TA505

Monty Spider - Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Monty Spider - Threat Group Cards: A Threat Actor Encyclopedia

To evade detection, hackers are requiring targets to complete CAPTCHAs

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor To evade detection, hackers are requiring targets to complete CAPTCHAs

Microsoft links Clop ransomware gang to MOVEit data-theft attacks

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Microsoft links Clop ransomware gang to MOVEit data-theft attacks

GraceWire / FlawedGrace malware adventure

date ORKL added it fromORKL

The original link failed its last check. Original publisher Detailsfor GraceWire / FlawedGrace malware adventure

FIN11 is Back : Impersonates Popular Video Conference Application - CYFIRMA

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor FIN11 is Back : Impersonates Popular Video Conference Application - CYFIRMA

Gandcrab (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Gandcrab (Malware Family)

Binary Defense

date ORKL added it fromORKL

The original link failed its last check. Original publisher Detailsfor Binary Defense

Indrik Spider - Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Indrik Spider - Threat Group Cards: A Threat Actor Encyclopedia

Research, News, and Perspectives

date ORKL added it fromORKL

The original link failed its last check. Original publisher Detailsfor Research, News, and Perspectives

TA505 hacking crew spent much of 2019 trying to breach South Korea’s financial sector

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor TA505 hacking crew spent much of 2019 trying to breach South Korea’s financial sector

Microsoft: Clop and LockBit ransomware behind PaperCut server hacks

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Microsoft: Clop and LockBit ransomware behind PaperCut server hacks

Microsoft: Notorious FIN7 hackers return in Clop ransomware attacks

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Microsoft: Notorious FIN7 hackers return in Clop ransomware attacks

Blog: Stay Ahead of Cyber Threats

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Blog: Stay Ahead of Cyber Threats

Tracking a P2P network related to TA505

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Tracking a P2P network related to TA505

Silence, Contract Crew - Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Silence, Contract Crew - Threat Group Cards: A Threat Actor Encyclopedia

Dridex - Red Canary Threat Detection Report

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Dridex - Red Canary Threat Detection Report

FlawedAmmyy (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor FlawedAmmyy (Malware Family)

Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia

Microsoft Detects New TA505 Malware Attacks After Short Break

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Microsoft Detects New TA505 Malware Attacks After Short Break

Microsoft: SysAid zero-day flaw exploited in Clop ransomware attacks

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Microsoft: SysAid zero-day flaw exploited in Clop ransomware attacks

Clop ransomware claims it breached 130 orgs using GoAnywhere zero-day

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Clop ransomware claims it breached 130 orgs using GoAnywhere zero-day

Cybereason vs. Cl0p Ransomware

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Cybereason vs. Cl0p Ransomware

Clop (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Clop (Malware Family)

TA505 shifts with the times | Proofpoint US

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor TA505 shifts with the times | Proofpoint US

Energy giant Shell discloses data breach after Accellion hack

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Energy giant Shell discloses data breach after Accellion hack

Microsoft: Iranian hacking groups join Papercut attack spree

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Microsoft: Iranian hacking groups join Papercut attack spree

Cl0p in Your Network? Here's How to Find Out

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Cl0p in Your Network? Here's How to Find Out

Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia

Buhtrap, Ratopak Spider - Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Buhtrap, Ratopak Spider - Threat Group Cards: A Threat Actor Encyclopedia

Dridex (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Dridex (Malware Family)

Triton (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Triton (Malware Family)

Zeus (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Zeus (Malware Family)

New ServHelper Variant Employs Excel 4.0 Macro to drop Singed Payload

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor New ServHelper Variant Employs Excel 4.0 Macro to drop Singed Payload

#StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability | CISA

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor #StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability | CISA

Wizard Spider, Gold Blackburn - Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Wizard Spider, Gold Blackburn - Threat Group Cards: A Threat Actor Encyclopedia

Latest Trickbot Variant has New Tricks Up Its Sleeve

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Latest Trickbot Variant has New Tricks Up Its Sleeve

Global Accellion data breaches linked to Clop ransomware gang

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Global Accellion data breaches linked to Clop ransomware gang

Cyber Security Research

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research

Locky (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Locky (Malware Family)

TA505, Graceful Spider, Gold Evergreen

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor TA505, Graceful Spider, Gold Evergreen

Dridex Malware | CISA

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Dridex Malware | CISA

Clop Ransomware Now Kills Windows 10 Apps and 3rd Party Tools

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Clop Ransomware Now Kills Windows 10 Apps and 3rd Party Tools

Ransomware gang now using critical Windows flaw in attacks

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Ransomware gang now using critical Windows flaw in attacks

artik.blue is for sale! Check it out on ExpiredDomains.com

date ORKL added it fromORKL

The original link failed its last check. Original publisher Detailsfor artik.blue is for sale! Check it out on ExpiredDomains.com

Everything You Need to Know About LockBit

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Everything You Need to Know About LockBit

TA505: Variety in Use of ServHelper and FlawedAmmyy

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor TA505: Variety in Use of ServHelper and FlawedAmmyy

TA505 Uses HTML, RATs, Other Techniques in Campaigns

date ORKL added it fromORKL

The original link failed its last check. Original publisher Detailsfor TA505 Uses HTML, RATs, Other Techniques in Campaigns

Mercenary Akula Hits Ukraine-Supporting Financial Institution

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mercenary Akula Hits Ukraine-Supporting Financial Institution

Curly COMrades: A New Threat Actor Targeting Geopolitical Hotbeds

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Curly COMrades: A New Threat Actor Targeting Geopolitical Hotbeds

TLP-CLEAR-31072025-ShadowSyndicate-infrastructure-illumination-EN.pdf

Malpedia library date Julien DUGAY fromORKL

Archived copy on ORKL Detailsfor TLP-CLEAR-31072025-ShadowSyndicate-infrastructure-illumination-EN.pdf

Operation CargoTalon : UNG0901 Targets Russian Aerospace & Defense Sector using EAGLET implant.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation CargoTalon : UNG0901 Targets Russian Aerospace & Defense Sector using EAGLET implant.

10 Things I Hate About Attribution: RomCom vs. TransferLoader | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 10 Things I Hate About Attribution: RomCom vs. TransferLoader | Proofpoint US

Operation Endgame: Do Takedowns and Arrests Matter?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Endgame: Do Takedowns and Arrests Matter?

