1 report in ATT&CK
T1059.009 1 report reports only
T1059.010 1 report reports only
T1059.011 1 report reports only
T1068 1 report in ATT&CK
T1069.001 1 report in ATT&CK
T1069.002 1 report in ATT&CK
T1069.003 1 report reports only
T1070 1 report reports only
T1070.006 1 report reports only
T1070.009 1 report reports only
T1071.004 1 report in ATT&CK
T1072 1 report reports only
T1074 1 report reports only
T1074.002 1 report reports only
T1078.003 1 report reports only
T1078.004 1 report reports only
T1087.001 1 report in ATT&CK
T1087.002 1 report in ATT&CK
T1087.004 1 report reports only
T1090.001 1 report reports only
T1090.003 1 report reports only
T1095 1 report reports only
T1098.001 1 report reports only
T1098.003 1 report reports only
T1098.004 1 report reports only
T1098.005 1 report reports only
T1098.006 1 report reports only
T1098.007 1 report reports only
T1104 1 report reports only
T1113 1 report in ATT&CK
T1114 1 report reports only
T1114.001 1 report reports only
T1114.002 1 report reports only
T1114.003 1 report reports only
T1115 1 report in ATT&CK
T1123 1 report reports only
T1124 1 report reports only
T1125 1 report reports only
T1129 1 report reports only
T1132 1 report reports only
T1133 1 report in ATT&CK
T1134.002 1 report reports only
T1136 1 report reports only
T1136.001 1 report reports only
T1136.002 1 report reports only
T1137.006 1 report reports only
T1195.002 1 report reports only
T1199 1 report reports only
T1200 1 report reports only
T1201 1 report in ATT&CK
T1202 1 report reports only
T1203 1 report in ATT&CK
T1210 1 report reports only
T1213.001 1 report reports only
T1213.002 1 report reports only
T1213.003 1 report reports only
T1217 1 report reports only
T1218.011 1 report reports only
T1482 1 report reports only
T1484 1 report reports only
T1484.001 1 report reports only
T1491.002 1 report reports only
T1496 1 report reports only
T1497 1 report reports only
T1497.001 1 report in ATT&CK
T1497.003 1 report reports only
T1505 1 report reports only
T1505.004 1 report reports only
T1518 1 report reports only
T1529 1 report reports only
T1530 1 report reports only
T1534 1 report reports only
T1537 1 report reports only
T1538 1 report reports only
T1543 1 report reports only
T1543.002 1 report reports only
T1543.004 1 report reports only
T1546.003 1 report reports only
T1546.004 1 report reports only
T1546.008 1 report reports only
T1546.012 1 report reports only
T1546.015 1 report reports only
T1547 1 report reports only
T1547.002 1 report reports only
T1547.005 1 report reports only
T1548 1 report reports only
T1548.002 1 report reports only
T1550 1 report reports only
T1550.001 1 report reports only
T1550.002 1 report reports only
T1554 1 report reports only
T1555.003 1 report in ATT&CK
T1556 1 report reports only
T1556.006 1 report reports only
T1556.009 1 report reports only
T1557 1 report reports only
T1559.001 1 report reports only
T1560 1 report reports only
T1560.002 1 report reports only
T1560.003 1 report reports only
T1564.003 1 report reports only
T1565 1 report reports only
T1565.001 1 report reports only
T1566.004 1 report reports only
T1567.001 1 report reports only
T1569 1 report reports only
T1570 1 report reports only
T1572 1 report in ATT&CK
T1574 1 report reports only
T1574.011 1 report reports only
T1578 1 report reports only
T1580 1 report reports only
T1583.004 1 report reports only
T1583.006 1 report reports only
T1584 1 report reports only
T1585 1 report reports only
T1585.003 1 report reports only
T1586.002 1 report in ATT&CK
T1587 1 report reports only
T1587.003 1 report reports only
T1588 1 report reports only
T1588.002 1 report in ATT&CK
T1588.003 1 report in ATT&CK
T1588.004 1 report reports only
T1588.007 1 report reports only
T1590.005 1 report reports only
T1591 1 report reports only
T1592.002 1 report reports only
T1595 1 report reports only
T1598 1 report reports only
T1598.003 1 report reports only
T1602 1 report reports only
T1602.001 1 report reports only
T1602.002 1 report reports only
T1608.001 1 report in ATT&CK
T1608.002 1 report reports only
T1608.003 1 report reports only
T1608.004 1 report reports only
T1608.005 1 report reports only
T1608.006 1 report reports only
T1613 1 report reports only
T1614 1 report reports only
T1614.001 1 report reports only
T1615 1 report reports only
T1619 1 report reports only
T1620 1 report reports only
T1652 1 report reports only
T1654 1 report reports only
T1657 1 report reports only
T1659 1 report reports only

Counts come from technique IDs in the actor's report text. “Reports only” means reports name the technique but MITRE ATT&CK® does not list it for this actor.

Also listed by ATT&CK

Show all 18 techniques Show fewer

CVEs named in reports

Show all 303 CVEs Show fewer

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

10 August 2026

UNIT 42 PLAYBOOK VIEWER

date ORKL added it fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor UNIT 42 PLAYBOOK VIEWER
6 August 2026

New Destructive Wiper ZeroCleare Targets Energy Sector in the Middle East

date ORKL added it fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor New Destructive Wiper ZeroCleare Targets Energy Sector in the Middle East
28 July 2026

Cavern Manticore: Exposing Iran-Linked Modular C2 Framework

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Cavern Manticore: Exposing Iran-Linked Modular C2 Framework
24 July 2026

Updated Cyber Threat Actor Naming System

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Updated Cyber Threat Actor Naming System
1 May 2026

Iranian APT group ‘MuddyWater’ Adds Exploits to Their Arsenal – ClearSky Cyber Security

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Iranian APT group ‘MuddyWater’ Adds Exploits to Their Arsenal – ClearSky Cyber Security
29 April 2026

MuddyWater: Snakes by the riverbank

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor MuddyWater: Snakes by the riverbank
29 April 2026

Latest Cyber Threat Intelligence & Security Insights

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Latest Cyber Threat Intelligence & Security Insights
29 April 2026

Latest Cyber Threat Intelligence & Security Insights

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Latest Cyber Threat Intelligence & Security Insights
29 April 2026

Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization
6 April 2026

Tortoiseshell Group Targets IT Providers in Saudi Arabia in Probable Supply Chain Attacks

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Tortoiseshell Group Targets IT Providers in Saudi Arabia in Probable Supply Chain Attacks

Show all 403 reports Show fewer

6 April 2026

Chafer: Latest Attacks Reveal Heightened Ambitions

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Chafer: Latest Attacks Reveal Heightened Ambitions
6 April 2026

Subgroup: [Unnamed group USA] - Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Subgroup: [Unnamed group USA] - Threat Group Cards: A Threat Actor Encyclopedia
6 April 2026

Greenbug’s DNS-isms | NETSCOUT

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Greenbug’s DNS-isms | NETSCOUT
6 April 2026

Unveiling Void Manticore: Structured Collaboration Between Espionage and Destruction in MOIS

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Unveiling Void Manticore: Structured Collaboration Between Espionage and Destruction in MOIS
6 April 2026

APT34 Deploys Phishing Attack With New Malware

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor APT34 Deploys Phishing Attack With New Malware
6 April 2026

Attack Graph Response to US-CERT Alert (AA22-264A)

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Attack Graph Response to US-CERT Alert (AA22-264A)
6 April 2026

Waterbug: Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Waterbug: Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments
6 April 2026

DistTrack (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor DistTrack (Malware Family)
6 April 2026

Helix Kitten

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Helix Kitten
6 April 2026

Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia
6 April 2026

Swallowing the Snake’s Tail: Tracking Turla Infrastructure

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Swallowing the Snake’s Tail: Tracking Turla Infrastructure
6 April 2026

CISA Alert AA22-264A - Iranian HomeLand Justice APT Group's TTPs

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor CISA Alert AA22-264A - Iranian HomeLand Justice APT Group's TTPs
6 April 2026

New Iranian Campaign Tailored to US Companies Utilizes an Updated Toolset

date ORKL added it fromORKL

The original link failed its last check. Original publisher Detailsfor New Iranian Campaign Tailored to US Companies Utilizes an Updated Toolset
6 April 2026

Tortoiseshell Group Targets IT Providers in Saudi Arabia in Probable Supply Chain Attacks

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Tortoiseshell Group Targets IT Providers in Saudi Arabia in Probable Supply Chain Attacks
6 April 2026

Turla Compromises, Infiltrates Iranian APT Infrastructure

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Turla Compromises, Infiltrates Iranian APT Infrastructure
6 April 2026

Examining the Activities of the Turla APT Group

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Examining the Activities of the Turla APT Group
6 April 2026

