Wizard Spider

Also reported as Periwinkle Tempest, DEV-0193, UNC1878, TEMP.MixMaster, FIN12 and 15 other names. Linked to Russia by four sources.

Reports: 1,158
Last reported: 19 May 2026
Known CVEs: 499
Techniques in ATT&CK: 64
Origin: Russia

ID: G0102
Sources: ATT&CK MISP ETDA Malpedia Microsoft
Merge evidence: 43 alias matches

Reports per quarter

2015 Q4: 1 report
2016 Q1: no reports
2016 Q2: no reports
2016 Q3: no reports
2016 Q4: 5 reports
2017 Q1: no reports
2017 Q2: 5 reports
2017 Q3: 2 reports
2017 Q4: 1 report
2018 Q1: 5 reports
2018 Q2: 3 reports
2018 Q3: 3 reports
2018 Q4: 12 reports
2019 Q1: 21 reports
2019 Q2: 16 reports
2019 Q3: 8 reports
2019 Q4: 23 reports
2020 Q1: 39 reports
2020 Q2: 31 reports
2020 Q3: 33 reports
2020 Q4: 92 reports
2021 Q1: 71 reports
2021 Q2: 81 reports
2021 Q3: 96 reports
2021 Q4: 87 reports
2022 Q1: 126 reports
2022 Q2: 115 reports
2022 Q3: 59 reports
2022 Q4: 22 reports
2023 Q1: 21 reports
2023 Q2: 12 reports
2023 Q3: 19 reports
2023 Q4: 18 reports
2024 Q1: 7 reports
2024 Q2: 13 reports
2024 Q3: 20 reports
2024 Q4: 13 reports
2025 Q1: 8 reports
2025 Q2: 9 reports
2025 Q3: 7 reports
2025 Q4: 4 reports
2026 Q1: 5 reports
2026 Q2: 45 reports

Dated reports, 2015 Q4 to 2026 Q2.

Techniques seen in the last two years

T1053.005 9 reports in ATT&CK
T1057 8 reports reports only
T1105 7 reports in ATT&CK
T1059.001 6 reports in ATT&CK
T1059.003 6 reports in ATT&CK
T1082 6 reports in ATT&CK
T1016 5 reports in ATT&CK
T1071.001 5 reports in ATT&CK
T1083 5 reports reports only
T1204.002 5 reports in ATT&CK

