APT37

HWP Malware Using the Steganography Technique: RedEyes (ScarCruft) - ASEC

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor HWP Malware Using the Steganography Technique: RedEyes (ScarCruft) - ASEC

Cisco IOS Security Command Reference: Commands S to Z - show parameter-map type consent through show users [Support]

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Cisco IOS Security Command Reference: Commands S to Z - show parameter-map type consent through show users [Support]

NavRAT Uses US-North Korea Summit As Decoy For Attacks In South Korea

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor NavRAT Uses US-North Korea Summit As Decoy For Attacks In South Korea

STARDUST CHOLLIMA | Threat Actor Profile | CrowdStrike

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor STARDUST CHOLLIMA | Threat Actor Profile | CrowdStrike

RedEyes Group Wiretapping Individuals (APT37) - ASEC

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor RedEyes Group Wiretapping Individuals (APT37) - ASEC

RokRAT (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor RokRAT (Malware Family)

APT trends report Q2 2021

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor APT trends report Q2 2021

Meeting the “Ministrer” | Fortinet Blog

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Meeting the “Ministrer” | Fortinet Blog

Distribution of Backdoor via Malicious LNK: RedEyes (ScarCruft) - ASEC

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Distribution of Backdoor via Malicious LNK: RedEyes (ScarCruft) - ASEC

Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia

Definitive Dossier of Devilish Debug Details — Part One: PDB Paths and Malware | Mandiant

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Definitive Dossier of Devilish Debug Details — Part One: PDB Paths and Malware | Mandiant

국가기반 APT 그룹 '오퍼레이션 스타 크루저(Operation Star Cruiser)' 수행 … 사이버 첩보활동 지속

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor 국가기반 APT 그룹 '오퍼레이션 스타 크루저(Operation Star Cruiser)' 수행 … 사이버 첩보활동 지속

'오퍼레이션 배틀 크루저' 다양한 취약점으로 국내외 APT 공격 지속

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor '오퍼레이션 배틀 크루저' 다양한 취약점으로 국내외 APT 공격 지속

RedEyes hackers use new malware to steal data from Windows, phones

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor RedEyes hackers use new malware to steal data from Windows, phones

Tracking Traces of Malware Disguised as Hancom Office Document File and Being Distributed (RedEyes) - ASEC

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Tracking Traces of Malware Disguised as Hancom Office Document File and Being Distributed (RedEyes) - ASEC

NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT

Reaper, APT 37, Ricochet Chollima, ScarCruft

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Reaper, APT 37, Ricochet Chollima, ScarCruft

RedEyes (ScarCruft)’s CHM Malware Using the Topic of Fukushima Wastewater Release - ASEC

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor RedEyes (ScarCruft)’s CHM Malware Using the Topic of Fukushima Wastewater Release - ASEC

Operation Artemis: Analysis of HWP-Based DLL Side Loading Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Artemis: Analysis of HWP-Based DLL Side Loading Attacks

State-Sponsored Remote Wipe Tactics Targeting Android Devices

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor State-Sponsored Remote Wipe Tactics Targeting Android Devices

eset-apt-activity-report-q2-2025-q3-2025.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eset-apt-activity-report-q2-2025-q3-2025.pdf

APT37: Rust Backdoor & Python Loader | ThreatLabz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT37: Rust Backdoor & Python Loader | ThreatLabz

RokRAT Malware Using Malicious Hangul (.HWP) Documents - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RokRAT Malware Using Malicious Hangul (.HWP) Documents - ASEC

DTEX-Exposing+DPRK+Cyber+Syndicate+and+Hidden+IT+Workforce.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DTEX-Exposing+DPRK+Cyber+Syndicate+and+Hidden+IT+Workforce.pdf

Analysis of APT37 Attack Case Disguised as a Think Tank for National Security Strategy in South Korea (Operation. ToyBox Story)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis of APT37 Attack Case Disguised as a Think Tank for National Security Strategy in South Korea (Operation. ToyBox Story)

Malware development trick 47: simple Windows clipboard hijacking. Simple C example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development trick 47: simple Windows clipboard hijacking. Simple C example.