Horns&Hooves campaign delivers NetSupport RAT and BurnsRAT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Horns&Hooves campaign delivers NetSupport RAT and BurnsRAT

Ransomware Review: First Half of 2024

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware Review: First Half of 2024

Largest ever operation against botnets hits dropper malware ecosystem

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Largest ever operation against botnets hits dropper malware ecosystem

m-trends-2024.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor m-trends-2024.pdf

Unveiling custom packers: A comprehensive guide

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unveiling custom packers: A comprehensive guide

Rewterz Threat Alert - Widely Abused MSIX App Installer Disabled by Microsoft – Active IOCs - Rewterz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rewterz Threat Alert - Widely Abused MSIX App Installer Disabled by Microsoft – Active IOCs - Rewterz

Russian developer of Trickbot malware pleads guilty, faces 35-year sentence

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Russian developer of Trickbot malware pleads guilty, faces 35-year sentence

Monthly news - December 2023

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Monthly news - December 2023

2023 State of The Threat – A Year in Review

Malpedia library date Secureworks fromORKL

Archived copy on ORKL Detailsfor 2023 State of The Threat – A Year in Review

Sekoia.io mid-2023 Ransomware Threat Landscape

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sekoia.io mid-2023 Ransomware Threat Landscape

Multiple Foreign Nationals Charged in Connection with Trickbot Malware and Conti Ransomware Conspiracies

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Multiple Foreign Nationals Charged in Connection with Trickbot Malware and Conti Ransomware Conspiracies

Trickbot in Light of Trickleaks Data

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trickbot in Light of Trickleaks Data

Incident Response trends Q2 2023: Data theft extortion rises, while healthcare is still most-targeted vertical

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Incident Response trends Q2 2023: Data theft extortion rises, while healthcare is still most-targeted vertical

TrueBot Analysis Part IV - Config Extraction

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrueBot Analysis Part IV - Config Extraction

Increased Truebot Activity Infects U.S. and Canada Based Networks | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Increased Truebot Activity Infects U.S. and Canada Based Networks | CISA

Monthly news - July 2023

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Monthly news - July 2023

Clop Ransomware: History, Timeline, And Adversary Simulation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Clop Ransomware: History, Timeline, And Adversary Simulation

A Truly Graceful Wipe Out

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor A Truly Graceful Wipe Out

Carbon Black’s TrueBot Detection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Carbon Black’s TrueBot Detection

Research As A Service | Loginsoft

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Research As A Service | Loginsoft

Taming the Storm- Understanding and Mitigating the Consequences of CVE-2023-27350

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Taming the Storm- Understanding and Mitigating the Consequences of CVE-2023-27350

Elastic Security Labs discovers the LOBSHOT malware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Elastic Security Labs discovers the LOBSHOT malware

Elastic Security Labs discovers the LOBSHOT malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Elastic Security Labs discovers the LOBSHOT malware

m_trends_2023_report.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor m_trends_2023_report.pdf

How Microsoft names threat actors

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor How Microsoft names threat actors

TrueBot Analysis Part III - Capabilities

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrueBot Analysis Part III - Capabilities

RIG___TLP_CLEAR-1.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RIG___TLP_CLEAR-1.pdf

TrueBot Analysis Part II - Static unpacker

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrueBot Analysis Part II - Static unpacker

Recent TZW Campaigns Revealed As Part of GlobeImposter Malware Family

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Recent TZW Campaigns Revealed As Part of GlobeImposter Malware Family

Recent TZW Campaigns Revealed As Part of GlobeImposter Malware Family

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Recent TZW Campaigns Revealed As Part of GlobeImposter Malware Family

TrueBot Analysis Part I - A short glimpse into packed TrueBot samples

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor TrueBot Analysis Part I - A short glimpse into packed TrueBot samples

TrueBot Analysis Part I - A short glimpse into packed TrueBot samples

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrueBot Analysis Part I - A short glimpse into packed TrueBot samples

United States and United Kingdom Sanction Members of Russia-Based Trickbot Cybercrime Gang

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor United States and United Kingdom Sanction Members of Russia-Based Trickbot Cybercrime Gang

Investigating Intrusions From Intriguing Exploits

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Investigating Intrusions From Intriguing Exploits

Investigating Intrusions From Intriguing Exploits

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Investigating Intrusions From Intriguing Exploits

Following the Scent of TrickGate: 6-Year-Old Packer Used to Deploy the Most Wanted Malware - Check Point Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Following the Scent of TrickGate: 6-Year-Old Packer Used to Deploy the Most Wanted Malware - Check Point Research

Navigating the Vast Ocean of Sandbox Evasions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Navigating the Vast Ocean of Sandbox Evasions

Breaking the silence - Recent Truebot activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Breaking the silence - Recent Truebot activity

Breaking the silence - Recent Truebot activity

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Breaking the silence - Recent Truebot activity

Eu_Repo_C_APT_profile_Conti_Wizard_Spider_dc2a733e18.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Eu_Repo_C_APT_profile_Conti_Wizard_Spider_dc2a733e18.pdf

GraceWire / FlawedGrace malware adventure

Malpedia library date fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor GraceWire / FlawedGrace malware adventure

LockBit 3.0 Being Distributed via Amadey Bot - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor LockBit 3.0 Being Distributed via Amadey Bot - ASEC

LockBit 3.0 Being Distributed via Amadey Bot

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor LockBit 3.0 Being Distributed via Amadey Bot

Black Basta Ransomware - Attacks Deploy Custom EDR Evasion Tools Tied to FIN7 Threat Actor

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Black Basta Ransomware - Attacks Deploy Custom EDR Evasion Tools Tied to FIN7 Threat Actor

Black Basta Ransomware | Attacks Deploy Custom EDR Evasion Tools Tied to FIN7 Threat Actor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Black Basta Ransomware | Attacks Deploy Custom EDR Evasion Tools Tied to FIN7 Threat Actor

Banking Trojan Techniques: How Financially Motivated Malware Became Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Banking Trojan Techniques: How Financially Motivated Malware Became Infrastructure

Microsoft links Raspberry Robin worm to Clop ransomware attacks

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Microsoft links Raspberry Robin worm to Clop ransomware attacks