Show all 276 techniques Show fewer

T1566.001 5 reports in ATT&CK
T1572 5 reports reports only
T1005 4 reports in ATT&CK
T1018 4 reports in ATT&CK
T1027 4 reports reports only
T1033 4 reports in ATT&CK
T1041 4 reports in ATT&CK
T1046 4 reports reports only
T1047 4 reports in ATT&CK
T1059 4 reports reports only
T1140 4 reports reports only
T1189 4 reports reports only
T1190 4 reports reports only
T1219 4 reports reports only
T1482 4 reports reports only
T1505.003 4 reports reports only
T1003 3 reports reports only
T1003.001 3 reports in ATT&CK
T1003.002 3 reports in ATT&CK
T1007 3 reports reports only
T1021.001 3 reports in ATT&CK
T1021.002 3 reports in ATT&CK
T1036.005 3 reports reports only
T1049 3 reports reports only
T1055 3 reports in ATT&CK
T1055.002 3 reports reports only
T1059.005 3 reports reports only
T1068 3 reports reports only
T1069.002 3 reports reports only
T1070.004 3 reports in ATT&CK
T1071 3 reports reports only
T1078 3 reports in ATT&CK
T1087.001 3 reports reports only
T1087.002 3 reports in ATT&CK
T1132.001 3 reports reports only
T1133 3 reports in ATT&CK
T1135 3 reports in ATT&CK
T1136.001 3 reports in ATT&CK
T1486 3 reports reports only
T1489 3 reports in ATT&CK
T1490 3 reports in ATT&CK
T1518.001 3 reports in ATT&CK
T1566 3 reports reports only
T1570 3 reports in ATT&CK
T1574.001 3 reports reports only
T1008 2 reports reports only
T1021.004 2 reports reports only
T1027.009 2 reports reports only
T1036 2 reports reports only
T1053 2 reports reports only
T1055.004 2 reports reports only
T1056 2 reports reports only
T1056.001 2 reports reports only
T1059.006 2 reports reports only
T1059.007 2 reports reports only
T1069.001 2 reports reports only
T1071.004 2 reports reports only
T1078.002 2 reports in ATT&CK
T1090 2 reports reports only
T1090.001 2 reports reports only
T1095 2 reports reports only
T1098 2 reports reports only
T1098.007 2 reports reports only
T1104 2 reports reports only
T1119 2 reports reports only
T1124 2 reports reports only
T1129 2 reports reports only
T1134 2 reports reports only
T1136 2 reports reports only
T1204 2 reports reports only
T1217 2 reports reports only
T1496 2 reports reports only
T1505.004 2 reports reports only
T1543.003 2 reports in ATT&CK
T1547.001 2 reports in ATT&CK
T1548 2 reports reports only
T1555.003 2 reports reports only
T1560 2 reports reports only
T1560.001 2 reports in ATT&CK
T1566.002 2 reports in ATT&CK
T1566.004 2 reports reports only
T1567 2 reports reports only
T1571 2 reports reports only
T1573.001 2 reports reports only
T1583 2 reports reports only
T1583.003 2 reports reports only
T1587.001 2 reports reports only
T1590 2 reports reports only
T1595 2 reports reports only
T1595.002 2 reports reports only
T1608 2 reports reports only
T1608.001 2 reports reports only
T1608.002 2 reports reports only
T1608.006 2 reports reports only
T1620 2 reports reports only
T1649 2 reports reports only
T1010 1 report reports only
T1012 1 report reports only
T1016.001 1 report reports only
T1020 1 report reports only
T1021 1 report in ATT&CK
T1021.005 1 report reports only
T1021.006 1 report in ATT&CK
T1036.003 1 report reports only
T1037 1 report reports only
T1037.001 1 report reports only
T1039 1 report reports only
T1040 1 report reports only
T1048 1 report reports only
T1053.003 1 report reports only
T1055.001 1 report in ATT&CK
T1055.003 1 report reports only
T1055.009 1 report reports only
T1055.012 1 report reports only
T1056.003 1 report reports only
T1059.002 1 report reports only
T1059.004 1 report reports only
T1059.009 1 report reports only
T1059.010 1 report reports only
T1059.011 1 report reports only
T1069 1 report reports only
T1069.003 1 report reports only
T1070 1 report reports only
T1070.006 1 report reports only
T1072 1 report reports only
T1074 1 report in ATT&CK
T1074.001 1 report in ATT&CK
T1074.002 1 report reports only
T1078.003 1 report reports only
T1078.004 1 report reports only
T1087 1 report reports only
T1087.004 1 report reports only