Malware development trick 46: simple Windows keylogger. Simple C example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development trick 46: simple Windows keylogger. Simple C example.

Lookout Discovers North Korean APT37 Mobile Spyware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lookout Discovers North Korean APT37 Mobile Spyware

APT37 - RokRat

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT37 - RokRat

APT-C-28 Group Launched New Cyber Attack With Fileless RokRat Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT-C-28 Group Launched New Cyber Attack With Fileless RokRat Malware

ESET APT Activity Report Q2 2024-Q3 2024

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET APT Activity Report Q2 2024-Q3 2024

AhnLab and NCSC Release Joint Report on Microsoft Zero-Day Browser Vulnerability (CVE-2024-38178)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AhnLab and NCSC Release Joint Report on Microsoft Zero-Day Browser Vulnerability (CVE-2024-38178)

SHROUDED#SLEEP: A Deep Dive into North Korea’s Ongoing Campaign Against Southeast Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SHROUDED#SLEEP: A Deep Dive into North Korea’s Ongoing Campaign Against Southeast Asia

ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilities

file creation date fromORKL

Archived copy on ORKL Detailsfor ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilities

LNK File Disguised as Certificate Distributing RokRAT Malware - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor LNK File Disguised as Certificate Distributing RokRAT Malware - ASEC

RE:archive | APT37's ROKRAT HWP Object Linking and Embedding

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RE:archive | APT37's ROKRAT HWP Object Linking and Embedding

To Russia With Love: Assessing a KONNI-Backdoored Suspected Russian Consular Software Installer

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor To Russia With Love: Assessing a KONNI-Backdoored Suspected Russian Consular Software Installer

ScarCruft | Attackers Gather Strategic Intelligence and Target Cybersecurity Professionals

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ScarCruft | Attackers Gather Strategic Intelligence and Target Cybersecurity Professionals

Konni(코니) 에서 만든 국세청 사칭 악성코드-첨부1.취득자금 소명대상 금액의 출처 확인서(국제조세조정에 관한 법률 시행규칙).hwp(2023.12.13)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Konni(코니) 에서 만든 국세청 사칭 악성코드-첨부1.취득자금 소명대상 금액의 출처 확인서(국제조세조정에 관한 법률 시행규칙).hwp(2023.12.13)

The New APT Group DarkCasino and the Global Surge in WinRAR 0-Day Exploits - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.

Malpedia library date NSFOCUS fromORKLCCS '25 data

Archived copy on ORKL Detailsfor The New APT Group DarkCasino and the Global Surge in WinRAR 0-Day Exploits - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.

ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilities

Malpedia library date ESET fromORKLCCS '25 data

Archived copy on ORKL Detailsfor ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilities

APT trends report Q3 2023

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q3 2023

Assessed Cyber Structure and Alignments of North Korea in 2023 | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Assessed Cyber Structure and Alignments of North Korea in 2023 | Mandiant

deep analysis of Xiangoop Loader and EntryShell payload

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor deep analysis of Xiangoop Loader and EntryShell payload

REarchive: Reverse Engineering APT37's GOLDBACKDOOR dropper

Malpedia library date 0x0v1 fromORKLCCS '25 data

Archived copy on ORKL Detailsfor REarchive: Reverse Engineering APT37's GOLDBACKDOOR dropper

BlueShell Used in APT Attacks Against Korean and Thai Targets - ASEC

Malpedia library date AhnLab fromORKLCCS '25 data

Archived copy on ORKL Detailsfor BlueShell Used in APT Attacks Against Korean and Thai Targets - ASEC

국내와 태국 대상 APT 공격에 사용된 BlueShell 악성코드 - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 국내와 태국 대상 APT 공격에 사용된 BlueShell 악성코드 - ASEC

Comrades in Arms? | North Korea Compromises Sanctioned Russian Missile Engineering Company

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Comrades in Arms? | North Korea Compromises Sanctioned Russian Missile Engineering Company

Chain Reaction: ROKRAT’s Missing Link

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chain Reaction: ROKRAT’s Missing Link