Raspberry Robin worm part of larger ecosystem facilitating pre-ransomware activity

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Raspberry Robin worm part of larger ecosystem facilitating pre-ransomware activity

Microsoft links Raspberry Robin worm to Clop ransomware attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft links Raspberry Robin worm to Clop ransomware attacks

Raspberry Robin worm part of larger ecosystem facilitating pre-ransomware activity | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Raspberry Robin worm part of larger ecosystem facilitating pre-ransomware activity | Microsoft Security Blog

2022%20Q3%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2022%20Q3%20Botnet%20Threat%20Update.pdf

Outpost24_Gracewrapper_Report_2022.pdf?_hsmi=229071559

file creation date fromORKL

Archived copy on ORKL Detailsfor Outpost24_Gracewrapper_Report_2022.pdf?_hsmi=229071559

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense

TeslaGun_TLPWHITE.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TeslaGun_TLPWHITE.pdf

202208291500_Evil Corp Threat Profile_TLPWHITE

file creation date fromORKL

Archived copy on ORKL Detailsfor 202208291500_Evil Corp Threat Profile_TLPWHITE

DCShadow Attacks: Detecting a Rogue Domain Controller

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DCShadow Attacks: Detecting a Rogue Domain Controller

Mandiant Red Team Emulates FIN11 Tactics To Control Operational Technology Servers | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mandiant Red Team Emulates FIN11 Tactics To Control Operational Technology Servers | Mandiant

Mandiant Red Team Emulates FIN11 Tactics To Control Operational Technology Servers

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Mandiant Red Team Emulates FIN11 Tactics To Control Operational Technology Servers

Amadey Bot Being Distributed Through SmokeLoader - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Amadey Bot Being Distributed Through SmokeLoader - ASEC

Amadey Bot Being Distributed Through SmokeLoader

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Amadey Bot Being Distributed Through SmokeLoader

Malware analysis with IDA/Radare2 - Basic Unpacking (Dridex first stage)

Malpedia library date fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor Malware analysis with IDA/Radare2 - Basic Unpacking (Dridex first stage)

The hateful eight- Kaspersky’s guide to modern ransomware groups’ TTPs (Download Form)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The hateful eight- Kaspersky’s guide to modern ransomware groups’ TTPs (Download Form)

Common-TTPs-of-the-modern-ransomware_low-res.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Common-TTPs-of-the-modern-ransomware_low-res.pdf

The hateful eight: Kaspersky’s guide to modern ransomware groups’ TTPs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The hateful eight: Kaspersky’s guide to modern ransomware groups’ TTPs

Attack Graph Emulating the Conti Ransomware Team’s Behaviors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attack Graph Emulating the Conti Ransomware Team’s Behaviors

Conti Targets Critical Firmware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti Targets Critical Firmware

To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions | Mandiant

THALES%20THREAT%20HANDBOOK%202022%20Light%20Version_1.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor THALES%20THREAT%20HANDBOOK%202022%20Light%20Version_1.pdf

Clop ransomware gang is back, hits 21 victims in a single month

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Clop ransomware gang is back, hits 21 victims in a single month

SocGholish Campaigns and Initial Access Kit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SocGholish Campaigns and Initial Access Kit

SocGholish Campaigns and Initial Access Kit

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor SocGholish Campaigns and Initial Access Kit

4 Types of Dropper Malware in Microsoft Office & How to Detect Them | Deep Instinct

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 4 Types of Dropper Malware in Microsoft Office & How to Detect Them | Deep Instinct

Malware Analysis: Trickbot

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Analysis: Trickbot

Weaponization of Excel Add-Ins Part 2: Dridex Infection Chain Case Studies

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Weaponization of Excel Add-Ins Part 2: Dridex Infection Chain Case Studies

Ransomware Spotlight: RansomEXX

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware Spotlight: RansomEXX

Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself | Microsoft Security Blog

Ransomware: How Attackers are Breaching Corporate Networks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware: How Attackers are Breaching Corporate Networks

The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection

20220427_NP_TLPWHITE_ANSSI_FIN7.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 20220427_NP_TLPWHITE_ANSSI_FIN7.pdf

Conti and Emotet: A constantly destructive duo

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti and Emotet: A constantly destructive duo

AA22-110A_Joint_CSA_Russian_State-Sponsored_and_Criminal_Cyber_Threats_to_Critical_Infrastructure_4_20_22_Final.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AA22-110A_Joint_CSA_Russian_State-Sponsored_and_Criminal_Cyber_Threats_to_Critical_Infrastructure_4_20_22_Final.pdf

Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure | CISA

Lessons from the Conti Leaks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lessons from the Conti Leaks

Karakurt revealed as data extortion arm of Conti cybercrime syndicate

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Karakurt revealed as data extortion arm of Conti cybercrime syndicate

The Karakurt Web: Threat Intel and Blockchain Analysis Reveals Extension of Conti Business Model

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Karakurt Web: Threat Intel and Blockchain Analysis Reveals Extension of Conti Business Model

RL Blog | ReversingLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RL Blog | ReversingLabs

Move fast and commit crimes: Conti’s development teams mirror corporate tech

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Move fast and commit crimes: Conti’s development teams mirror corporate tech

Conti Ransomware V. 3, Including Decryptor, Leaked

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti Ransomware V. 3, Including Decryptor, Leaked

Mēris and TrickBot standing on the shoulders of giants

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mēris and TrickBot standing on the shoulders of giants

Uncovering Trickbot’s use of IoT devices in command-and-control infrastructure | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Uncovering Trickbot’s use of IoT devices in command-and-control infrastructure | Microsoft Security Blog

Cutting corners against a Dridex downloader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cutting corners against a Dridex downloader

CISA updates Conti ransomware alert with nearly 100 domain names

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CISA updates Conti ransomware alert with nearly 100 domain names

Conti Ransomware Decryptor, TrickBot Source Code Leaked

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti Ransomware Decryptor, TrickBot Source Code Leaked

Conti Ransomware Group Diaries, Part II: The Office

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti Ransomware Group Diaries, Part II: The Office

Conti Group Leaked!

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti Group Leaked!