Five Threat Groups Target Industrial Systems: Dragos

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Five Threat Groups Target Industrial Systems: Dragos
6 April 2026

Iranian State-Sponsored and Aligned Attacks: What You Need to Know and Steps to Protect Yourself | Proofpoint US

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Iranian State-Sponsored and Aligned Attacks: What You Need to Know and Steps to Protect Yourself | Proofpoint US
6 April 2026

What are State Sponsored Cyber Attacks? - Detailed Guide

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor What are State Sponsored Cyber Attacks? - Detailed Guide
6 April 2026

Threat Actor Activity Related to the Iran Conflict

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Threat Actor Activity Related to the Iran Conflict
6 April 2026

Fox Kitten – Widespread Iranian Espionage-Offensive Campaign – ClearSky Cyber Security

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Fox Kitten – Widespread Iranian Espionage-Offensive Campaign – ClearSky Cyber Security
6 April 2026

The Unraveling of an Iranian Cyber Attack Against the Iraqi Government

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor The Unraveling of an Iranian Cyber Attack Against the Iraqi Government
6 April 2026

OilRig Deploys “ALMA Communicator” – DNS Tunneling Trojan

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor OilRig Deploys “ALMA Communicator” – DNS Tunneling Trojan
6 April 2026

Subgroup: Greenbug, Volatile Kitten - Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Subgroup: Greenbug, Volatile Kitten - Threat Group Cards: A Threat Actor Encyclopedia
6 April 2026

OilRig’s persistent attacks using cloud service-powered downloaders

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor OilRig’s persistent attacks using cloud service-powered downloaders
6 April 2026

APT 33, Elfin, Magnallium - Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor APT 33, Elfin, Magnallium - Threat Group Cards: A Threat Actor Encyclopedia
6 April 2026

The Garden of Forking Paths: Sophisticated APTs diversify toolsets

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor The Garden of Forking Paths: Sophisticated APTs diversify toolsets
6 April 2026

OilRig Uses ISMDoor Variant; Possibly Linked to Greenbug Threat Group

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor OilRig Uses ISMDoor Variant; Possibly Linked to Greenbug Threat Group
6 April 2026

OilRig Targets Technology Service Provider and Government Agency with QUADAGENT

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor OilRig Targets Technology Service Provider and Government Agency with QUADAGENT
6 April 2026

OilRig targets a Middle Eastern Government and Adds Evasion Techniques to OopsIE

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor OilRig targets a Middle Eastern Government and Adds Evasion Techniques to OopsIE
6 April 2026

OilRig Actors Provide a Glimpse into Development and Testing Efforts

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor OilRig Actors Provide a Glimpse into Development and Testing Efforts
6 April 2026

Council on Foreign Relations

date ORKL added it fromORKL

The original link failed its last check. Original publisher Detailsfor Council on Foreign Relations
6 April 2026

SCANdalous! (External Detection Using Network Scan Data and Automation) | Mandiant

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor SCANdalous! (External Detection Using Network Scan Data and Automation) | Mandiant
6 April 2026

Crambus: New Campaign Targets Middle Eastern Government

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Crambus: New Campaign Targets Middle Eastern Government
6 April 2026

Breaking the Rules: A Tough Outlook for Home Page Attacks (CVE-2017-11774) | Mandiant

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Breaking the Rules: A Tough Outlook for Home Page Attacks (CVE-2017-11774) | Mandiant
6 April 2026

Definitive Dossier of Devilish Debug Details — Part One: PDB Paths and Malware | Mandiant

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Definitive Dossier of Devilish Debug Details — Part One: PDB Paths and Malware | Mandiant
6 April 2026

Charming Kitten

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Charming Kitten
6 April 2026

Targeted Attacks against Banks in the Middle East

date ORKL added it fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor Targeted Attacks against Banks in the Middle East
6 April 2026

Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia
6 April 2026

TwoFace (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor TwoFace (Malware Family)
6 April 2026

New Iranian hacking tool leaked on Telegram

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor New Iranian hacking tool leaked on Telegram
6 April 2026

Iran Ups its Traditional Cyber Espionage Tradecraft

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Iran Ups its Traditional Cyber Espionage Tradecraft
6 April 2026

CTO at NCSC Summary: week ending October 29th

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor CTO at NCSC Summary: week ending October 29th
6 April 2026

Chafer, APT 39 - Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Chafer, APT 39 - Threat Group Cards: A Threat Actor Encyclopedia
6 April 2026

SpyNote: Spyware with RAT capabilities targeting Financial Institutions

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor SpyNote: Spyware with RAT capabilities targeting Financial Institutions
6 April 2026

Microsoft investigates Iranian attacks against the Albanian government

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Microsoft investigates Iranian attacks against the Albanian government
6 April 2026

OilRig, APT 34, Helix Kitten, Chrysene

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor OilRig, APT 34, Helix Kitten, Chrysene
6 April 2026

Researchers Discover New variants of APT34 Malware

date ORKL added it fromORKL

The original link failed its last check. Original publisher Detailsfor Researchers Discover New variants of APT34 Malware
6 April 2026

What Is DNS Tunneling? [+ Examples & Protection Tips]

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor What Is DNS Tunneling? [+ Examples & Protection Tips]
6 April 2026

BONDUPDATER (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor BONDUPDATER (Malware Family)
6 April 2026

Talks - BrightTALK

date ORKL added it fromORKL

The original link failed its last check. Original publisher Detailsfor Talks - BrightTALK
6 April 2026

The Israel-Hamas War | Cyber Domain State-Sponsored Activity of Interest

date ORKL added it fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor The Israel-Hamas War | Cyber Domain State-Sponsored Activity of Interest
6 April 2026

OilRig Group Steps Up Attacks with New Delivery Documents and New Injector Trojan

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor OilRig Group Steps Up Attacks with New Delivery Documents and New Injector Trojan
6 April 2026

The inside story of the world’s most dangerous malware

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor The inside story of the world’s most dangerous malware
6 April 2026

Report: CIA received more offensive hacking powers in 2018

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Report: CIA received more offensive hacking powers in 2018
11 March 2026

Iran’s Cyber Playbook in the Escalating Regional Conflict

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Iran’s Cyber Playbook in the Escalating Regional Conflict
4 March 2026

Iranian APT Infrastructure in Focus: Mapping State-Aligned Clusters During Geopolitical Escalation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Iranian APT Infrastructure in Focus: Mapping State-Aligned Clusters During Geopolitical Escalation
23 January 2026

SpyNote: Comprehensive Analysis of an Android Remote Access Trojan

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SpyNote: Comprehensive Analysis of an Android Remote Access Trojan
5 June 2025

BladedFeline: Whispering in the dark

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BladedFeline: Whispering in the dark
19 May 2025

AIYA - Mobile malware development book. First edition

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AIYA - Mobile malware development book. First edition
12 May 2025

ESET APT Activity Report Q4 2024-Q1 2025

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET APT Activity Report Q4 2024-Q1 2025
24 April 2025

m-trends-2025-en.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor m-trends-2025-en.pdf
10 April 2025

Newly Registered Domains Distributing SpyNote Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Newly Registered Domains Distributing SpyNote Malware
9 February 2025

Analysis of malicious mobile applications impersonating popular Polish apps — OLX, Allegro, IKO

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis of malicious mobile applications impersonating popular Polish apps — OLX, Allegro, IKO
16 December 2024

IOControl Malware: What’s New, What’s Not?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor IOControl Malware: What’s New, What’s Not?
4 December 2024

Frequent freeloader part I: Secret Blizzard compromising Storm-0156 infrastructure for espionage | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Frequent freeloader part I: Secret Blizzard compromising Storm-0156 infrastructure for espionage | Microsoft Security Blog
21 November 2024

Untitled

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Untitled
20 November 2024

PROSPERO & Proton66: Uncovering the links between bulletproof networks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PROSPERO & Proton66: Uncovering the links between bulletproof networks
11 October 2024

Earth Simnavaz (aka APT34) Levies Advanced Cyberattacks Against Middle East

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Simnavaz (aka APT34) Levies Advanced Cyberattacks Against Middle East
11 October 2024

Earth Simnavaz (aka APT34) Levies Advanced Cyberattacks Against Middle East

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Simnavaz (aka APT34) Levies Advanced Cyberattacks Against Middle East
8 October 2024

Inside a Cybercriminal’s Server: DDoS Tools, Spyware APKs, and Phishing Templates

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Inside a Cybercriminal’s Server: DDoS Tools, Spyware APKs, and Phishing Templates
19 September 2024

UNC1860 and the Temple of Oats: Iran’s Hidden Hand in Middle Eastern Networks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UNC1860 and the Temple of Oats: Iran’s Hidden Hand in Middle Eastern Networks
19 September 2024