Chain Reaction- RokRAT's Missing Link

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Chain Reaction- RokRAT's Missing Link

RokRAT Malware Distributed Through LNK Files (*.lnk): RedEyes (ScarCruft) - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RokRAT Malware Distributed Through LNK Files (*.lnk): RedEyes (ScarCruft) - ASEC

RokRAT Malware Distributed Through LNK Files (.lnk)- RedEyes (ScarCruft)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor RokRAT Malware Distributed Through LNK Files (.lnk)- RedEyes (ScarCruft)

202304114e0fa0f4fd1d408aaddeef8be63a4757_20230411161526_0531.pdf

Malpedia library date fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor 202304114e0fa0f4fd1d408aaddeef8be63a4757_20230411161526_0531.pdf

Chinotto Backdoor Technical Analysis of the APT Reaper’s Powerful Weapon

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Chinotto Backdoor Technical Analysis of the APT Reaper’s Powerful Weapon

Scarcruft Bolsters Arsenal for targeting individual Android devices

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Scarcruft Bolsters Arsenal for targeting individual Android devices

Kimsuky group distributes malware disguised as a profile file (GitHub)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Kimsuky group distributes malware disguised as a profile file (GitHub)

Scarcruft Bolsters Arsenal for targeting individual Android devices

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Scarcruft Bolsters Arsenal for targeting individual Android devices

APT37 | ThreatLabz

Malpedia library date Zscaler fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT37 | ThreatLabz

Move, Patch, Get Out the Way- 2022 Zero-Day Exploitation Continues at an Elevated Pace

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Move, Patch, Get Out the Way- 2022 Zero-Day Exploitation Continues at an Elevated Pace

Peeking at Reaper’s surveillance operations

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Peeking at Reaper’s surveillance operations

Peeking at Reaper’s surveillance operations

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Peeking at Reaper’s surveillance operations

Magniber ransomware actors used a variant of Microsoft SmartScreen bypass

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Magniber ransomware actors used a variant of Microsoft SmartScreen bypass

HWP Malware Using the Steganography Technique: RedEyes (ScarCruft)

date in the CCS '25 data AhnLab fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor HWP Malware Using the Steganography Technique: RedEyes (ScarCruft)

WIP26 Espionage - Threat Actors Abuse Cloud Infrastructure in Targeted Telco Attacks

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor WIP26 Espionage - Threat Actors Abuse Cloud Infrastructure in Targeted Telco Attacks

WIP26 Espionage | Threat Actors Abuse Cloud Infrastructure in Targeted Telco Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor WIP26 Espionage | Threat Actors Abuse Cloud Infrastructure in Targeted Telco Attacks

Hangeul (HWP) malware using steganography- RedEyes (ScarCruft)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Hangeul (HWP) malware using steganography- RedEyes (ScarCruft)

TTPs $ ScarCruft Tracking Note

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TTPs $ ScarCruft Tracking Note

TTPs #9: 개인의 일상을 감시하는 공격전략 분석

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TTPs #9: 개인의 일상을 감시하는 공격전략 분석

Emulating the Highly Sophisticated North Korean Adversary Lazarus Group

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Emulating the Highly Sophisticated North Korean Adversary Lazarus Group

Emulating the Highly Sophisticated North Korean Adversary Lazarus Group – Part 1

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emulating the Highly Sophisticated North Korean Adversary Lazarus Group – Part 1

Cyber Threat Report- RambleOn Android Malware - Detailed analysis report of cyber threat targeting journalist in South Korea through APT phishing campaign with malicious APK

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Cyber Threat Report- RambleOn Android Malware - Detailed analysis report of cyber threat targeting journalist in South Korea through APT phishing campaign with malicious APK

Internet Explorer 0-day exploited by North Korean actor APT37

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Internet Explorer 0-day exploited by North Korean actor APT37

Internet Explorer 0-day exploited by North Korean actor APT37

date in the CCS '25 data Google fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Internet Explorer 0-day exploited by North Korean actor APT37

Internet Explorer 0-day exploited by North Korean actor APT37

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Internet Explorer 0-day exploited by North Korean actor APT37

Who’s swimming in South Korean waters? Meet ScarCruft’s Dolphin

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Who’s swimming in South Korean waters? Meet ScarCruft’s Dolphin

Who’s swimming in South Korean waters- Meet ScarCruft’s Dolphin

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Who’s swimming in South Korean waters- Meet ScarCruft’s Dolphin

Malware development tricks: parent PID spoofing. Simple C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development tricks: parent PID spoofing. Simple C++ example.