2021trends.pdf

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor 2021trends.pdf

TrickBot malware suddenly got quiet, researchers say, but it’s hardly the end for its operators

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot malware suddenly got quiet, researchers say, but it’s hardly the end for its operators

TrickBot gang shuts down botnet after months of inactivity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot gang shuts down botnet after months of inactivity

TrickBot Gang Likely Shifting Operations to Switch to New Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot Gang Likely Shifting Operations to Switch to New Malware

Notorious TrickBot Malware Gang Shuts Down its Botnet Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Notorious TrickBot Malware Gang Shuts Down its Botnet Infrastructure

Sanctions Be Damned | From Dridex to Macaw, The Evolution of Evil Corp

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sanctions Be Damned | From Dridex to Macaw, The Evolution of Evil Corp

Ransomware Spotlight: Clop

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware Spotlight: Clop

Cybercrime Moves: Conti Ransomware Absorbs TrickBot Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cybercrime Moves: Conti Ransomware Absorbs TrickBot Malware

Ransomware Spotlight- Clop

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Ransomware Spotlight- Clop

Trickbot operation is now controlled by Conti ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trickbot operation is now controlled by Conti ransomware

Conti ransomware gang takes over TrickBot malware operation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti ransomware gang takes over TrickBot malware operation

A Modern Ninja: Evasive Trickbot Attacks Customers of 60 High-Profile Companies

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Modern Ninja: Evasive Trickbot Attacks Customers of 60 High-Profile Companies

TrickBot Ravages Customers of Amazon, PayPal and Other Top Brands

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot Ravages Customers of Amazon, PayPal and Other Top Brands

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense

Annual Threat trends 2021

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Annual Threat trends 2021

PrivateLoader: The first step in many malware schemes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PrivateLoader: The first step in many malware schemes

TrickBot gang template-based metaprogramming Bazar malware

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor TrickBot gang template-based metaprogramming Bazar malware

Inside Trickbot, Russia’s Notorious Ransomware Gang

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Inside Trickbot, Russia’s Notorious Ransomware Gang

S1_-SentinelLabs_SanctionsBeDamned_final_02.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor S1_-SentinelLabs_SanctionsBeDamned_final_02.pdf

Log4j Exploit Hits Again: Vulnerable Unifi Network Application (Ubiquiti) at Risk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Log4j Exploit Hits Again: Vulnerable Unifi Network Application (Ubiquiti) at Risk

Log4j Exploit Hits Again- Vulnerable Unifi Network Application (Ubiquiti) at Risk

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Log4j Exploit Hits Again- Vulnerable Unifi Network Application (Ubiquiti) at Risk

Deep Dive into Trickbot's Web Injection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Deep Dive into Trickbot's Web Injection

Microsoft Word - DiavolFLASH Approved FINAL 01192022

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Microsoft Word - DiavolFLASH Approved FINAL 01192022

2021 Adversary Infrastructure Report

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2021 Adversary Infrastructure Report

Malware Headliners- Dridex

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Malware Headliners- Dridex

Log4j Vulnerabilities: Attack Insights

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Log4j Vulnerabilities: Attack Insights

Advanced Network Detection & Response - MetaDefender NDR - OPSWAT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Advanced Network Detection & Response - MetaDefender NDR - OPSWAT

24/7 managed detection, response, and expert cybersecurity services - GoSecure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 24/7 managed detection, response, and expert cybersecurity services - GoSecure

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research

Tracking a P2P network related to TA505

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Tracking a P2P network related to TA505

Dridex Trojan

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dridex Trojan

Dridex Trojan - Defeating Anti-Analysis - Strings Decryption - C&C Extraction

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Dridex Trojan - Defeating Anti-Analysis - Strings Decryption - C&C Extraction

Global Operations Lead to Arrests of Alleged Members of GandCrab REvil and Cl0p Cartels

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Global Operations Lead to Arrests of Alleged Members of GandCrab REvil and Cl0p Cartels

FINDING BEACONS IN THE DARK 1650728751599

Malpedia library date BlackBerry fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor FINDING BEACONS IN THE DARK 1650728751599

TrickBot helps Emotet come back from the dead

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot helps Emotet come back from the dead

The Business of Fraud: Botnet Malware Dissemination

Malpedia library date Insikt Group® fromORKL

Archived copy on ORKL Detailsfor The Business of Fraud: Botnet Malware Dissemination

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research

TA505 exploits SolarWinds Serv-U vulnerability (CVE-2021-35211) for initial access

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TA505 exploits SolarWinds Serv-U vulnerability (CVE-2021-35211) for initial access

TA505 exploits SolarWinds Serv-U vulnerability (CVE-2021-35211) for initial access – NCC Group Research

date in the CCS '25 data NCC Group fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor TA505 exploits SolarWinds Serv-U vulnerability (CVE-2021-35211) for initial access – NCC Group Research

TA505 exploits SolarWinds Serv-U vulnerability (CVE-2021-35211) for initial access

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor TA505 exploits SolarWinds Serv-U vulnerability (CVE-2021-35211) for initial access

12 targeted for involvement in ransomware attacks against critical infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 12 targeted for involvement in ransomware attacks against critical infrastructure

Національна поліція України

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Національна поліція України

Russian National Extradited to United States to Face Charges for Alleged Role in Cybercriminal Organization

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Russian National Extradited to United States to Face Charges for Alleged Role in Cybercriminal Organization

TrickBot ... many tricks - VinCSS Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot ... many tricks - VinCSS Blog

Stopping GRACEFUL SPIDER: Falcon Complete’s Fast Response to Recent SolarWinds Serv-U Exploit Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Stopping GRACEFUL SPIDER: Falcon Complete’s Fast Response to Recent SolarWinds Serv-U Exploit Campaign

Stopping GRACEFUL SPIDER- Falcon Complete’s Fast Response to Recent SolarWinds Serv-U Exploit Campaign

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Stopping GRACEFUL SPIDER- Falcon Complete’s Fast Response to Recent SolarWinds Serv-U Exploit Campaign

Trickbot module descriptions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trickbot module descriptions

Whatta TA_ TA505 Ramps Up Activity, Delivers New FlawedGrace Variant _ Proofpoint US

date in the CCS '25 data Proofpoint fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Whatta TA_ TA505 Ramps Up Activity, Delivers New FlawedGrace Variant _ Proofpoint US