T1090.003 1 report reports only
T1091 1 report reports only
T1098.001 1 report reports only
T1098.003 1 report reports only
T1098.004 1 report reports only
T1098.005 1 report reports only
T1098.006 1 report reports only
T1102 1 report reports only
T1102.002 1 report reports only
T1106 1 report reports only
T1110 1 report reports only
T1112 1 report in ATT&CK
T1113 1 report reports only
T1114 1 report reports only
T1114.001 1 report reports only
T1114.002 1 report reports only
T1114.003 1 report reports only
T1115 1 report reports only
T1120 1 report reports only
T1123 1 report reports only
T1125 1 report reports only
T1132 1 report reports only
T1134.001 1 report reports only
T1136.002 1 report in ATT&CK
T1137 1 report reports only
T1137.006 1 report reports only
T1195 1 report reports only
T1195.001 1 report reports only
T1195.002 1 report reports only
T1199 1 report reports only
T1200 1 report reports only
T1201 1 report reports only
T1203 1 report reports only
T1204.001 1 report in ATT&CK
T1204.004 1 report reports only
T1210 1 report in ATT&CK
T1213 1 report reports only
T1213.001 1 report reports only
T1213.002 1 report reports only
T1213.003 1 report reports only
T1218 1 report reports only
T1218.007 1 report reports only
T1484 1 report reports only
T1484.001 1 report reports only
T1485 1 report reports only
T1491.002 1 report reports only
T1497 1 report reports only
T1497.001 1 report reports only
T1497.003 1 report reports only
T1498 1 report reports only
T1505 1 report reports only
T1518 1 report reports only
T1528 1 report reports only
T1529 1 report reports only
T1530 1 report reports only
T1534 1 report reports only
T1537 1 report reports only
T1538 1 report reports only
T1543 1 report reports only
T1543.002 1 report reports only
T1543.004 1 report reports only
T1546 1 report reports only
T1546.003 1 report reports only
T1546.004 1 report reports only
T1546.008 1 report reports only
T1546.012 1 report reports only
T1546.015 1 report reports only
T1547 1 report reports only
T1547.002 1 report reports only
T1547.005 1 report reports only
T1547.009 1 report reports only
T1548.002 1 report reports only
T1550 1 report reports only
T1550.001 1 report reports only
T1550.002 1 report in ATT&CK
T1552 1 report reports only
T1554 1 report reports only
T1555 1 report reports only
T1556 1 report reports only
T1556.002 1 report reports only
T1556.006 1 report reports only
T1556.009 1 report reports only
T1558.003 1 report in ATT&CK
T1559 1 report reports only
T1560.002 1 report reports only
T1564.004 1 report reports only
T1565 1 report reports only
T1565.001 1 report reports only
T1566.003 1 report reports only
T1567.001 1 report reports only
T1567.002 1 report in ATT&CK
T1569 1 report reports only
T1569.002 1 report in ATT&CK
T1573 1 report reports only
T1573.002 1 report reports only
T1574 1 report reports only
T1574.011 1 report reports only
T1578 1 report reports only
T1580 1 report reports only
T1583.001 1 report reports only
T1583.004 1 report reports only
T1583.006 1 report reports only
T1584 1 report reports only
T1584.004 1 report reports only
T1585 1 report reports only
T1585.002 1 report in ATT&CK
T1586.002 1 report reports only
T1587 1 report reports only
T1587.003 1 report reports only
T1588 1 report reports only
T1588.002 1 report in ATT&CK
T1588.003 1 report in ATT&CK
T1588.004 1 report reports only
T1588.007 1 report reports only
T1589.002 1 report reports only
T1590.005 1 report reports only
T1592 1 report reports only
T1595.001 1 report reports only
T1598 1 report reports only
T1602 1 report reports only
T1602.001 1 report reports only
T1602.002 1 report reports only
T1608.003 1 report reports only
T1608.004 1 report reports only
T1608.005 1 report reports only
T1613 1 report reports only
T1614 1 report reports only
T1614.001 1 report reports only
T1615 1 report reports only
T1619 1 report reports only
T1622 1 report reports only
T1652 1 report reports only
T1654 1 report reports only
T1657 1 report reports only