UNC1860 and the Temple of Oats: Iran’s Hidden Hand in Middle Eastern Networks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UNC1860 and the Temple of Oats: Iran’s Hidden Hand in Middle Eastern Networks
11 September 2024

Targeted Iranian Attacks Against Iraqi Government Infrastructure - Check Point Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Targeted Iranian Attacks Against Iraqi Government Infrastructure - Check Point Research
14 August 2024

Cryptocurrency Lures & Pupy RAT: UTG-Q-010 Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cryptocurrency Lures & Pupy RAT: UTG-Q-010 Campaign
27 June 2024

Threat Actor Groups Tracked by Palo Alto Networks Unit 42 (Updated Aug. 1, 2025)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Actor Groups Tracked by Palo Alto Networks Unit 42 (Updated Aug. 1, 2025)
26 June 2024

Craxs Rat, the master tool behind fake app scams and banking fraud | Group-IB Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Craxs Rat, the master tool behind fake app scams and banking fraud | Group-IB Blog
20 June 2024

Caught in the Act: Uncovering SpyNote in Unexpected Places

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Caught in the Act: Uncovering SpyNote in Unexpected Places
20 May 2024

Bad Karma, No Justice: Void Manticore Destructive Activities in Israel

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bad Karma, No Justice: Void Manticore Destructive Activities in Israel
13 May 2024

ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilities

file creation date fromORKL

Archived copy on ORKL Detailsfor ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilities
4 April 2024

DarkBeatC2: The Latest MuddyWater Attack Framework

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DarkBeatC2: The Latest MuddyWater Attack Framework
2 April 2024

APT and financial attacks on industrial organizations in H2 2023 | Kaspersky ICS CERT EN

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT and financial attacks on industrial organizations in H2 2023 | Kaspersky ICS CERT EN
19 February 2024

Android/SpyNote bypasses Restricted Settings + breaks many RE tools

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Android/SpyNote bypasses Restricted Settings + breaks many RE tools
15 February 2024

watchtower-2023-eoy-report-en

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor watchtower-2023-eoy-report-en
15 February 2024

Android/SpyNote Moves to Crypto Currencies | FortiGuard Lab

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Android/SpyNote Moves to Crypto Currencies | FortiGuard Lab
14 December 2023

OilRig's persistent attacks using cloud service-powered downloaders

date in the CCS '25 data ESET fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor OilRig's persistent attacks using cloud service-powered downloaders
12 December 2023

From Albania To The Middle East: The Scarred Manticore Is Listening

file creation date Checkpoint fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor From Albania To The Middle East: The Scarred Manticore Is Listening
1 December 2023

Monthly news - December 2023

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Monthly news - December 2023
31 October 2023

From Albania to the Middle East_ The Scarred Manticore is Listening - Check Point Research

date in the CCS '25 data Check Point fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor From Albania to the Middle East_ The Scarred Manticore is Listening - Check Point Research
31 October 2023

From Albania to the Middle East: The Scarred Manticore is Listening

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From Albania to the Middle East: The Scarred Manticore is Listening
26 October 2023

ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilities

Malpedia library date ESET fromORKLCCS '25 data

Archived copy on ORKL Detailsfor ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilities
24 October 2023

The Israel-Hamas War | Cyber Domain State-Sponsored Activity of Interest

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Israel-Hamas War | Cyber Domain State-Sponsored Activity of Interest
19 October 2023

Crambus: New Campaign Targets Middle Eastern Government

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Crambus: New Campaign Targets Middle Eastern Government
21 September 2023

OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes
30 August 2023

APT34 Unleashes New Wave of Phishing Attack with Variant of SideTwist Trojan - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.

Malpedia library date NSFOCUS fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT34 Unleashes New Wave of Phishing Attack with Variant of SideTwist Trojan - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.
31 July 2023

SpyNote continues to attack financial institutions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SpyNote continues to attack financial institutions
7 June 2023

Analysis and Reversing of srvnet2.sys

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis and Reversing of srvnet2.sys
5 June 2023

Iran Cyber Threat Overview

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Iran Cyber Threat Overview
10 May 2023

SpyNote targets IRCTC users

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SpyNote targets IRCTC users
6 February 2023

Collect, Exfiltrate, Sleep, Repeat

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Collect, Exfiltrate, Sleep, Repeat
2 February 2023

New APT34 Malware Targets The Middle East

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor New APT34 Malware Targets The Middle East
2 February 2023

New APT34 Malware Targets The Middle East

date in the CCS '25 data Trendmicro fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor New APT34 Malware Targets The Middle East
2 February 2023

New APT34 Malware Targets The Middle East

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New APT34 Malware Targets The Middle East
5 January 2023

SpyNote Android malware infections surge after source code leak

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SpyNote Android malware infections surge after source code leak
5 January 2023

SpyNote: Spyware with RAT capabilities targeting Financial Institutions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SpyNote: Spyware with RAT capabilities targeting Financial Institutions
4 January 2023

Pupy RAT hiding under WerFault’s cover

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Pupy RAT hiding under WerFault’s cover
27 September 2022

More Than Meets the Eye: Exposing a Polyglot File That Delivers IcedID

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor More Than Meets the Eye: Exposing a Polyglot File That Delivers IcedID
27 September 2022

More Than Meets the Eye- Exposing a Polyglot File That Delivers IcedID

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor More Than Meets the Eye- Exposing a Polyglot File That Delivers IcedID
26 September 2022

The Anatomy of Wiper Malware, Part 3: Input/Output Controls | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Anatomy of Wiper Malware, Part 3: Input/Output Controls | CrowdStrike
8 September 2022

Microsoft investigates Iranian attacks against the Albanian government | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft investigates Iranian attacks against the Albanian government | Microsoft Security Blog
8 September 2022

Microsoft investigates Iranian attacks against the Albanian government

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Microsoft investigates Iranian attacks against the Albanian government
12 August 2022

The Anatomy of Wiper Malware, Part 1: Common Techniques | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Anatomy of Wiper Malware, Part 1: Common Techniques | CrowdStrike
10 August 2022

SpyNote – An Android Snooper

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SpyNote – An Android Snooper
4 August 2022

Advanced Persistent Threats (APTs)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Advanced Persistent Threats (APTs)
29 July 2022

APT trends report Q2 2020

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT trends report Q2 2020
25 July 2022

Burned and Blinded - Escalation Risks of Intelligence Loss from Countercyber Operations in Crisis

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Burned and Blinded - Escalation Risks of Intelligence Loss from Countercyber Operations in Crisis
24 June 2022

APT34 - Saitama Agent

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT34 - Saitama Agent
24 June 2022

APT34 - Saitama Agent

Malpedia library date XJunior fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT34 - Saitama Agent
15 June 2022

DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach
13 June 2022

Translating Saitama's DNS tunneling messages - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Translating Saitama's DNS tunneling messages - SANS ISC
13 June 2022

Translating Saitama's DNS tunneling messages

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Translating Saitama's DNS tunneling messages
31 May 2022

THALES%20THREAT%20HANDBOOK%202022%20Light%20Version_1.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor THALES%20THREAT%20HANDBOOK%202022%20Light%20Version_1.pdf
26 May 2022

eset_threat_report_t12022

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor eset_threat_report_t12022
23 May 2022

Operation Earth Berberoka: An Analysis of a Multivector and Multiplatform APT Campaign Targeting Online Gambling Sites

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Earth Berberoka: An Analysis of a Multivector and Multiplatform APT Campaign Targeting Online Gambling Sites
11 May 2022

Please Confirm You Received Our APT

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Please Confirm You Received Our APT
11 May 2022

Please Confirm You Received Our APT | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Please Confirm You Received Our APT | FortiGuard Labs
10 May 2022

APT34 targets Jordan Government using new Saitama backdoor

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT34 targets Jordan Government using new Saitama backdoor
10 May 2022

APT34 targets Jordan Government using new Saitama backdoor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT34 targets Jordan Government using new Saitama backdoor
28 April 2022

An Overview of the Increasing Wiper Malware Threat | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor An Overview of the Increasing Wiper Malware Threat | FortiGuard Labs
27 April 2022

https://documents.trendmicro.com/assets/txt/earth-berberoka-linux-iocs-2.txt

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor https://documents.trendmicro.com/assets/txt/earth-berberoka-linux-iocs-2.txt
30 March 2022

Social Engineering Remains Key Tradecraft for Iranian APTs

Malpedia library date Insikt Group® fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Social Engineering Remains Key Tradecraft for Iranian APTs
30 March 2022

Social Engineering Remains Key Tradecraft for Iranian APTs

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Social Engineering Remains Key Tradecraft for Iranian APTs
25 March 2022

Dragos_Intel_WP_InitAccess-IndEnvirons-Final.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dragos_Intel_WP_InitAccess-IndEnvirons-Final.pdf
8 March 2022