Revealing Europe's NSO

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Revealing Europe's NSO

Revealing Europe's NSO

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Revealing Europe's NSO

PowerPoint Presentation

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor PowerPoint Presentation

North Korean hackers attack EU targets with Konni RAT malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor North Korean hackers attack EU targets with Konni RAT malware

North Korean hackers attack EU targets with Konni RAT malware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor North Korean hackers attack EU targets with Konni RAT malware

Securonix Threat Labs Initial Coverage Advisory: STIFF#BIZON Detection Using Securonix – New Attack Campaign Observed Possibly Linked to Konni/APT37 (North Korea)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Securonix Threat Labs Initial Coverage Advisory: STIFF#BIZON Detection Using Securonix – New Attack Campaign Observed Possibly Linked to Konni/APT37 (North Korea)

Lookout Uncovers Hermit Spyware Deployed in Kazakhstan

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lookout Uncovers Hermit Spyware Deployed in Kazakhstan

Lookout Uncovers Android Spyware Deployed in Kazakhstan

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Lookout Uncovers Android Spyware Deployed in Kazakhstan

THALES%20THREAT%20HANDBOOK%202022%20Light%20Version_1.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor THALES%20THREAT%20HANDBOOK%202022%20Light%20Version_1.pdf

The Hermit Kingdom’s Ransomware play

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Hermit Kingdom’s Ransomware play

Malware development: persistence - part 3. COM DLL hijack. Simple C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development: persistence - part 3. COM DLL hijack. Simple C++ example.

yir-cyber-threats-annex-download.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor yir-cyber-threats-annex-download.pdf

The ink-stained trail of GOLDBACKDOOR

date in the CCS '25 data stairwell fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor The ink-stained trail of GOLDBACKDOOR

Not So Lazarus- Mapping DPRK Cyber Threat Groups to Government Organizations

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Not So Lazarus- Mapping DPRK Cyber Threat Groups to Government Organizations

KONNI evolves into stealthier RAT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor KONNI evolves into stealthier RAT

Hackers take over diplomat's email, target Russian deputy minister

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hackers take over diplomat's email, target Russian deputy minister

Hackers take over diplomat's email, target Russian deputy minister

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Hackers take over diplomat's email, target Russian deputy minister

APT37 Using a New Android Spyware, Chinotto

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT37 Using a New Android Spyware, Chinotto

APT37 Deploys New Android Spyware, Chinotto

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT37 Deploys New Android Spyware, Chinotto

ScarCruft surveilling North Korean defectors and human rights activists

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor ScarCruft surveilling North Korean defectors and human rights activists

ScarCruft surveilling North Korean defectors and human rights activists

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ScarCruft surveilling North Korean defectors and human rights activists

Global_APT_Research_Report_for_the_first_half_of_2021-360

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Global_APT_Research_Report_for_the_first_half_of_2021-360

APT_trends_report_Q2_2021_Securelist

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT_trends_report_Q2_2021_Securelist

North Korean APT InkySquid Infects Victims Using Browser Exploits

file creation date Volexity fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor North Korean APT InkySquid Infects Victims Using Browser Exploits

North Korean Cyberattacks A Dangerous and Evolving Threat 2

date in the CCS '25 data Heritage.org fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor North Korean Cyberattacks A Dangerous and Evolving Threat 2

volexity.com-North Korean BLUELIGHT Special InkySquid Deploys RokRAT

date in the CCS '25 data Volexity fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor volexity.com-North Korean BLUELIGHT Special InkySquid Deploys RokRAT

North Korean BLUELIGHT Special- InkySquid Deploys RokRAT

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor North Korean BLUELIGHT Special- InkySquid Deploys RokRAT