Counts come from technique IDs in the actor's report text. “Reports only” means reports name the technique but MITRE ATT&CK® does not list it for this actor.

Also listed by ATT&CK

Show all 14 techniques Show fewer

CVEs named in reports

Show all 499 CVEs Show fewer

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

19 May 2026

https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json
14 May 2026

FrostyNeighbor: Fresh mischief and digital shenanigans

publisher's date ESET Research fromORKLESET

Archived copy on ORKL Detailsfor FrostyNeighbor: Fresh mischief and digital shenanigans
29 April 2026

Behind The Mystery Of Russia's 'Dyre' Hackers Who Stole Millions From American Business

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Behind The Mystery Of Russia's 'Dyre' Hackers Who Stole Millions From American Business
6 April 2026

Monty Spider - Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Monty Spider - Threat Group Cards: A Threat Actor Encyclopedia
6 April 2026

Mummy Spider, TA542 - Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Mummy Spider, TA542 - Threat Group Cards: A Threat Actor Encyclopedia
6 April 2026

Conti ransomware explained: What you need to know about this aggressive criminal group

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Conti ransomware explained: What you need to know about this aggressive criminal group
6 April 2026

ISFB (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor ISFB (Malware Family)
6 April 2026

Timelining GRIM SPIDER's Big Game Hunting Tactics | CrowdStrike

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Timelining GRIM SPIDER's Big Game Hunting Tactics | CrowdStrike
6 April 2026

Dharma Ransomware Intrusions Exhibit Consistent Techniques

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Dharma Ransomware Intrusions Exhibit Consistent Techniques
6 April 2026

Germany doxxes Conti ransomware and TrickBot ring leader

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Germany doxxes Conti ransomware and TrickBot ring leader

Show all 1,158 reports Show fewer

6 April 2026

Brooklyn & Vermont hospitals are latest Ryuk ransomware victims

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Brooklyn & Vermont hospitals are latest Ryuk ransomware victims
6 April 2026

Blog: Stay Ahead of Cyber Threats

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Blog: Stay Ahead of Cyber Threats
6 April 2026

Smoky Spider - Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Smoky Spider - Threat Group Cards: A Threat Actor Encyclopedia
6 April 2026

Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure | CISA

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure | CISA
6 April 2026

Tracking Adversaries: The Qilin RaaS

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Tracking Adversaries: The Qilin RaaS
6 April 2026

An Inside Look at the Conti Group | Deep Instinct

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor An Inside Look at the Conti Group | Deep Instinct
6 April 2026

Irish police seize Conti domains used in HSE ransomware attack

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Irish police seize Conti domains used in HSE ransomware attack
6 April 2026

RiskIQ Threat Intelligence Roundup: Campaigns Targeting Ukraine and Global Malware Infrastructure | RiskIQ

date ORKL added it fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor RiskIQ Threat Intelligence Roundup: Campaigns Targeting Ukraine and Global Malware Infrastructure | RiskIQ
6 April 2026

Russian man pleads guilty to laundering Ryuk ransomware money

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Russian man pleads guilty to laundering Ryuk ransomware money
6 April 2026

Malware Unpacking With Hardware Breakpoints - Cobalt Strike Shellcode Loader

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Malware Unpacking With Hardware Breakpoints - Cobalt Strike Shellcode Loader
6 April 2026

Looking for the ‘Sliver’ lining: Hunting for emerging command-and-control frameworks | Microsoft Security Blog

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Looking for the ‘Sliver’ lining: Hunting for emerging command-and-control frameworks | Microsoft Security Blog
6 April 2026

BazarBackdoor (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor BazarBackdoor (Malware Family)
6 April 2026

Conti (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Conti (Malware Family)
6 April 2026

How to Use Ghidra to Analyse Shellcode and Extract Cobalt Strike Command & Control Servers

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor How to Use Ghidra to Analyse Shellcode and Extract Cobalt Strike Command & Control Servers
6 April 2026

The many lives of BlackCat ransomware | Microsoft Security Blog

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor The many lives of BlackCat ransomware | Microsoft Security Blog
6 April 2026

Ghidra Tutorial - Using Entropy To Locate Cobalt Strike Decryption Functions

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Ghidra Tutorial - Using Entropy To Locate Cobalt Strike Decryption Functions
6 April 2026

SCANdalous! (External Detection Using Network Scan Data and Automation) | Mandiant

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor SCANdalous! (External Detection Using Network Scan Data and Automation) | Mandiant
6 April 2026

IcedID (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor IcedID (Malware Family)
6 April 2026

Conti Ransomware: Inside One of the World’s Most Aggressive Ransomware Groups

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Conti Ransomware: Inside One of the World’s Most Aggressive Ransomware Groups
6 April 2026