TA505: Malware Activity & New FlawedGrace Variant | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TA505: Malware Activity & New FlawedGrace Variant | Proofpoint US

Whatta TA- TA505 Ramps Up Activity, Delivers New FlawedGrace Variant

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Whatta TA- TA505 Ramps Up Activity, Delivers New FlawedGrace Variant

Explosive New MirrorBlast Campaign Targets Financial Companies

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Explosive New MirrorBlast Campaign Targets Financial Companies

Explosive New MirrorBlast Campaign Targets Financial Companies

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Explosive New MirrorBlast Campaign Targets Financial Companies

TrickBot gang doubles down enterprise infection

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor TrickBot gang doubles down enterprise infection

New Trickbot and BazarLoader delivery vectors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Trickbot and BazarLoader delivery vectors

Ransomware as a Service: Enabler of Widespread Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware as a Service: Enabler of Widespread Attacks

The REBOL Yell: A New Novel REBOL Exploit | FRSecure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The REBOL Yell: A New Novel REBOL Exploit | FRSecure

Threat hunting in large datasets by clustering security events

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat hunting in large datasets by clustering security events

HP Wolf Security Threat Insights Report Q3 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor HP Wolf Security Threat Insights Report Q3 2021

MirrorBlast and TA505- Examining Similarities in Tactics, Techniques and Procedures

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor MirrorBlast and TA505- Examining Similarities in Tactics, Techniques and Procedures

MirrorBlast and TA505: Examining Similarities in Tactics, Techniques and Procedures

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MirrorBlast and TA505: Examining Similarities in Tactics, Techniques and Procedures

Phishing Eager Travelers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Phishing Eager Travelers

Big Game Hunting TTPs Continue to Shift After DarkSide Pipeline Attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Big Game Hunting TTPs Continue to Shift After DarkSide Pipeline Attack

Big Game Hunting TTPs Continue to Shift After DarkSide Pipeline Attack

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Big Game Hunting TTPs Continue to Shift After DarkSide Pipeline Attack

TrickBot gang developer arrested when trying to leave Korea

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot gang developer arrested when trying to leave Korea

The State of SSL/TLS Certificate Usage in Malware C&C Communications

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The State of SSL/TLS Certificate Usage in Malware C&C Communications

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog

The Ransomware Threat (White Paper)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Ransomware Threat (White Paper)

Signed MSI files, Raccoon and Amadey are used for installing ServHelper RAT

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Signed MSI files, Raccoon and Amadey are used for installing ServHelper RAT

Signed MSI files, Raccoon and Amadey are used for installing ServHelper RAT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Signed MSI files, Raccoon and Amadey are used for installing ServHelper RAT

BazarCall to Conti Ransomware via Trickbot and Cobalt Strike

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor BazarCall to Conti Ransomware via Trickbot and Cobalt Strike

Detecting TA551 domains

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detecting TA551 domains

Detecting Trickbot with Splunk | Splunk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detecting Trickbot with Splunk | Splunk

ASEC_REPORT_vol.103_ENG

date in the CCS '25 data AhnLab fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ASEC_REPORT_vol.103_ENG

Macintosh HD:Users:Shared:dd:4work:Bitdefender-PR-Whitepaper-DarkNexus-creat4349-en_EN:Bitdefender-PR-Whitepaper-DarkNexus-creat4349-en_EN.indd

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Macintosh HD:Users:Shared:dd:4work:Bitdefender-PR-Whitepaper-DarkNexus-creat4349-en_EN:Bitdefender-PR-Whitepaper-DarkNexus-creat4349-en_EN.indd

Morgan Stanley reports data breach after vendor Accellion hack

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Morgan Stanley reports data breach after vendor Accellion hack

TA505 adds GoLang crypter for delivering miners and ServHelper

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor TA505 adds GoLang crypter for delivering miners and ServHelper

TA505 adds GoLang crypter for delivering miners and ServHelper

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TA505 adds GoLang crypter for delivering miners and ServHelper

Dridex Document to Cobalt Strike – Malware Book Reports

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dridex Document to Cobalt Strike – Malware Book Reports

TrickBot: New attacks see the botnet deploy new banking module, new ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot: New attacks see the botnet deploy new banking module, new ransomware

TrickBot and Zeus

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot and Zeus

Malware Masquerades as Privacy Tool

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Malware Masquerades as Privacy Tool

filedownload.do?attach_file_seq=2808&attach_file_id=EpF2808.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor filedownload.do?attach_file_seq=2808&attach_file_id=EpF2808.pdf

Ukrainian Police Nab Six Tied to CLOP Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ukrainian Police Nab Six Tied to CLOP Ransomware

Ukrainian police arrest Clop ransomware members, seize server infrastructure

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Ukrainian police arrest Clop ransomware members, seize server infrastructure

How Initial Access Brokers Lead to Ransomware | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How Initial Access Brokers Lead to Ransomware | Proofpoint US

Національна поліція України

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Національна поліція України

Ukrainian police arrest Clop ransomware members, seize server infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ukrainian police arrest Clop ransomware members, seize server infrastructure

Detecting UEFI Bootkits in the Wild (Part 1)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detecting UEFI Bootkits in the Wild (Part 1)

Ransomware Double Extortion and Beyond: REvil, Clop, and Conti

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware Double Extortion and Beyond: REvil, Clop, and Conti

Intel 471

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Intel 471

Inside the SystemBC Malware-As-A-Service

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Inside the SystemBC Malware-As-A-Service

Latvian National Charged for Alleged Role in Transnational Cybercrime Organization

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Latvian National Charged for Alleged Role in Transnational Cybercrime Organization

US arrests Latvian woman who worked on Trickbot malware source code

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor US arrests Latvian woman who worked on Trickbot malware source code

A Deep Dive into Packing Software CryptOne

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Deep Dive into Packing Software CryptOne

Look how many cybercriminals love Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Look how many cybercriminals love Cobalt Strike

Campo, a New Attack Campaign Targeting Japan - Mal-Eats

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Campo, a New Attack Campaign Targeting Japan - Mal-Eats

Response When Minutes Matter: Rising Up Against Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Response When Minutes Matter: Rising Up Against Ransomware