North Korean BLUELIGHT Special: InkySquid Deploys RokRAT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor North Korean BLUELIGHT Special: InkySquid Deploys RokRAT

New variant of Konni malware used in campaign targetting Russia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New variant of Konni malware used in campaign targetting Russia

New variant of Konni malware used in campaign targetting Russia

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New variant of Konni malware used in campaign targetting Russia

volexity.com-North Korean APT InkySquid Infects Victims Using Browser Exploits

date in the CCS '25 data Volexity fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor volexity.com-North Korean APT InkySquid Infects Victims Using Browser Exploits

North Korean APT InkySquid Infects Victims Using Browser Exploits

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor North Korean APT InkySquid Infects Victims Using Browser Exploits

North Korean APT37 - InkySquid Infects Victims Using Browser Exploits

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor North Korean APT37 - InkySquid Infects Victims Using Browser Exploits

Threats to the 2020 Tokyo Olympic Games

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threats to the 2020 Tokyo Olympic Games

Matryoshka : Variant of ROKRAT, APT37 (Scarcruft)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Matryoshka : Variant of ROKRAT, APT37 (Scarcruft)

D2T1%20-%20The%20Phishermen%20-%20Dissecting%20Phishing%20Techniques%20of%20CloudDragon%20APT%20-%20Linda%20Kuo%20&Zih-Cing%20Liao%20.pdf

Malpedia library date Team T5 fromORKLCCS '25 data

Archived copy on ORKL Detailsfor D2T1%20-%20The%20Phishermen%20-%20Dissecting%20Phishing%20Techniques%20of%20CloudDragon%20APT%20-%20Linda%20Kuo%20&Zih-Cing%20Liao%20.pdf

PowerPoint 簡報

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PowerPoint 簡報

as-21-Kuo-We-Are-About-To-Land-How-CloudDragon-Turns-A-Nightmare-Into-Reality.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor as-21-Kuo-We-Are-About-To-Land-How-CloudDragon-Turns-A-Nightmare-Into-Reality.pdf

mtrends-2021

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor mtrends-2021

https---www.ptsecurity.com-ww-en-analytics-antisandbox-techniques-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor https---www.ptsecurity.com-ww-en-analytics-antisandbox-techniques-

Analytics

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Analytics

Lazarus APT37 IOCs

date in the CCS '25 data Github (hvs-consulting) fromCCS '25 data

Detailsfor Lazarus APT37 IOCs

Retrohunting APT37- North Korean APT used VBA self decode technique to inject RokRat

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Retrohunting APT37- North Korean APT used VBA self decode technique to inject RokRat

blog.malwarebytes.com-Retrohunting APT37 North Korean APT used VBA self decode technique to inject RokRat

date in the CCS '25 data Malwarebytes fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor blog.malwarebytes.com-Retrohunting APT37 North Korean APT used VBA self decode technique to inject RokRat

Greetings from Lazarus

Malpedia library date HvS-Consulting AG fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Greetings from Lazarus

Who is the Threat Actor Behind Operation Earth Kitsune?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Who is the Threat Actor Behind Operation Earth Kitsune?

Who is the Threat Actor Behind Operation Earth Kitsune-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Who is the Threat Actor Behind Operation Earth Kitsune-

“「2021 평화∙통일 이야기 공모전」 참가 신청서” 제목의 한글문서 유포 (APT 추정)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor “「2021 평화∙통일 이야기 공모전」 참가 신청서” 제목의 한글문서 유포 (APT 추정)

Group-IB_Hi-Tech_Crime_Trends_2020-2021_en

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Group-IB_Hi-Tech_Crime_Trends_2020-2021_en

RL Blog | ReversingLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RL Blog | ReversingLabs

APT_trends_report_Q3_2020_Securelist

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT_trends_report_Q3_2020_Securelist

APT trends report Q3 2020

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT trends report Q3 2020

APT trends report Q3 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q3 2020

The many personalities of Lazarus

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The many personalities of Lazarus