TrickBot teams up with Shatak phishers for Conti ransomware attacks

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor TrickBot teams up with Shatak phishers for Conti ransomware attacks
6 April 2026

Wizard Spider, Gold Blackburn - Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Wizard Spider, Gold Blackburn - Threat Group Cards: A Threat Actor Encyclopedia
6 April 2026

Ransomware Activity Targeting the Healthcare and Public Health Sector | CISA

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Ransomware Activity Targeting the Healthcare and Public Health Sector | CISA
6 April 2026

New Zealand hospitals infected by ransomware, cancel some surgeries

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor New Zealand hospitals infected by ransomware, cancel some surgeries
6 April 2026

Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself | Microsoft Security Blog

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself | Microsoft Security Blog
6 April 2026

Latest Trickbot Variant has New Tricks Up Its Sleeve

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Latest Trickbot Variant has New Tricks Up Its Sleeve
6 April 2026

The Brothers Grim | Group-IB Blog

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor The Brothers Grim | Group-IB Blog
6 April 2026

Cobalt Strike (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Cobalt Strike (Malware Family)
6 April 2026

Ryuk (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Ryuk (Malware Family)
6 April 2026

Bumblebee Malware Loader Threat Analysis

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Bumblebee Malware Loader Threat Analysis
6 April 2026

Consequences - The Conti Leaks and future problems

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Consequences - The Conti Leaks and future problems
6 April 2026

TrickBot adds new trick to its arsenal: tampering with trusted texts | Malwarebytes Labs

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor TrickBot adds new trick to its arsenal: tampering with trusted texts | Malwarebytes Labs
6 April 2026

Scully Spider, TA547 - Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Scully Spider, TA547 - Threat Group Cards: A Threat Actor Encyclopedia
6 April 2026

Ryuk explained: Targeted, devastatingly effective ransomware

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Ryuk explained: Targeted, devastatingly effective ransomware
6 April 2026

REvil, Ryuk and Tycoon Ransomware: How They Work and How to Defend Against Them

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor REvil, Ryuk and Tycoon Ransomware: How They Work and How to Defend Against Them
6 April 2026

Threat Intelligence Query Examples - Real World Queries for Identifying Malware Infrastructure

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Threat Intelligence Query Examples - Real World Queries for Identifying Malware Infrastructure
12 February 2026

OysterLoader Unmasked: The Multi-Stage Evasion Loader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OysterLoader Unmasked: The Multi-Stage Evasion Loader
5 February 2026

The Shadow Campaigns: Uncovering Global Espionage

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Shadow Campaigns: Uncovering Global Espionage
3 February 2026

The Notepad++ supply chain attack — unnoticed execution chains and new IoCs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Notepad++ supply chain attack — unnoticed execution chains and new IoCs
26 January 2026

GOGITTER, GITSHELLPAD, and GOSHELL Analysis | ThreatLabz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GOGITTER, GITSHELLPAD, and GOSHELL Analysis | ThreatLabz
4 January 2026

From a New Year's surprise to a bag of coal - Analysis of mystery PowerShell

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From a New Year's surprise to a bag of coal - Analysis of mystery PowerShell
19 December 2025

Multiple Threat Actors Leveraging CVE-2025-55182 (React2Shell)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Multiple Threat Actors Leveraging CVE-2025-55182 (React2Shell)
20 November 2025

APT24's Pivot to Multi-Vector Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT24's Pivot to Multi-Vector Attacks
22 October 2025

The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns
2 October 2025

UAT-8099: Chinese-speaking cybercrime group targets high-value IIS for SEO fraud

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UAT-8099: Chinese-speaking cybercrime group targets high-value IIS for SEO fraud
29 September 2025

From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion
24 September 2025

Chinese Hackers RedNovember Target Global Governments Using Pantegana and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese Hackers RedNovember Target Global Governments Using Pantegana and Cobalt Strike
28 August 2025