日本を狙う新たな攻撃キャンペーン Campo の全体像 - Mal-Eats

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 日本を狙う新たな攻撃キャンペーン Campo の全体像 - Mal-Eats

Clop Ransomware Detection: Threat Research Release, April 2021 | Splunk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Clop Ransomware Detection: Threat Research Release, April 2021 | Splunk

Trickbot Brief: Creds and Beacons

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Trickbot Brief: Creds and Beacons

Ransomware Attack Vectors shift as New Software Vulnerability Exploits Abound

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware Attack Vectors shift as New Software Vulnerability Exploits Abound

Ransomware and Data Leak Site Publication Time Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware and Data Leak Site Publication Time Analysis

Security Brief: Threat Actors Pair Tax-Themed Lures With COVID-19, Healthcare Themes | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Security Brief: Threat Actors Pair Tax-Themed Lures With COVID-19, Healthcare Themes | Proofpoint US

Meet the Ransomware Gang Behind One of the Biggest Supply Chain Hacks Ever

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Meet the Ransomware Gang Behind One of the Biggest Supply Chain Hacks Ever

Meet The Ransomware Gang Behind One of the Biggest Supply Chain Hacks Ever

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Meet The Ransomware Gang Behind One of the Biggest Supply Chain Hacks Ever

Detecting Clop Ransomware | Splunk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detecting Clop Ransomware | Splunk

Threat Assessment: Clop Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Assessment: Clop Ransomware

Threat Assessment- Clop Ransomware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Threat Assessment- Clop Ransomware

PaaS, or how hackers evade antivirus software

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor PaaS, or how hackers evade antivirus software

mtrends-2021

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor mtrends-2021

EtterSilent: the underground’s new favorite maldoc builder

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor EtterSilent: the underground’s new favorite maldoc builder

Dridex Loader Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dridex Loader Analysis

TrickBot Crews New CobaltStrike Loader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot Crews New CobaltStrike Loader

Financial Cyberthreats in 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Financial Cyberthreats in 2020

2021-Threat-Detection-Report.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2021-Threat-Detection-Report.pdf

Dridex Reloaded: Analysis of a New Dridex Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dridex Reloaded: Analysis of a New Dridex Campaign

Ransomware gang urges victims’ customers to demand a ransom payment

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware gang urges victims’ customers to demand a ransom payment

report-bb-2021-threat-report.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor report-bb-2021-threat-report.pdf

SilverFish_TLPWHITE.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SilverFish_TLPWHITE.pdf

HP_Bromium_Threat_Insights_Report_Q4_2020_V5.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor HP_Bromium_Threat_Insights_Report_Q4_2020_V5.pdf

TrickBot Malware | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot Malware | CISA

DEWMODE Web Shell Used on Accellion FTA Appliances

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DEWMODE Web Shell Used on Accellion FTA Appliances

CL0P and REvil Escalate Their Ransomware Tactics

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CL0P and REvil Escalate Their Ransomware Tactics

MineBridge Is on the Rise, With a Sophisticated Delivery Mechanism

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor MineBridge Is on the Rise, With a Sophisticated Delivery Mechanism

An Exhaustively-Analyzed IDB for FlawedGrace — Möbius Strip Reverse Engineering

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor An Exhaustively-Analyzed IDB for FlawedGrace — Möbius Strip Reverse Engineering

Cyber Threats 2020: A Year in Retrospect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Threats 2020: A Year in Retrospect

CERTFR-2021-CTI-006.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERTFR-2021-CTI-006.pdf

Report2021GTR.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Report2021GTR.pdf

The_CrowdStrike_2021_Global_Threat_Report

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The_CrowdStrike_2021_Global_Threat_Report

MINEBRIDGE Remote-access Trojan (RAT) 2021 | Zscaler Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MINEBRIDGE Remote-access Trojan (RAT) 2021 | Zscaler Blog

Return of the MINEBRIDGE RAT With New TTPs and Social Engineering Lures

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Return of the MINEBRIDGE RAT With New TTPs and Social Engineering Lures

Cyber Criminals Exploit Accellion FTA for Data Theft and Extortion

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Cyber Criminals Exploit Accellion FTA for Data Theft and Extortion

Threat Actors Exploit Accellion FTA for Data Theft and Extortion

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Actors Exploit Accellion FTA for Data Theft and Extortion

Operation SyncTrek

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation SyncTrek

Probable Iranian Cyber Actors, Static Kitten, Conducting Cyberespionage Campaign Targeting UAE and Kuwait Government Agencies

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Probable Iranian Cyber Actors, Static Kitten, Conducting Cyberespionage Campaign Targeting UAE and Kuwait Government Agencies

Probable Iranian Cyber Actors, Static Kitten, Conducting Cyberespionage Campaign Targeting UAE and Kuwait Government Agencies

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Probable Iranian Cyber Actors, Static Kitten, Conducting Cyberespionage Campaign Targeting UAE and Kuwait Government Agencies

ESET_Threat_Report_Q42020.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET_Threat_Report_Q42020.pdf

Dridex Malware Analysis [1 Feb 2021]

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dridex Malware Analysis [1 Feb 2021]

De ataque con Malware a incidente de Ransomware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor De ataque con Malware a incidente de Ransomware

TrickBot masrv Module

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot masrv Module

What tracking an attacker email infrastructure tells us about persistent cybercriminal operations | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What tracking an attacker email infrastructure tells us about persistent cybercriminal operations | Microsoft Security Blog

Anchor and Lazarus together again?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Anchor and Lazarus together again?

Dridex Malicious Document Analysis: Automating the Extraction of Payload URLs | HP Wolf Security

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dridex Malicious Document Analysis: Automating the Extraction of Payload URLs | HP Wolf Security

Funtastic Packers And Where To Find Them

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Funtastic Packers And Where To Find Them

Wireshark Tutorial: Examining Emotet Infection Traffic

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Wireshark Tutorial: Examining Emotet Infection Traffic

Trickbot Still Alive and Well

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Trickbot Still Alive and Well

Holiday Bazar: Tracking a TrickBot-Related Ransomware Incident - DomainTools | Start Here. Know Now.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Holiday Bazar: Tracking a TrickBot-Related Ransomware Incident - DomainTools | Start Here. Know Now.