Cylera%20Labs%20Kwampirs%20Shamoon%20Technical%20Report.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cylera%20Labs%20Kwampirs%20Shamoon%20Technical%20Report.pdf
9 February 2022

eset_threat_report_t32021.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eset_threat_report_t32021.pdf
9 February 2022

Iranian Hackers Using New Marlin Backdoor in 'Out to Sea' Espionage Campaign

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Iranian Hackers Using New Marlin Backdoor in 'Out to Sea' Espionage Campaign
8 February 2022

eset_threat_report_t32021

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor eset_threat_report_t32021
14 December 2021

Full Spectrum Detections for 5 Popular Web Shells: Alfa, SharPyShell, Krypton, ASPXSpy, and TWOFACE

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Full Spectrum Detections for 5 Popular Web Shells: Alfa, SharPyShell, Krypton, ASPXSpy, and TWOFACE
29 November 2021

WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019
16 November 2021

Evolving trends in Iranian threat actor activity – MSTIC presentation at CyberWarCon 2021 | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Evolving trends in Iranian threat actor activity – MSTIC presentation at CyberWarCon 2021 | Microsoft Security Blog
16 November 2021

Evolving trends in Iranian threat actor activity – MSTIC presentation at CyberWarCon 2021

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Evolving trends in Iranian threat actor activity – MSTIC presentation at CyberWarCon 2021
15 October 2021

Global_APT_Research_Report_for_the_first_half_of_2021-360

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Global_APT_Research_Report_for_the_first_half_of_2021-360
7 October 2021

VB2021 paper: Lyceum reborn: counterintelligence in the Middle East

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor VB2021 paper: Lyceum reborn: counterintelligence in the Middle East
30 September 2021

Masters of Mimicry: new APT group ChamelGang and its arsenal

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Masters of Mimicry: new APT group ChamelGang and its arsenal
21 September 2021

Capturing and Detecting AndroidTester Remote Access Trojan with the Emergency VPN — Civilsphere

Malpedia library date civilsphereproject fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Capturing and Detecting AndroidTester Remote Access Trojan with the Emergency VPN — Civilsphere
2 September 2021

Advanced Persistent Threats (APTs)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Advanced Persistent Threats (APTs)
20 August 2021

An Overview of FinTech Threat Landscape

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor An Overview of FinTech Threat Landscape
17 August 2021

Pay2Kitten report

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Pay2Kitten report
20 July 2021

Ongoing Campaign Leveraging Exchange Vulnerability Potentially Linked to Iran

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Ongoing Campaign Leveraging Exchange Vulnerability Potentially Linked to Iran
13 July 2021

Attacks Against the Government Sector (White Paper)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attacks Against the Government Sector (White Paper)
2 July 2021

Geopolitical nation-state threat actor overview June 2021

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Geopolitical nation-state threat actor overview June 2021
8 June 2021

The blurry boundaries between nation-state actors and the cybercrime underground

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The blurry boundaries between nation-state actors and the cybercrime underground
25 May 2021

mtrends-2018.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor mtrends-2018.pdf
6 May 2021

Iran Cyber Operations Groups

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Iran Cyber Operations Groups
22 April 2021

Prometei Botnet Exploiting Microsoft Exchange Vulnerabilities

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Prometei Botnet Exploiting Microsoft Exchange Vulnerabilities
22 April 2021

Prometei Botnet Exploiting Microsoft Exchange Vulnerabilities

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Prometei Botnet Exploiting Microsoft Exchange Vulnerabilities
21 April 2021

Taking Action Against Hackers in Palestine

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Taking Action Against Hackers in Palestine
8 April 2021

Iran’s APT34 Returns with an Updated Arsenal

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Iran’s APT34 Returns with an Updated Arsenal
8 April 2021

Iran’s APT34 Returns with an Updated Arsenal - Check Point Research

date in the CCS '25 data Check Point fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Iran’s APT34 Returns with an Updated Arsenal - Check Point Research
8 April 2021

Iran’s APT34 Returns with an Updated Arsenal - Check Point Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Iran’s APT34 Returns with an Updated Arsenal - Check Point Research
28 February 2021

Cyber Threats 2020: A Year in Retrospect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Threats 2020: A Year in Retrospect
24 February 2021

LazyScripter

Malpedia library date Malwarebytes fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor LazyScripter
23 February 2021

Report2021GTR.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Report2021GTR.pdf
23 February 2021

The_CrowdStrike_2021_Global_Threat_Report

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The_CrowdStrike_2021_Global_Threat_Report
18 February 2021

https---www.ptsecurity.com-ww-en-analytics-antisandbox-techniques-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor https---www.ptsecurity.com-ww-en-analytics-antisandbox-techniques-
18 February 2021

Analytics

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Analytics
7 January 2021

Adversary Infrustructure Report 2020 - A Defender's View

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Adversary Infrustructure Report 2020 - A Defender's View
7 January 2021

SolarWinds- How a Rare DGA Helped Attacker Communications Fly Under the Radar

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor SolarWinds- How a Rare DGA Helped Attacker Communications Fly Under the Radar
7 January 2021

SolarWinds: How a Rare DGA Helped Attacker Communications Fly Under the Radar

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SolarWinds: How a Rare DGA Helped Attacker Communications Fly Under the Radar
10 December 2020

No pandas, just people: The current state of China’s cybercrime underground

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor No pandas, just people: The current state of China’s cybercrime underground
8 December 2020

Identifying Critical Infrastructure Targeting through Network Creation

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Identifying Critical Infrastructure Targeting through Network Creation
3 December 2020

ATR_82599

date in the CCS '25 data Telsy fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ATR_82599
1 December 2020

奇安信威胁情报中心

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 奇安信威胁情报中心
27 November 2020

Investigation with a twist: an accidental APT attack and averted data destruction

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Investigation with a twist: an accidental APT attack and averted data destruction
23 November 2020

Group-IB_Hi-Tech_Crime_Trends_2020-2021_en

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Group-IB_Hi-Tech_Crime_Trends_2020-2021_en
12 November 2020

Dragos_Manufacturing%20Threat%20Perspective_1120.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dragos_Manufacturing%20Threat%20Perspective_1120.pdf
15 September 2020

Report2020OverWatchNowheretoHide.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Report2020OverWatchNowheretoHide.pdf
1 September 2020

Iranian hackers are selling access to compromised companies on an underground forum

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Iranian hackers are selling access to compromised companies on an underground forum
1 September 2020

Iranian hackers are selling access to compromised companies on an underground forum

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Iranian hackers are selling access to compromised companies on an underground forum
10 August 2020

FBI says an Iranian hacking group is attacking F5 networking devices

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor FBI says an Iranian hacking group is attacking F5 networking devices
10 August 2020

FBI says an Iranian hacking group is attacking F5 networking devices

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor FBI says an Iranian hacking group is attacking F5 networking devices
31 July 2020

APT_trends_report_Q2_2020_Securelist

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT_trends_report_Q2_2020_Securelist
29 July 2020

APT trends report Q2 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q2 2020
29 July 2020

APT trends report Q2 2020

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT trends report Q2 2020
22 July 2020

OilRig Targets Middle Eastern Telecommunications Organization and Adds Novel C2 Channel with Steganography to Its Inventory

date in the CCS '25 data Palo Alto fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor OilRig Targets Middle Eastern Telecommunications Organization and Adds Novel C2 Channel with Steganography to Its Inventory
22 July 2020

OilRig Targets Middle Eastern Telecommunications Organization and Adds Novel C2 Channel with Steganography to Its Inventory

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor OilRig Targets Middle Eastern Telecommunications Organization and Adds Novel C2 Channel with Steganography to Its Inventory
22 July 2020

OilRig APT Drills into Malware Innovation with Unique Backdoor

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor OilRig APT Drills into Malware Innovation with Unique Backdoor
22 July 2020

OilRig APT Drills into Malware Innovation with Unique Backdoor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OilRig APT Drills into Malware Innovation with Unique Backdoor
22 July 2020

OilRig Targets Middle Eastern Telecommunications Organization and Adds Novel C2 Channel with Steganography to Its Inventory

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OilRig Targets Middle Eastern Telecommunications Organization and Adds Novel C2 Channel with Steganography to Its Inventory
15 July 2020

An in-depth analysis of SpyNote remote access trojan

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor An in-depth analysis of SpyNote remote access trojan
13 July 2020

SCANdalous! (External Detection Using Network Scan Data and Automation)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor SCANdalous! (External Detection Using Network Scan Data and Automation)
13 July 2020

SCANdalous! (External Detection Using Network Scan Data and Automation) | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SCANdalous! (External Detection Using Network Scan Data and Automation) | Mandiant
28 June 2020

0628-2020APT上半年报告-画册

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 0628-2020APT上半年报告-画册
28 May 2020