TAOTH Campaign Exploits End-of-Support Software to Target Traditional Chinese Users and Dissidents

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TAOTH Campaign Exploits End-of-Support Software to Target Traditional Chinese Users and Dissidents
27 August 2025

ShadowSilk: A Cross-Border Binary Union for Data Exfiltration | Group-IB Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ShadowSilk: A Cross-Border Binary Union for Data Exfiltration | Group-IB Blog
21 July 2025

The SOC files: Rumble in the jungle or APT41’s new target in Africa

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The SOC files: Rumble in the jungle or APT41’s new target in Africa
17 July 2025

Dissecting the ClickFix User-Execution Attack and Its Sophisticated Persistence via ADS

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dissecting the ClickFix User-Execution Attack and Its Sophisticated Persistence via ADS
16 July 2025

Phish and Chips: China-Aligned Espionage Actors Ramp Up Taiwan Semiconductor Industry Targeting | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Phish and Chips: China-Aligned Espionage Actors Ramp Up Taiwan Semiconductor Industry Targeting | Proofpoint US
24 June 2025

Cyber%20Threat%20Intelligence%20Report%202025.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber%20Threat%20Intelligence%20Report%202025.pdf
23 June 2025

Threat Hunting Introduction: Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Hunting Introduction: Cobalt Strike
19 June 2025

Cobalt Strike Operators Leverage PowerShell Loaders Across Chinese, Russian, and Global Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Operators Leverage PowerShell Loaders Across Chinese, Russian, and Global Infrastructure
17 June 2025

Operation Endgame: Do Takedowns and Arrests Matter?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Endgame: Do Takedowns and Arrests Matter?
15 June 2025

Team46 and TaxOff: two sides of the same coin

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Team46 and TaxOff: two sides of the same coin
27 May 2025

Earth Lamia Develops Custom Arsenal to Target Multiple Industries

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Lamia Develops Custom Arsenal to Target Multiple Industries
23 May 2025

Shadow Banker Makes Glorious Return, Interviews Guy Exposing Conti Command & Control – Shadow Banker

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Shadow Banker Makes Glorious Return, Interviews Guy Exposing Conti Command & Control – Shadow Banker
29 April 2025

Nitrogen Dropping Cobalt Strike – A Combination of “Chemical Elements”

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Nitrogen Dropping Cobalt Strike – A Combination of “Chemical Elements”
24 April 2025

m-trends-2025-en.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor m-trends-2025-en.pdf
31 March 2025

Operation HollowQuill: Malware delivered into Russian R&D Networks via Research Decoy PDFs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation HollowQuill: Malware delivered into Russian R&D Networks via Research Decoy PDFs
31 March 2025

The Espionage Toolkit of Earth Alux A Closer Look at its Advanced Techniques

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Espionage Toolkit of Earth Alux A Closer Look at its Advanced Techniques
7 March 2025

report-incident-response-middle-east.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor report-incident-response-middle-east.pdf
29 January 2025

CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia
21 January 2025

JSAC2025_1_5_leon-chang_theo-chen_en.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor JSAC2025_1_5_leon-chang_theo-chen_en.pdf
17 January 2025

threat_horizons_report_h1_2025.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor threat_horizons_report_h1_2025.pdf
10 January 2025

Jul-Dec%202024%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Jul-Dec%202024%20Botnet%20Threat%20Update.pdf
7 January 2025

Golang Beacons and VS Code Tunnels: Tracking a Cobalt Strike Server Leveraging Trusted Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Golang Beacons and VS Code Tunnels: Tracking a Cobalt Strike Server Leveraging Trusted Infrastructure
4 December 2024

Black Basta Ransomware Campaign Drops Zbot, DarkGate, and Custom Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Black Basta Ransomware Campaign Drops Zbot, DarkGate, and Custom Malware
3 December 2024

Rare Watermark Links Cobalt Strike 4.10 Team Servers to Ongoing Suspicious Activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rare Watermark Links Cobalt Strike 4.10 Team Servers to Ongoing Suspicious Activity
2 December 2024