[Threat Analysis] CLOP Ransomware that Attacked Korean Distribution Giant - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor [Threat Analysis] CLOP Ransomware that Attacked Korean Distribution Giant - ASEC

research.checkpoint.com-Stopping Serial Killer Catching the Next Strike

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor research.checkpoint.com-Stopping Serial Killer Catching the Next Strike

Stopping Serial Killer: Catching the Next Strike - Check Point Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Stopping Serial Killer: Catching the Next Strike - Check Point Research

DRIDEX Stopping Serial Killer- Catching the Next Strike

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor DRIDEX Stopping Serial Killer- Catching the Next Strike

Building a Custom Malware Analysis Lab Environment - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Building a Custom Malware Analysis Lab Environment - SentinelLabs

TrickBot: A Closer Look

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot: A Closer Look

TA505s modified loader means new attack campaign could be coming

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor TA505s modified loader means new attack campaign could be coming

DebUNCing Attribution How Mandiant Tracks Uncategorized Threat Actors

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor DebUNCing Attribution How Mandiant Tracks Uncategorized Threat Actors

Using Qiling Framework to Unpack TA505 packed samples

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Using Qiling Framework to Unpack TA505 packed samples

Using Qiling Framework to Unpack TA505 packed samples

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Using Qiling Framework to Unpack TA505 packed samples

Cyber Actors Target K-12 Distance Learning Education to Cause Disruptions and Steal Data | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Actors Target K-12 Distance Learning Education to Cause Disruptions and Steal Data | CISA

Cybereason vs. Ryuk Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cybereason vs. Ryuk Ransomware

Report2020CrowdStrikeServicesCyberFrontLines.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor Report2020CrowdStrikeServicesCyberFrontLines.pdf

Ransomware gang says they stole 2 million credit cards from E-Land

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware gang says they stole 2 million credit cards from E-Land

TrickBot Now Offers "TrickBoot": Persist, Brick, Profit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot Now Offers "TrickBoot": Persist, Brick, Profit

Analysis_ReportCLOP_Ransomware.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis_ReportCLOP_Ransomware.pdf

[S2W LAB] Analysis of Clop Ransomware suspiciously related to the Recent Incident (English)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor [S2W LAB] Analysis of Clop Ransomware suspiciously related to the Recent Incident (English)

Bitdefender Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bitdefender Labs

LightBot: TrickBot’s new reconnaissance malware for high-value targets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor LightBot: TrickBot’s new reconnaissance malware for high-value targets

The malware that usually installs ransomware and you need to remove right away

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The malware that usually installs ransomware and you need to remove right away

Easily Identify Malicious Servers on the Internet with JARM - Salesforce Engineering Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Easily Identify Malicious Servers on the Internet with JARM - Salesforce Engineering Blog

TA505- A Brief History Of Their Time

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor TA505- A Brief History Of Their Time

TA505_ A Brief History Of Their Time – Fox-IT International blog

date in the CCS '25 data Fox-IT fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor TA505_ A Brief History Of Their Time – Fox-IT International blog

TA505: A Brief History Of Their Time

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TA505: A Brief History Of Their Time

Splunking with Sysmon Part 4: Detecting Trickbot

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Splunking with Sysmon Part 4: Detecting Trickbot

Kaspersky-Attacks-on-industrial-enterprises-using-RMS-and-TeamViewer-EN.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Kaspersky-Attacks-on-industrial-enterprises-using-RMS-and-TeamViewer-EN.pdf

Trick or Threat: Ryuk Ransomware Targets Health Care Industry

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trick or Threat: Ryuk Ransomware Targets Health Care Industry

An Odd Relationship – One Night in Norfolk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor An Odd Relationship – One Night in Norfolk

TinyPOS and ProLocker- An Odd Relationship

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor TinyPOS and ProLocker- An Odd Relationship

A Bazar start: How one hospital thwarted a Ryuk ransomware outbreak

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Bazar start: How one hospital thwarted a Ryuk ransomware outbreak

Threat Assessment: Ryuk Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Assessment: Ryuk Ransomware

CERTFR-2020-CTI-010.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERTFR-2020-CTI-010.pdf

FIN11- A Widespread Ransomware and Extortion Operation (Webinar)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor FIN11- A Widespread Ransomware and Extortion Operation (Webinar)

Dropping the Anchor | NETSCOUT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dropping the Anchor | NETSCOUT

Leakware-Ransomware-Hybrid Attacks

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Leakware-Ransomware-Hybrid Attacks

Die Lage der IT-Sicherheit in Deutschland 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Die Lage der IT-Sicherheit in Deutschland 2020

An update on disruption of Trickbot - Microsoft On the Issues

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor An update on disruption of Trickbot - Microsoft On the Issues

Wizard Spider Modifies and Expands Toolset [Adversary Update]

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Wizard Spider Modifies and Expands Toolset [Adversary Update]

Officials Announce International Operation Targeting Transnational Criminal Organization QQAAZZ that Provided Money Laundering Services to High-Level Cybercriminals

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Officials Announce International Operation Targeting Transnational Criminal Organization QQAAZZ that Provided Money Laundering Services to High-Level Cybercriminals

FIN11: Widespread Email Campaigns as Precursor for Ransomware and Data Theft | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor FIN11: Widespread Email Campaigns as Precursor for Ransomware and Data Theft | Mandiant

FIN11- Widespread Email Campaigns as Precursor for Ransomware and Data Theft

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor FIN11- Widespread Email Campaigns as Precursor for Ransomware and Data Theft

New action to combat ransomware ahead of U.S. elections - Microsoft On the Issues

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New action to combat ransomware ahead of U.S. elections - Microsoft On the Issues

2020-10-06%20Trickbot%201%20Complaint%20with%20exs.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2020-10-06%20Trickbot%201%20Complaint%20with%20exs.pdf

Trickbot disrupted

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Trickbot disrupted

Trickbot: U.S. Court Order Hits Botnet’s Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trickbot: U.S. Court Order Hits Botnet’s Infrastructure

ESET takes part in global operation to disrupt Trickbot

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET takes part in global operation to disrupt Trickbot

CVE-2020-1472- Advanced Persistent Threat Actors Use Zerologon Vulnerability In Exploit Chain with Unpatched Vulnerabilities

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor CVE-2020-1472- Advanced Persistent Threat Actors Use Zerologon Vulnerability In Exploit Chain with Unpatched Vulnerabilities