Phishing Emails Used to Deploy KONNI Malware | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Phishing Emails Used to Deploy KONNI Malware | CISA

apt37-reaper-the-overlooked-north-korean-actor.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor apt37-reaper-the-overlooked-north-korean-actor.pdf

Cloud Threat Landscape Report 2020,pdf

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Cloud Threat Landscape Report 2020,pdf

T1055 Process Injection

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor T1055 Process Injection

MITRE ATT&CK T1055 Process Injection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MITRE ATT&CK T1055 Process Injection

200407-MWB-COVID-White-Paper_Final

date in the CCS '25 data Malwarebytes fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 200407-MWB-COVID-White-Paper_Final

The 'Spy Cloud' Operation Geumseong121 group carries out the APT attack disguising the evidence of North Korean defection

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The 'Spy Cloud' Operation Geumseong121 group carries out the APT attack disguising the evidence of North Korean defection

The 'Spy Cloud' Operation Geumseong121 group carries out the APT attack disguising the evidence of North Korean defection

date in the CCS '25 data EST Security fromCCS '25 data

Detailsfor The 'Spy Cloud' Operation Geumseong121 group carries out the APT attack disguising the evidence of North Korean defection

Tracking ‘Kimsuky’, the North Korea-based cyber espionage group- Part 1

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Tracking ‘Kimsuky’, the North Korea-based cyber espionage group- Part 1

Report2020CrowdStrikeGlobalThreatReport

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Report2020CrowdStrikeGlobalThreatReport

Cyber Threats 2019: A Year in Retrospect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Threats 2019: A Year in Retrospect

Lexfo-WhitePaper-The_Lazarus_Constellation

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Lexfo-WhitePaper-The_Lazarus_Constellation

Lexfo-WhitePaper-The_Lazarus_Constellation.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lexfo-WhitePaper-The_Lazarus_Constellation.pdf

Tracking ‘Kimsuky’, the North Korea-based cyber espionage group- Part 1

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Tracking ‘Kimsuky’, the North Korea-based cyber espionage group- Part 1

2020.02.22_APT_threat_report_2019_CN_version

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 2020.02.22_APT_threat_report_2019_CN_version

sadasd

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor sadasd

A Look Into Konni 2019 Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Look Into Konni 2019 Campaign

Drilling Deep: A Look at Cyberattacks on the Oil and Gas Industry

date in the CCS '25 data Trend Micro fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Drilling Deep: A Look at Cyberattacks on the Oil and Gas Industry

Group-IB_Hi-Tech_Crime_Trends_2019-2020_en

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Group-IB_Hi-Tech_Crime_Trends_2019-2020_en

Group-IB_Hi-Tech_Crime_Trends_2019-2020

date in the CCS '25 data Group-IB fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Group-IB_Hi-Tech_Crime_Trends_2019-2020

APT Trends Report Q2 2018

file creation date Kaspersky fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor APT Trends Report Q2 2018

Microsoft Word - Dragon Messenger_eng.docx

file creation date fromORKL

Archived copy on ORKL Detailsfor Microsoft Word - Dragon Messenger_eng.docx

mobile-malware-report.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor mobile-malware-report.pdf

(cn)_higaisa_apt_report

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor (cn)_higaisa_apt_report

腾讯iOA官网(腾讯自研自用的一体化办公安全平台）-免费使用

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 腾讯iOA官网(腾讯自研自用的一体化办公安全平台）-免费使用

20191004_Kimsuky Group - Track the King of the Spear-Phishing_PUB

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 20191004_Kimsuky Group - Track the King of the Spear-Phishing_PUB

Untitled

file creation date fromORKL

Archived copy on ORKL Detailsfor Untitled

코니(Konni) APT 조직, 러시아 문서로 위장한 공격 등장

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 코니(Konni) APT 조직, 러시아 문서로 위장한 공격 등장

APT_trends_report_Q2_2019_Securelist

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT_trends_report_Q2_2019_Securelist

APT trends report Q2 2019

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q2 2019

APT trends report Q2 2019

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT trends report Q2 2019

ScarCruft continues to evolve, introduces Bluetooth harvester

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor ScarCruft continues to evolve, introduces Bluetooth harvester