The Curious Case of an Egg-Cellent Resume

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor The Curious Case of an Egg-Cellent Resume
19 November 2024

Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella
12 November 2024

China-Nexus TAG-112 Compromises Tibetan Websites to Distribute Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-Nexus TAG-112 Compromises Tibetan Websites to Distribute Cobalt Strike
12 November 2024

China-Nexus TAG-112 Compromises Tibetan Websites to Distribute Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-Nexus TAG-112 Compromises Tibetan Websites to Distribute Cobalt Strike
31 October 2024

Tricks, Treats, and Threats: Cobalt Strike & the Goblin Lurking in Plain Sight

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tricks, Treats, and Threats: Cobalt Strike & the Goblin Lurking in Plain Sight
30 October 2024

Inside Intelligence Center: LUNAR SPIDER Enabling Ransomware Attacks on Financial Sector with Brute Ratel C4 and Latrodectus

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Inside Intelligence Center: LUNAR SPIDER Enabling Ransomware Attacks on Financial Sector with Brute Ratel C4 and Latrodectus
28 October 2024

Emotet Malware Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet Malware Analysis
24 October 2024

Operation Cobalt Whisper: Threat Actor Targets Multiple Industries Across Hong Kong and Pakistan.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Cobalt Whisper: Threat Actor Targets Multiple Industries Across Hong Kong and Pakistan.
23 October 2024

Threat Spotlight: WarmCookie/BadSpace

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Spotlight: WarmCookie/BadSpace
23 October 2024

Highlighting TA866/Asylum Ambuscade Activity Since 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Highlighting TA866/Asylum Ambuscade Activity Since 2021
10 October 2024

Unmasking Adversary Infrastructure: How Certificates and Redirects Exposed Earth Baxia and PlugX Activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unmasking Adversary Infrastructure: How Certificates and Redirects Exposed Earth Baxia and PlugX Activity
24 September 2024

Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdf
19 September 2024

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/earth-baxia-uses-spear-phishing-and-geoserver-exploit-to-target-apac/IOCs%20-%20Earth%20Baxia%20Uses%20Spear-Phishing%20and%20GeoServer%20Exploit%20to%20Target%20APAC.txt

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/earth-baxia-uses-spear-phishing-and-geoserver-exploit-to-target-apac/IOCs%20-%20Earth%20Baxia%20Uses%20Spear-Phishing%20and%20GeoServer%20Exploit%20to%20Target%20APAC.txt
19 September 2024

Earth Baxia Uses Spear-Phishing and GeoServer Exploit to Target APAC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Baxia Uses Spear-Phishing and GeoServer Exploit to Target APAC
29 August 2024

From Cobalt Strike to Mimikatz: A Deep Dive into the SLOW#TEMPEST Campaign Targeting Chinese Users

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From Cobalt Strike to Mimikatz: A Deep Dive into the SLOW#TEMPEST Campaign Targeting Chinese Users
26 August 2024

BlackSuit Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor BlackSuit Ransomware
23 August 2024

Sailing_the_Seven_SEAs_Deep_Dive_into_Polaris_Arsenal_and_Intelligence_Insights.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sailing_the_Seven_SEAs_Deep_Dive_into_Polaris_Arsenal_and_Intelligence_Insights.pdf
23 August 2024

Pirates_of_The_Nang_Hai_Follow_the_Artifacts_of_Tropic_Trooper,_No_One_Knows.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Pirates_of_The_Nang_Hai_Follow_the_Artifacts_of_Tropic_Trooper,_No_One_Knows.pdf
22 August 2024

AppDomainManager Injectionを悪用したマルウェアによる攻撃について

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AppDomainManager Injectionを悪用したマルウェアによる攻撃について
21 August 2024

Chinese APT abuses MSC files with GrimResource vulnerability

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese APT abuses MSC files with GrimResource vulnerability
12 August 2024