Suspected Naikon DGA Domains

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Suspected Naikon DGA Domains
26 May 2020

ESET_Turla_ComRAT

Malpedia library date ESET fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ESET_Turla_ComRAT
19 May 2020

Sophisticated Espionage Group Turns Attention to Telecom Providers in South Asia _ Symantec Blogs

date in the CCS '25 data Symantec fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Sophisticated Espionage Group Turns Attention to Telecom Providers in South Asia _ Symantec Blogs
19 May 2020

Sophisticated Espionage Group Turns Attention to Telecom Providers in South Asia

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Sophisticated Espionage Group Turns Attention to Telecom Providers in South Asia
19 May 2020

Sophisticated Espionage Group Turns Attention to Telecom Providers in South Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sophisticated Espionage Group Turns Attention to Telecom Providers in South Asia
31 March 2020

Storm Cloud Unleashed: Tibetan Focus of Highly Targeted Fake Flash Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Storm Cloud Unleashed: Tibetan Focus of Highly Targeted Fake Flash Campaign
12 March 2020

Swallowing the Snake's Tail: Tracking Turla Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Swallowing the Snake's Tail: Tracking Turla Infrastructure
4 March 2020

Report2020CrowdStrikeGlobalThreatReport

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Report2020CrowdStrikeGlobalThreatReport
3 March 2020

Cyber Threats 2019: A Year in Retrospect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Threats 2019: A Year in Retrospect
3 March 2020

The North Korean Kimsuky APT keeps threatening South Korea evolving its TTPs

date in the CCS '25 data Yoroi fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The North Korean Kimsuky APT keeps threatening South Korea evolving its TTPs
2 March 2020

apt34-aka-oilrig-attacks-lebanon-government-entities-with-maildropper-implant

date in the CCS '25 data Telsy fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor apt34-aka-oilrig-attacks-lebanon-government-entities-with-maildropper-implant
2 March 2020

Karkoff 2020- a new APT34 espionage operation involves Lebanon Government

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Karkoff 2020- a new APT34 espionage operation involves Lebanon Government
2 March 2020

Karkoff 2020 a new APT34 espionage operation involves Lebanon Government

date in the CCS '25 data Yoroi fromCCS '25 data

The original link failed its last check. Detailsfor Karkoff 2020 a new APT34 espionage operation involves Lebanon Government
24 February 2020

The ICS Threat Landscape and Activity Groups

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor The ICS Threat Landscape and Activity Groups
17 February 2020

Fox Kittens report 16.2.2020

date in the CCS '25 data ClearSky Cyber Security ltd fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Fox Kittens report 16.2.2020
16 February 2020

Fox Kittens report 18.2.2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Fox Kittens report 18.2.2020
13 February 2020

2020.02.22_APT_threat_report_2019_CN_version

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 2020.02.22_APT_threat_report_2019_CN_version
30 January 2020

New Iranian Campaign Tailored to US Companies Utilizes an Updated Toolset

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New Iranian Campaign Tailored to US Companies Utilizes an Updated Toolset
27 January 2020

xHunt Campaign- New Watering Hole Identified for Credential Harvesting

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor xHunt Campaign- New Watering Hole Identified for Credential Harvesting
24 January 2020

Current Iran-Associated Cyber Threats

file creation date Symantec fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Current Iran-Associated Cyber Threats
23 January 2020

European Energy Sector Organization Targeted by PupyRAT Malware in Late 2019

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor European Energy Sector Organization Targeted by PupyRAT Malware in Late 2019
22 January 2020

IBM X-Force IRIS ZeroCleare - Tehcnical Paper

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor IBM X-Force IRIS ZeroCleare - Tehcnical Paper
15 January 2020

Iranian Threat Actors- Preliminary Analysis

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Iranian Threat Actors- Preliminary Analysis
14 January 2020

Iranian Cyber Response to Death of IRGC Head Would Likely Use Reported TTPs and Previous Access

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Iranian Cyber Response to Death of IRGC Head Would Likely Use Reported TTPs and Previous Access
1 January 2020

North American Electric Cyber Threat Perspective

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor North American Electric Cyber Threat Perspective
12 December 2019

Drilling Deep: A Look at Cyberattacks on the Oil and Gas Industry

date in the CCS '25 data Trend Micro fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Drilling Deep: A Look at Cyberattacks on the Oil and Gas Industry
9 December 2019

Group-IB_Hi-Tech_Crime_Trends_2019-2020_en

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Group-IB_Hi-Tech_Crime_Trends_2019-2020_en
4 December 2019

Microsoft Word - New Destructive Wiper ZeroCleare v1 MLM comments.docx

date in the CCS '25 data IBM Security fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Microsoft Word - New Destructive Wiper ZeroCleare v1 MLM comments.docx
4 December 2019

APT review: what the world’s threat actors got up to in 2019

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT review: what the world’s threat actors got up to in 2019
29 November 2019

Group-IB_Hi-Tech_Crime_Trends_2019-2020

date in the CCS '25 data Group-IB fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Group-IB_Hi-Tech_Crime_Trends_2019-2020
9 November 2019

APT34 Event Analysis Report

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT34 Event Analysis Report
9 November 2019

APT34 Event Analysis Report - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.

Malpedia library date NSFOCUS fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT34 Event Analysis Report - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.
22 October 2019

NSA_CSA_Turla_20191021%20ver%204%20-%20nsa.gov.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor NSA_CSA_Turla_20191021%20ver%204%20-%20nsa.gov.pdf
21 October 2019

Advisory: Turla group exploits Iranian APT to expand coverage of victims

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Advisory: Turla group exploits Iranian APT to expand coverage of victims
16 October 2019

APT trends report Q3 2019

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q3 2019
16 October 2019

ReverseEngineering_SecurityReport_EN_2019.10.16-2.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor ReverseEngineering_SecurityReport_EN_2019.10.16-2.pdf
23 September 2019

xHunt Campaign- Attacks on Kuwait Shipping and Transportation Organizations

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor xHunt Campaign- Attacks on Kuwait Shipping and Transportation Organizations
23 September 2019

xHunt Campaign: Attacks on Kuwait Shipping and Transportation Organizations

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor xHunt Campaign: Attacks on Kuwait Shipping and Transportation Organizations
18 September 2019

Chirp of the PoisonFrog

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Chirp of the PoisonFrog
18 September 2019

Tortoiseshell Group Targets IT Providers in Saudi Arabia in Probable Supply Chain Attacks

date in the CCS '25 data Symantec fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Tortoiseshell Group Targets IT Providers in Saudi Arabia in Probable Supply Chain Attacks
18 September 2019

Tortoiseshell Group Targets IT Providers in Saudi Arabia in Probable Supply Chain Attacks

file creation date Symantec fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Tortoiseshell Group Targets IT Providers in Saudi Arabia in Probable Supply Chain Attacks
18 September 2019

Tortoiseshell Group Targets IT Providers in Saudi Arabia in Probable Supply Chain Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tortoiseshell Group Targets IT Providers in Saudi Arabia in Probable Supply Chain Attacks
18 September 2019

Tortoiseshell Group Targets IT Providers in Saudi Arabia in Probable Supply Chain Attacks

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Tortoiseshell Group Targets IT Providers in Saudi Arabia in Probable Supply Chain Attacks
27 August 2019

LYCEUM Takes Center Stage in Middle East Campaign

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor LYCEUM Takes Center Stage in Middle East Campaign
27 August 2019

Cyber Threat Group LYCEUM Takes Center Stage in Middle East Campaign

date in the CCS '25 data SecureWorks fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Cyber Threat Group LYCEUM Takes Center Stage in Middle East Campaign
22 August 2019

APT34- The Helix Kitten Cybercriminal Group Loves to Meow Middle Eastern and International Organizations

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT34- The Helix Kitten Cybercriminal Group Loves to Meow Middle Eastern and International Organizations
22 August 2019

GitHub - n1nj4sec/pupy: Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) C2 and post-exploitation framework written in python and C

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GitHub - n1nj4sec/pupy: Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) C2 and post-exploitation framework written in python and C
22 August 2019

APT34: The Helix Kitten Cybercriminal Group Loves to Meow Middle Eastern and International Organizations

Malpedia library date Cyware fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT34: The Helix Kitten Cybercriminal Group Loves to Meow Middle Eastern and International Organizations
8 August 2019

APT_trends_report_Q2_2019_Securelist

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT_trends_report_Q2_2019_Securelist
1 August 2019

APT trends report Q2 2019

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q2 2019
1 August 2019

APT trends report Q2 2019

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT trends report Q2 2019
1 August 2019

Dragos - Global Oil and Gas Cyber Threat Perspctive

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Dragos - Global Oil and Gas Cyber Threat Perspctive
1 August 2019

ClearSky-2019-H1-Cyber-Events-Summary-Report.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ClearSky-2019-H1-Cyber-Events-Summary-Report.pdf
19 July 2019