ScarCruft continues to evolve, introduces Bluetooth harvester _ Securelist

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ScarCruft continues to evolve, introduces Bluetooth harvester _ Securelist

ScarCruft continues to evolve, introduces Bluetooth harvester

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ScarCruft continues to evolve, introduces Bluetooth harvester

2019-data-breach-investigations-report.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2019-data-breach-investigations-report.pdf

cfile5.uf@99A0CD415CB67E210DCEB3.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor cfile5.uf@99A0CD415CB67E210DCEB3.pdf

rpt-mtrends-2019.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor rpt-mtrends-2019.pdf

rpt-mtrends-2019

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor rpt-mtrends-2019

CrowdStrike_GTR_2019_.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor CrowdStrike_GTR_2019_.pdf

2019.01.03.Tencent_APT_Summary_report_2018_CN_Version

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 2019.01.03.Tencent_APT_Summary_report_2018_CN_Version

2018 APT Summary Report CN version

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 2018 APT Summary Report CN version

Return to ROKRAT!! (feat. FAAAA...Sad...)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Return to ROKRAT!! (feat. FAAAA...Sad...)

Return to ROKRAT!! (feat. FAAAA...Sad...)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Return to ROKRAT!! (feat. FAAAA...Sad...)

rpt-apt38-2018-web_v5-1.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor rpt-apt38-2018-web_v5-1.pdf

APT37- Final1stspy Reaping the FreeMilk

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT37- Final1stspy Reaping the FreeMilk

rpt-apt38-2018-web_v4

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor rpt-apt38-2018-web_v4

APT37 Final1stspy Reaping the FreeMilk

date in the CCS '25 data Intezer fromCCS '25 data

The original link failed its last check. Detailsfor APT37 Final1stspy Reaping the FreeMilk

NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT

NOKKI Almost Ties the Knot with DOGCALL- Reaper Group Uses New Malware to Deploy RAT

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor NOKKI Almost Ties the Knot with DOGCALL- Reaper Group Uses New Malware to Deploy RAT

Report Ties North Korean Attacks to New Malware, Linked by Word Macros

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Report Ties North Korean Attacks to New Malware, Linked by Word Macros

Report Ties North Korean Attacks to New Malware, Linked by Word Macros

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Report Ties North Korean Attacks to New Malware, Linked by Word Macros

New KONNI Malware attacking Eurasia and Southeast Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New KONNI Malware attacking Eurasia and Southeast Asia

OPERATION "Rocket Man"

date in the CCS '25 data ESTSecurity fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor OPERATION "Rocket Man"

Examining Code Reuse Reveals Undiscovered Links Among North Korea’s Malware Families | McAfee Blogs

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Examining Code Reuse Reveals Undiscovered Links Among North Korea’s Malware Families | McAfee Blogs

Operation Daybreak

file creation date Kaspersky fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Operation Daybreak

APT Trends Report Q2 2018

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT Trends Report Q2 2018

APT Trends Report Q2 2018

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT Trends Report Q2 2018

NavRAT Uses US-North Korea Summit As Decoy For Attacks In South Korea

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor NavRAT Uses US-North Korea Summit As Decoy For Attacks In South Korea

Red_Eyes_Hacking_Group_Report

date in the CCS '25 data ggunyong fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Red_Eyes_Hacking_Group_Report

M-Trends Overview

Malpedia library date Marco Rottigni fromORKL

Archived copy on ORKL Detailsfor M-Trends Overview

APT Trends report Q1 2018

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT Trends report Q1 2018

APT Trends report Q1 2018

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT Trends report Q1 2018

Reaper Group’s Updated Mobile Arsenal

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Reaper Group’s Updated Mobile Arsenal

Reaper Group’s Updated Mobile Arsenal

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Reaper Group’s Updated Mobile Arsenal

Fake AV Investigation Unearths KevDroid, New Android Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Fake AV Investigation Unearths KevDroid, New Android Malware

Fake AV Investigation Unearths KevDroid, New Android Malware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Fake AV Investigation Unearths KevDroid, New Android Malware