Trickbot disrupted

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trickbot disrupted

CVE-2020-1472: Advanced Persistent Threat Actors Use Zerologon Vulnerability In Exploit Chain with Unpatched Vulnerabilities

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CVE-2020-1472: Advanced Persistent Threat Actors Use Zerologon Vulnerability In Exploit Chain with Unpatched Vulnerabilities

Droppers, Downloaders and TrickBot: Detecting a Stealthy COVID-19-themed Campaign using Toolmarks | HP Wolf Security

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Droppers, Downloaders and TrickBot: Detecting a Stealthy COVID-19-themed Campaign using Toolmarks | HP Wolf Security

German tech giant Software AG down after ransomware attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor German tech giant Software AG down after ransomware attack

Eager Beaver: A Short Overview of the Restless Threat Actor TA505

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Eager Beaver: A Short Overview of the Restless Threat Actor TA505

TA505 targets the Americas in a new campaign

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor TA505 targets the Americas in a new campaign

Eager Beaver- A Short Overview of the Restless Threat Actor TA505

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Eager Beaver- A Short Overview of the Restless Threat Actor TA505

TA505 targets the Americas in a new campaign

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor TA505 targets the Americas in a new campaign

Maksim Yakubets

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Maksim Yakubets

Attacks Aimed at Disrupting the Trickbot Botnet

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attacks Aimed at Disrupting the Trickbot Botnet

bazarloader.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor bazarloader.pdf

VB2020 paper: Another threat actor day...

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor VB2020 paper: Another threat actor day...

What's behind the increase in ransomware attacks this year?

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor What's behind the increase in ransomware attacks this year?

What Service NSW has to do with Russia?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What Service NSW has to do with Russia?

Reverse Engineering Dridex and Automating IOC Extraction

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Reverse Engineering Dridex and Automating IOC Extraction

Reverse Engineering Dridex and Automating IOC Extraction

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Reverse Engineering Dridex and Automating IOC Extraction

Partners in crime North Koreans and elite Russian-speaking cybercriminals

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Partners in crime North Koreans and elite Russian-speaking cybercriminals

Partners in crime_ North Koreans and elite Russian-speaking cybercriminals - Intel 471

date in the CCS '25 data Intel 471 fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Partners in crime_ North Koreans and elite Russian-speaking cybercriminals - Intel 471

Recent Dridex activity - SANS Internet Storm Center

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Recent Dridex activity - SANS Internet Storm Center

tweets/2020-09-07-Dridex-IOCs.txt at master · pan-unit42/tweets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor tweets/2020-09-07-Dridex-IOCs.txt at master · pan-unit42/tweets

Trickbot rdpscanDll – Transforming Candidate Credentials for Brute-Forcing RDP Servers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trickbot rdpscanDll – Transforming Candidate Credentials for Brute-Forcing RDP Servers

CERTFR-2020-CTI-009

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor CERTFR-2020-CTI-009

How Ransomware Gangs Find New Monetization Schemes and Evolve in Marketing | KELA Cyber

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How Ransomware Gangs Find New Monetization Schemes and Evolve in Marketing | KELA Cyber

Wireshark Tutorial: Decrypting HTTPS Traffic

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Wireshark Tutorial: Decrypting HTTPS Traffic

CERTFR-2020-CTI-009.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERTFR-2020-CTI-009.pdf

Banking Trojans: A Reference Guide to the Malware Family Tree

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Banking Trojans: A Reference Guide to the Malware Family Tree

Dridex – From Word to Domain Dominance

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Dridex – From Word to Domain Dominance

Dridex - From Word to Domain Dominance

publisher's date The DFIR Report fromDFIR Report

Detailsfor Dridex - From Word to Domain Dominance

ESET_Threat_Report_Q22020.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET_Threat_Report_Q22020.pdf

Enter the Maze: Demystifying an Affiliate Involved in Maze (SNOW) - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Enter the Maze: Demystifying an Affiliate Involved in Maze (SNOW) - SentinelLabs

Emotet-TrickBot malware duo is back infecting Windows machines

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet-TrickBot malware duo is back infecting Windows machines

CERTFR-2020-CTI-008

Malpedia library date CrowdStrike fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor CERTFR-2020-CTI-008

Financially Motivated Actors Are Expanding Access Into OT: Analysis of Kill Lists That Include OT Processes Used With Seven Malware Families | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Financially Motivated Actors Are Expanding Access Into OT: Analysis of Kill Lists That Include OT Processes Used With Seven Malware Families | Mandiant

Blog: Stay Ahead of Cyber Threats

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Blog: Stay Ahead of Cyber Threats

Flowspec - TA505s bulletproof hoster of choice

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Flowspec - TA505s bulletproof hoster of choice

Deep Malware and Phishing Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Deep Malware and Phishing Analysis

TrickBot malware mistakenly warns victims that they are infected

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot malware mistakenly warns victims that they are infected

ServHelper- Hidden Miners

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor ServHelper- Hidden Miners

Hidden Miners: Making a profit for criminals AND keeping a foot in the door

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hidden Miners: Making a profit for criminals AND keeping a foot in the door

Clop, Clop! It’s a TA505 HTML malspam analysis

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Clop, Clop! It’s a TA505 HTML malspam analysis

Obfuscated VBScript Drops Zloader, Ursnif, Qakbot, Dridex

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Obfuscated VBScript Drops Zloader, Ursnif, Qakbot, Dridex

WastedLocker- A New Ransomware Variant Developed By The Evil Corp Group

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor WastedLocker- A New Ransomware Variant Developed By The Evil Corp Group

WastedLocker_ A New Ransomware Variant Developed By The Evil Corp Group – NCC Group Research

date in the CCS '25 data NCC Group fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor WastedLocker_ A New Ransomware Variant Developed By The Evil Corp Group – NCC Group Research

Inside a TrickBot Cobalt Strike Attack Server - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Inside a TrickBot Cobalt Strike Attack Server - SentinelLabs

CERTFR-2020-CTI-006.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERTFR-2020-CTI-006.pdf

Indiabulls Group hit by CLOP Ransomware, gets 24h leak deadline

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Indiabulls Group hit by CLOP Ransomware, gets 24h leak deadline