Hard Pass_ Declining APT34’s Invite to Join Their Professional Network

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Hard Pass_ Declining APT34’s Invite to Join Their Professional Network
18 July 2019

Hard Pass: Declining APT34's Invite to Join Their Professional Network | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hard Pass: Declining APT34's Invite to Join Their Professional Network | Mandiant
18 July 2019

Hard Pass- Declining APT34’s Invite to Join Their Professional Network

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Hard Pass- Declining APT34’s Invite to Join Their Professional Network
18 July 2019

Hard Pass: Declining APT34's Invite to Join Their Professional Network

date in the CCS '25 data FireEye fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Hard Pass: Declining APT34's Invite to Join Their Professional Network
24 June 2019

Threat Group Cards: A Threat Actor Encyclopedia

file creation date ThaiCERT fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Threat Group Cards: A Threat Actor Encyclopedia
21 June 2019

Waterbug_ Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Waterbug_ Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments
20 June 2019

Waterbug: Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Waterbug: Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments
20 June 2019

Waterbug- Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Waterbug- Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments
20 June 2019

Waterbug: Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments

date in the CCS '25 data Symantec fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Waterbug: Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments
16 June 2019

APT34 Tools Leak

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT34 Tools Leak
12 June 2019

Threat Group Cards: A Threat Actor Encyclopedia

file creation date Martijn van der Heide fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia
6 June 2019

APT34- Jason project

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT34- Jason project
6 June 2019

APT34 Jason project

date in the CCS '25 data Marco Ramilli's Blog fromCCS '25 data

The original link failed its last check. Detailsfor APT34 Jason project
29 May 2019

Catching fish in muddy waters | Group-IB Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Catching fish in muddy waters | Group-IB Blog
9 May 2019

New leaks of Iranian cyber-espionage operations hit Telegram and the Dark Web

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New leaks of Iranian cyber-espionage operations hit Telegram and the Dark Web
9 May 2019

New leaks of Iranian cyber-espionage operations hit Telegram and the Dark Web

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New leaks of Iranian cyber-espionage operations hit Telegram and the Dark Web
2 May 2019

APT34- Glimpse project

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT34- Glimpse project
2 May 2019

APT34 Glimpse project

date in the CCS '25 data Marco Ramilli's Blog fromCCS '25 data

Detailsfor APT34 Glimpse project
30 April 2019

Raw Threat Intelligence 2019-04-30- Oilrig data dump link analysis

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Raw Threat Intelligence 2019-04-30- Oilrig data dump link analysis
30 April 2019

Behind the Scenes with OilRig

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Behind the Scenes with OilRig
30 April 2019

Behind the Scenes with OilRig

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Behind the Scenes with OilRig
23 April 2019

APT34- webmask project

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT34- webmask project
23 April 2019

DNSpionage brings out the Karkoff

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DNSpionage brings out the Karkoff
23 April 2019

DNSpionage brings out the Karkoff

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor DNSpionage brings out the Karkoff
23 April 2019

APT34 webmask project

date in the CCS '25 data Marco Ramilli's Blog fromCCS '25 data

The original link failed its last check. Detailsfor APT34 webmask project
19 April 2019

Hacking (Back) and Influence Operations

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Hacking (Back) and Influence Operations
17 April 2019

Source code of Iranian cyber-espionage tools leaked on Telegram

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Source code of Iranian cyber-espionage tools leaked on Telegram
16 April 2019

DNS Tunneling in the Wild: Overview of OilRig’s DNS Tunneling

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DNS Tunneling in the Wild: Overview of OilRig’s DNS Tunneling
16 April 2019

DNS Tunneling in the Wild- Overview of OilRig’s DNS Tunneling

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor DNS Tunneling in the Wild- Overview of OilRig’s DNS Tunneling
10 April 2019

rpt-mtrends-2019.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor rpt-mtrends-2019.pdf
27 March 2019

Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.
27 March 2019

Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.
13 March 2019

Report2019GlobalThreatReport

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Report2019GlobalThreatReport
12 March 2019

APT Trends report Q2 2017

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT Trends report Q2 2017
4 March 2019

New Python-Based Payload MechaFlounder Used by Chafer

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Python-Based Payload MechaFlounder Used by Chafer
4 March 2019

New Python-Based Payload MechaFlounder Used by Chafer

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New Python-Based Payload MechaFlounder Used by Chafer
3 March 2019

rpt-mtrends-2019

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor rpt-mtrends-2019
27 February 2019

SECR_001_EN-1901%20-%20NETSCOUT%20Threat%20Intelligence%20Report%202H%202018.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor SECR_001_EN-1901%20-%20NETSCOUT%20Threat%20Intelligence%20Report%202H%202018.pdf
20 February 2019

CrowdStrike_GTR_2019.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor CrowdStrike_GTR_2019.pdf
18 February 2019

CrowdStrike_GTR_2019_.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor CrowdStrike_GTR_2019_.pdf
18 February 2019

yir-ics-activity-groups-threat-landscape-2018.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor yir-ics-activity-groups-threat-landscape-2018.pdf
12 February 2019

2019.01.03.Tencent_APT_Summary_report_2018_CN_Version

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 2019.01.03.Tencent_APT_Summary_report_2018_CN_Version
12 February 2019

2018 Master Table

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 2018 Master Table
29 January 2019

APT39 | Iranian Threat Group Focused on Personal Information

Malpedia library date FireEye fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT39 | Iranian Threat Group Focused on Personal Information
29 January 2019

APT39- An Iranian Cyber Espionage Group Focused on Personal Information

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT39- An Iranian Cyber Espionage Group Focused on Personal Information
7 January 2019

The APT Chronicles_December 2018 edition

date in the CCS '25 data FireEye fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The APT Chronicles_December 2018 edition
21 December 2018

OVERRULED: Containing a Potentially Destructive Adversary | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OVERRULED: Containing a Potentially Destructive Adversary | Mandiant
27 November 2018

Helix Kitten | Threat Actor Profile | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Helix Kitten | Threat Actor Profile | CrowdStrike
27 November 2018

Meet CrowdStrike’s Adversary of the Month for November- HELIX KITTEN

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Meet CrowdStrike’s Adversary of the Month for November- HELIX KITTEN
16 November 2018

Analyzing OilRig's Ops Tempo from Testing to Weaponization to Delivery

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing OilRig's Ops Tempo from Testing to Weaponization to Delivery
16 November 2018

Analyzing OilRig’s Ops Tempo from Testing to Weaponization to Delivery

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Analyzing OilRig’s Ops Tempo from Testing to Weaponization to Delivery
12 October 2018

CDS2018-Technical-S3-You've Got Mail_clean

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor CDS2018-Technical-S3-You've Got Mail_clean
14 September 2018

Tunneling Under the Sands

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Tunneling Under the Sands
14 September 2018

Tunneling Under the Sands

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tunneling Under the Sands
12 September 2018

OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government
12 September 2018

OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government
12 September 2018

OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government
4 September 2018

OilRig Targets a Middle Eastern Government and Adds Evasion Techniques to OopsIE - Palo Alto Networks Blog

date in the CCS '25 data Palo Alto fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor OilRig Targets a Middle Eastern Government and Adds Evasion Techniques to OopsIE - Palo Alto Networks Blog
30 August 2018

HITB-SG-2018-E - In the trails of WINDSHIFT [Autosaved]

date in the CCS '25 data Bellingcat fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor HITB-SG-2018-E - In the trails of WINDSHIFT [Autosaved]
14 August 2018

Area-1-Security-OperationDoos-IRN2%20Targets%20Saudi%20Arabian%20Oil%20and%20Gas%20Industry%20With%20Career-Themed%20Phishing%20Attack.pdf?utm_source=external%20share&utm_email=asset&utm_campaign=report&utm_content=operationdoos

file creation date fromORKL

Archived copy on ORKL Detailsfor Area-1-Security-OperationDoos-IRN2%20Targets%20Saudi%20Arabian%20Oil%20and%20Gas%20Industry%20With%20Career-Themed%20Phishing%20Attack.pdf?utm_source=external%20share&utm_email=asset&utm_campaign=report&utm_content=operationdoos
2 August 2018

Accenture-Cyber-Threatscape-Report-2018.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor Accenture-Cyber-Threatscape-Report-2018.pdf
25 July 2018

OilRig Targets Technology Service Provider and Government Agency with QUADAGENT

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor OilRig Targets Technology Service Provider and Government Agency with QUADAGENT
25 July 2018

OilRig Targets Technology Service Provider and Government Agency with QUADAGENT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OilRig Targets Technology Service Provider and Government Agency with QUADAGENT
6 June 2018