Cisco's Talos Intelligence Group Blog: NavRAT Uses US-North Korea Summit As Decoy For Attacks In South Korea

date in the CCS '25 data AhnLab fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Cisco's Talos Intelligence Group Blog: NavRAT Uses US-North Korea Summit As Decoy For Attacks In South Korea

Tech_Report_Malicious_Hancom

date in the CCS '25 data AhnLab fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Tech_Report_Malicious_Hancom

APT37.blog

date in the CCS '25 data FireEye fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT37.blog

APT37 (Reaper)- The Overlooked North Korean Actor

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT37 (Reaper)- The Overlooked North Korean Actor

APT37 (Reaper) | The Overlooked North Korean Threat Actor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT37 (Reaper) | The Overlooked North Korean Threat Actor

rpt_APT37.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor rpt_APT37.pdf

APT37 (Reaper): The Overlooked North Korean Actor

date in the CCS '25 data FireEye fromCCS '25 data

The link to Mirror on Box failed its last check. Detailsfor APT37 (Reaper): The Overlooked North Korean Actor

APT37 (Reaper): The Overlooked North Korean Actor

file creation date FireEye fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT37 (Reaper): The Overlooked North Korean Actor

Attacks Leveraging Adobe Zero-Day (CVE-2018-4878) – Threat Attribution, Attack Scenario and Recommendations

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Attacks Leveraging Adobe Zero-Day (CVE-2018-4878) – Threat Attribution, Attack Scenario and Recommendations

Korea In The Crosshairs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Korea In The Crosshairs

Korea In The Crosshairs

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Korea In The Crosshairs

Cisco's Talos Intelligence Group Blog: Korea In The Crosshairs

date in the CCS '25 data Microsoft fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Cisco's Talos Intelligence Group Blog: Korea In The Crosshairs

ROKRAT Reloaded

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ROKRAT Reloaded

FreeMilk: A Highly Targeted Spear Phishing Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor FreeMilk: A Highly Targeted Spear Phishing Campaign

Guerrero-Saade-Raiu-VB2017.indd

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Guerrero-Saade-Raiu-VB2017.indd

A Quick Look at a New KONNI RAT Variant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Quick Look at a New KONNI RAT Variant

New KONNI Campaign References North Korean Missile Capabilities

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New KONNI Campaign References North Korean Missile Capabilities

Analysis of new variant of Konni RAT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis of new variant of Konni RAT

Talos_RokRatWhitePaper.pdf

file creation date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Talos_RokRatWhitePaper.pdf

KONNI: A Malware Under The Radar For Years

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor KONNI: A Malware Under The Radar For Years

Introducing ROKRAT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Introducing ROKRAT

Microsoft_Security_Intelligence_Report_Volume_21_English.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor Microsoft_Security_Intelligence_Report_Volume_21_English.pdf

Kaspersky Security Bulletin 2016. Review of the year. Overall statistics for 2016

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Kaspersky Security Bulletin 2016. Review of the year. Overall statistics for 2016

Microsoft_Security_Intelligence_Report_Volume_21_English

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Microsoft_Security_Intelligence_Report_Volume_21_English

Operation Daybreak

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation Daybreak

Operation Daybreak

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Operation Daybreak

ScarCruft APT Group Used Latest Flash Zero Day in Two Dozen Attacks

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor ScarCruft APT Group Used Latest Flash Zero Day in Two Dozen Attacks

Operation Daybreak

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Daybreak

ScarCruft APT Group Used Latest Flash Zero Day in Two Dozen Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ScarCruft APT Group Used Latest Flash Zero Day in Two Dozen Attacks

Flash zero-day exploit deployed by the ScarCruft APT Group

file creation date Kaspersky fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Flash zero-day exploit deployed by the ScarCruft APT Group

CVE-2016-4171 – Adobe Flash Zero-day used in targeted attacks

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor CVE-2016-4171 – Adobe Flash Zero-day used in targeted attacks

CVE-2016-4171 - Adobe Flash Zero-day used in targeted attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CVE-2016-4171 - Adobe Flash Zero-day used in targeted attacks