Clearsky-Iranian-APT-group-%E2%80%98MuddyWater%E2%80%99-Adds-Exploits-to-Their-Arsenal.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Clearsky-Iranian-APT-group-%E2%80%98MuddyWater%E2%80%99-Adds-Exploits-to-Their-Arsenal.pdf
1 May 2018

M-Trends Overview

Malpedia library date Marco Rottigni fromORKL

Archived copy on ORKL Detailsfor M-Trends Overview
25 April 2018

M-TRENDS2018

file creation date FireEye fromORKL

Archived copy on ORKL Detailsfor M-TRENDS2018
20 April 2018

Researchers Discover New variants of APT34 Malware

Malpedia library date Booz Allen Hamilton fromORKLCCS '25 data

The original link failed its last check. Original publisher Detailsfor Researchers Discover New variants of APT34 Malware
20 April 2018

Researchers Discover New variants of APT34 Malware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Researchers Discover New variants of APT34 Malware
1 March 2018

Report2018GlobalThreatReport.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor Report2018GlobalThreatReport.pdf
1 March 2018

Industrial Control System Threats

Malpedia library date Dragos fromORKL

The original link failed its last check. Original publisher Detailsfor Industrial Control System Threats
28 February 2018

Chafer: Latest Attacks Reveal Heightened Ambitions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chafer: Latest Attacks Reveal Heightened Ambitions
28 February 2018

Chafer: Latest Attacks Reveal Heightened Ambitions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chafer: Latest Attacks Reveal Heightened Ambitions
28 February 2018

Chafer_ Latest Attacks Reveal Heightened Ambitions _ Symantec Blogs

date in the CCS '25 data Symantec fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Chafer_ Latest Attacks Reveal Heightened Ambitions _ Symantec Blogs
28 February 2018

Chafer- Latest Attacks Reveal Heightened Ambitions

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Chafer- Latest Attacks Reveal Heightened Ambitions
23 February 2018

OopsIE! OilRig Uses ThreeDollars to Deliver New Trojan

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor OopsIE! OilRig Uses ThreeDollars to Deliver New Trojan
23 February 2018

OopsIE! OilRig Uses ThreeDollars to Deliver New Trojan

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OopsIE! OilRig Uses ThreeDollars to Deliver New Trojan
23 February 2018

OopsIE! OilRig Uses ThreeDollars to Deliver New Trojan

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OopsIE! OilRig Uses ThreeDollars to Deliver New Trojan
29 January 2018

unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east
25 January 2018

OilRig uses RGDoor IIS Backdoor on Targets in the Middle East

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OilRig uses RGDoor IIS Backdoor on Targets in the Middle East
25 January 2018

OilRig uses RGDoor IIS Backdoor on Targets in the Middle East

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor OilRig uses RGDoor IIS Backdoor on Targets in the Middle East
25 January 2018

OilRig uses RGDoor IIS Backdoor on Targets in the Middle East

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OilRig uses RGDoor IIS Backdoor on Targets in the Middle East
17 January 2018

Sorry - the page you're looking for has been removed

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sorry - the page you're looking for has been removed
4 January 2018

Iran’s Cyber Ecosystem- Who Are the Threat Actors-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Iran’s Cyber Ecosystem- Who Are the Threat Actors-
19 December 2017

Iran_Cyber_Final_Full_v2

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Iran_Cyber_Final_Full_v2
15 December 2017

Introducing the Adversary Playbook- First up, OilRig

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Introducing the Adversary Playbook- First up, OilRig
15 December 2017

Introducing the Adversary Playbook: First up, OilRig

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Introducing the Adversary Playbook: First up, OilRig
11 December 2017

OilRig Performs Tests on the TwoFace Webshell

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OilRig Performs Tests on the TwoFace Webshell
11 December 2017

OilRig Performs Tests on the TwoFace Webshell

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor OilRig Performs Tests on the TwoFace Webshell
7 December 2017

New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit
7 December 2017

New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit « New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit | FireEye Inc

date in the CCS '25 data FireEye fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit « New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit | FireEye Inc
7 December 2017

New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit
1 December 2017

Advanced Persistent Threat Groups

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Advanced Persistent Threat Groups
22 November 2017

A dive into MuddyWater APT targeting Middle-East

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor A dive into MuddyWater APT targeting Middle-East
8 November 2017

OilRig Deploys "ALMA Communicator" - DNS Tunneling Trojan

date in the CCS '25 data Palo Alto Networks fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor OilRig Deploys "ALMA Communicator" - DNS Tunneling Trojan
8 November 2017

OilRig Deploys “ALMA Communicator” – DNS Tunneling Trojan

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OilRig Deploys “ALMA Communicator” – DNS Tunneling Trojan
8 November 2017

OilRig Deploys “ALMA Communicator” – DNS Tunneling Trojan

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor OilRig Deploys “ALMA Communicator” – DNS Tunneling Trojan
27 October 2017

Greenbug

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Greenbug
24 October 2017

Iranian Threat Agent Greenbug Impersonates Israeli High-Tech and Cyber Security Companies – ClearSky Cyber Security

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Iranian Threat Agent Greenbug Impersonates Israeli High-Tech and Cyber Security Companies – ClearSky Cyber Security
24 October 2017

Iranian Threat Agent Greenbug Impersonates Israeli High-Tech and Cyber Security Companies

date in the CCS '25 data Clearsky fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Iranian Threat Agent Greenbug Impersonates Israeli High-Tech and Cyber Security Companies
9 October 2017

OilRig Group Steps Up Attacks with New Delivery Documents and New Injector Trojan

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OilRig Group Steps Up Attacks with New Delivery Documents and New Injector Trojan
9 October 2017

OilRig Group Steps Up Attacks with New Delivery Documents and New Injector Trojan

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor OilRig Group Steps Up Attacks with New Delivery Documents and New Injector Trojan
26 September 2017

Striking Oil: A Closer Look at Adversary Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Striking Oil: A Closer Look at Adversary Infrastructure
26 September 2017

Striking Oil: A Closer Look at Adversary Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Striking Oil: A Closer Look at Adversary Infrastructure
26 September 2017

Striking Oil- A Closer Look at Adversary Infrastructure

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Striking Oil- A Closer Look at Adversary Infrastructure
28 August 2017

Recent ISMAgent Samples and Infrastructure by Iranian Threat Group GreenBug – ClearSky Cyber Security

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Recent ISMAgent Samples and Infrastructure by Iranian Threat Group GreenBug – ClearSky Cyber Security
8 August 2017

APT Trends report Q2 2017

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT Trends report Q2 2017
31 July 2017

TwoFace Webshell: Persistent Access Point for Lateral Movement

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TwoFace Webshell: Persistent Access Point for Lateral Movement
27 July 2017

With Fake News And Femmes Fatales, Iran's Spies Learn To Love Facebook

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor With Fake News And Femmes Fatales, Iran's Spies Learn To Love Facebook
27 July 2017

The Curious Case of Mia Ash- Fake Persona Lures Middle Eastern Targets

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Curious Case of Mia Ash- Fake Persona Lures Middle Eastern Targets
27 July 2017

OilRig Uses ISMDoor Variant; Possibly Linked to Greenbug Threat Group

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OilRig Uses ISMDoor Variant; Possibly Linked to Greenbug Threat Group
27 July 2017

OilRig Uses ISMDoor Variant; Possibly Linked to Greenbug Threat Group

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor OilRig Uses ISMDoor Variant; Possibly Linked to Greenbug Threat Group
27 July 2017

With Fake News And Femmes Fatales, Iran's Spies Learn To Love Facebook

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor With Fake News And Femmes Fatales, Iran's Spies Learn To Love Facebook
27 July 2017

OilRig uses ISMDoor variant; Possibly Linked to Greenbug Threat Group

date in the CCS '25 data Palo Alto fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor OilRig uses ISMDoor variant; Possibly Linked to Greenbug Threat Group
12 July 2017

Iranian Hackers Have Been Infiltrating Critical Infrastructure Companies

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Iranian Hackers Have Been Infiltrating Critical Infrastructure Companies
2 May 2017

Shamoon Collaborator Greenbug Adopts New Communication Tool

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Shamoon Collaborator Greenbug Adopts New Communication Tool
2 May 2017

Shamoon Collaborator Greenbug Adopts New Communication Tool

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Shamoon Collaborator Greenbug Adopts New Communication Tool
28 April 2017

Iranian Fileless Attack Infiltrates Israeli Organizations

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Iranian Fileless Attack Infiltrates Israeli Organizations
27 April 2017

Iranian Fileless Attack Infiltrates Israeli Organizations

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Iranian Fileless Attack Infiltrates Israeli Organizations
27 April 2017

OilRig Actors Provide a Glimpse into Development and Testing Efforts

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OilRig Actors Provide a Glimpse into Development and Testing Efforts
27 April 2017

Iranian Fileless Attack Infiltrates Israeli Organizations

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Iranian Fileless Attack Infiltrates Israeli Organizations
27 April 2017

OilRig Actors Provide a Glimpse into Development and Testing Efforts

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor OilRig Actors Provide a Glimpse into Development and Testing Efforts
24 April 2017

גלי תקיפה כנגד גופי ממשל, אקדמיה וגורמים עסקיים בישראל

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor גלי תקיפה כנגד גופי ממשל, אקדמיה וגורמים עסקיים בישראל
20 March 2017

logrhythm-labs-oilrig-campaign-analysis.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor logrhythm-labs-oilrig-campaign-analysis.pdf
28 February 2017

Iranian PupyRAT Bites Middle Eastern Organizations | SecureWorks

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Iranian PupyRAT Bites Middle Eastern Organizations | SecureWorks
27 February 2017

Shamoon- Multi-staged destructive attacks limited to specific targets

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Shamoon- Multi-staged destructive attacks limited to specific targets
27 February 2017

Endpoint Protection - Symantec Enterprise

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Endpoint Protection - Symantec Enterprise
22 February 2017

Iranian Threat Agent OilRig Delivers Digitally Signed Malware, Impersonates University of Oxford

file creation date Clearsky fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Iranian Threat Agent OilRig Delivers Digitally Signed Malware, Impersonates University of Oxford
16 February 2017

Iranian hackers behind the Magic Hound campaign linked to Shamoon

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Iranian hackers behind the Magic Hound campaign linked to Shamoon
15 February 2017

Iranian PupyRAT Bites Middle Eastern Organizations

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Iranian PupyRAT Bites Middle Eastern Organizations
15 February 2017

Magic Hound Campaign Attacks Saudi Targets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Magic Hound Campaign Attacks Saudi Targets
15 February 2017

Inside OilRig -- Tracking Iran's Busiest Hacker Crew On Its Global Rampage

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Inside OilRig -- Tracking Iran's Busiest Hacker Crew On Its Global Rampage
15 February 2017

Inside OilRig -- Tracking Iran's Busiest Hacker Crew On Its Global Rampage

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Inside OilRig -- Tracking Iran's Busiest Hacker Crew On Its Global Rampage
15 February 2017

Iranian PupyRAT Bites Middle Eastern Organizations

date in the CCS '25 data Secureworks fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Iranian PupyRAT Bites Middle Eastern Organizations
23 January 2017

Greenbug cyberespionage group targeting Middle East, possible links to Shamoon

Malpedia library date fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor Greenbug cyberespionage group targeting Middle East, possible links to Shamoon
23 January 2017

Greenbug cyberespionage group targeting Middle East, possible links to Shamoon

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Greenbug cyberespionage group targeting Middle East, possible links to Shamoon
5 January 2017

Iranian Threat Agent OilRig Delivers Digitally Signed Malware, Impersonates University of Oxford – ClearSky Cyber Security

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Iranian Threat Agent OilRig Delivers Digitally Signed Malware, Impersonates University of Oxford – ClearSky Cyber Security
5 January 2017

Iranian Fileless Attack Infiltrates Israeli Organizations

date in the CCS '25 data Morphisec fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Iranian Fileless Attack Infiltrates Israeli Organizations
5 January 2017

Iranian Threat Agent OilRig Delivers Digitally Signed Malware, Impersonates University of Oxford _ ClearSky Cybersecurity

date in the CCS '25 data ClearSky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Iranian Threat Agent OilRig Delivers Digitally Signed Malware, Impersonates University of Oxford _ ClearSky Cybersecurity
4 October 2016

OilRig Malware Campaign Updates Toolset and Expands Targets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OilRig Malware Campaign Updates Toolset and Expands Targets
4 October 2016

OilRig Malware Campaign Updates Toolset and Expands Targets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OilRig Malware Campaign Updates Toolset and Expands Targets
4 October 2016

OilRig Malware Campaign Updates Toolset and Expands Targets

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor OilRig Malware Campaign Updates Toolset and Expands Targets
26 May 2016

The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor
26 May 2016

The OilRig Campaign- Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The OilRig Campaign- Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor
26 May 2016

The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor
26 May 2016

The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor - Palo Alto Networks BlogPalo Alto Networks Blog

date in the CCS '25 data Palo Alto fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor - Palo Alto Networks BlogPalo Alto Networks Blog
4 April 2013

Clever Kitten | Threat Actor Profile | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Clever Kitten | Threat Actor Profile | CrowdStrike
4 March 2013

APT34 Deploys Phishing Attack With New Malware

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor APT34 Deploys Phishing Attack With New Malware

Newest first. Details opens the report in Explore.

Names and who uses them

OilRig from AT MI ET MA
IRN2 from AT MI ET MA
Helix Kitten from AT MI ET MA
Evasive Serpens from AT MI ET MA
Hazel Sandstorm from AT MI ET MA
EUROPIUM from AT MI ET MA
Earth Simnavaz from AT MI ET MA
Crambus from AT MI ET MA
TA452 from AT MI ET MA
APT34 from AT MI MA
Greenbug from MI ET MA
APT 34 from MI ET MA
Twisted Kitten from MI ET MA
Cobalt Gypsy from MI ET MA

Show all 28 names Show fewer

Scarred Manticore from MI ET MA
UNC1860 from MI ET MA
ITG13 from AT ET
CHRYSENE from MI MA
ATK40 from MI MA
SOLAR ION from MI MA
COBALT GYPSY from AT
Volatile Kitten from ET
Chrysene from ET
ATK 40 from ET
DEV-0861 from ET
Yellow Maero from ET
Storm-0861 from ET
HELIX KITTEN from MA

AT ATT&CK
MI MISP
ET ETDA
MA Malpedia

Origin and Motivation

Origin: Iran fromMISP ETDA Malpedia
Motivation: Information theft and espionage fromETDA

Claimed targets (actor-level, per source)

Sources give these for the actor as a whole, not for a report or campaign.

Countries: Albania fromETDA
Azerbaijan fromETDA
Bahrain fromETDA
China fromETDA
Egypt fromETDA
Iraq fromETDA
Israel fromETDA
Jordan fromETDA
Kuwait fromETDA
Lebanon fromETDA
Mauritius fromETDA
Oman fromETDA

Show all 19 countries Show fewer

Pakistan fromETDA
Qatar fromETDA
Saudi Arabia fromETDA
Türkiye fromETDA
United Arab Emirates fromETDA
United Kingdom fromETDA
United States fromETDA
Sectors: Chemical fromMISP ETDA Malpedia
Energy fromMISP ETDA Malpedia
Engineering fromMISP Malpedia
Finance fromMISP Malpedia
Government, Administration fromMISP Malpedia
Telecoms fromMISP Malpedia
Other fromMISP Malpedia
Education fromMISP ETDA Malpedia
Investment fromMISP Malpedia
Aerospace fromMISP Malpedia
Aviation fromETDA
Defense fromETDA

Show all 19 sectors Show fewer

Financial fromETDA
Government fromETDA
High-Tech fromETDA
IT fromETDA
Hospitality fromETDA
Oil and gas fromETDA
Telecommunications fromETDA

Malware and Tools

BONDUPDATER fromATT&CK Malpedia
Helminth fromATT&CK
ISMInjector fromATT&CK
LaZagne fromATT&CK
Mango fromATT&CK Malpedia
Mimikatz fromATT&CK
Net fromATT&CK
ODAgent fromATT&CK
OilBooster fromATT&CK
OilCheck fromATT&CK
OopsIE fromATT&CK Malpedia
POWRUNER fromATT&CK

Show all 47 malware and tools Show fewer

PowerExchange fromATT&CK
PsExec fromATT&CK
QUADAGENT fromATT&CK
RDAT fromATT&CK Malpedia
RGDoor fromATT&CK
Reg fromATT&CK
SEASHARPEE fromATT&CK
SampleCheck5000 fromATT&CK
SideTwist fromATT&CK Malpedia
Solar fromATT&CK Malpedia
Systeminfo fromATT&CK
Tasklist fromATT&CK
ZeroCleare fromATT&CK Malpedia
certutil fromATT&CK
ftp fromATT&CK
ipconfig fromATT&CK
netstat fromATT&CK
ngrok fromATT&CK
ISMAgent fromMalpedia
ISMDoor fromMalpedia
Alma Communicator fromMalpedia
GoogleDrive RAT fromMalpedia
Hawking fromMalpedia
Karkoff fromMalpedia
OilRig fromMalpedia
RedCap fromMalpedia
STEALHOOK fromMalpedia
Saitama Backdoor fromMalpedia
SpyNote fromMalpedia
TwoFace fromMalpedia
jason fromMalpedia
pupy fromMalpedia
LIONTAIL fromMalpedia
CRYPTOSLAY fromMalpedia
TEMPLEDOOR fromMalpedia