Ongoing Social Engineering Campaign Refreshes Payloads

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ongoing Social Engineering Campaign Refreshes Payloads
4 August 2024

Decoding a Cobalt Strike Downloader Script With CyberChef

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Decoding a Cobalt Strike Downloader Script With CyberChef
1 August 2024

APT41 likely compromised Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT41 likely compromised Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike
26 July 2024

Hive0137 on AI journey

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Hive0137 on AI journey
25 July 2024

UAC-0057 Attack Detection: A Surge in Adversary Activity Distributing PICASSOLOADER and Cobalt Strike Beacon

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UAC-0057 Attack Detection: A Surge in Adversary Activity Distributing PICASSOLOADER and Cobalt Strike Beacon
22 July 2024

A Beginner's Guide to Hunting Malicious Open Directories - Censys

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Beginner's Guide to Hunting Malicious Open Directories - Censys
18 July 2024

APT41 Has Arisen From the DUST

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT41 Has Arisen From the DUST
16 July 2024

TAG-100 Uses Open-Source Tools in Suspected Global Espionage Campaign, Compromising Two Asia-Pacific Intergovernmental Bodies

Malpedia library date Insikt Group® by Recorded Future® fromORKL

Archived copy on ORKL Detailsfor TAG-100 Uses Open-Source Tools in Suspected Global Espionage Campaign, Compromising Two Asia-Pacific Intergovernmental Bodies
10 July 2024

DodgeBox | ThreatLabz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DodgeBox | ThreatLabz
9 July 2024

Jan-Jun%202024%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Jan-Jun%202024%20Botnet%20Threat%20Update.pdf
2 July 2024

Exposing FakeBat loader: distribution methods and adversary infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Exposing FakeBat loader: distribution methods and adversary infrastructure
21 June 2024

GrimResource - Microsoft Management Console for initial access and evasion

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GrimResource - Microsoft Management Console for initial access and evasion
10 June 2024

IcedID Brings ScreenConnect and CSharp Streamer to ALPHV Ransomware Deployment

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor IcedID Brings ScreenConnect and CSharp Streamer to ALPHV Ransomware Deployment
5 June 2024

Exmatter malware levels up: S-RM observes new variant with simultaneous remote code execution and data targeting

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Exmatter malware levels up: S-RM observes new variant with simultaneous remote code execution and data targeting
30 May 2024

Largest ever operation against botnets hits dropper malware ecosystem

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Largest ever operation against botnets hits dropper malware ecosystem
23 May 2024

Sharp Dragon Expands Towards Africa and The Caribbean - Check Point Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sharp Dragon Expands Towards Africa and The Caribbean - Check Point Research
23 May 2024

Chinese Espionage Campaign Expands to Target Africa and The Caribbean

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese Espionage Campaign Expands to Target Africa and The Caribbean
15 May 2024

Threat actors misusing Quick Assist in social engineering attacks leading to ransomware | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat actors misusing Quick Assist in social engineering attacks leading to ransomware | Microsoft Security Blog
14 May 2024

QakBot attacks with Windows zero-day (CVE-2024-30051)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor QakBot attacks with Windows zero-day (CVE-2024-30051)
10 May 2024

Ongoing Social Engineering Campaign Linked to Black Basta Ransomware Operators

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ongoing Social Engineering Campaign Linked to Black Basta Ransomware Operators
24 April 2024

Securonix Threat Research Security Advisory: Analysis of Ongoing FROZEN#SHADOW Attack Campaign Leveraging SSLoad Malware and RMM Software for Domain Takeover

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Securonix Threat Research Security Advisory: Analysis of Ongoing FROZEN#SHADOW Attack Campaign Leveraging SSLoad Malware and RMM Software for Domain Takeover
22 April 2024

m-trends-2024.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor m-trends-2024.pdf
10 April 2024

Resolving Stack Strings with Emulation | 0ffset Training Solutions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Resolving Stack Strings with Emulation | 0ffset Training Solutions
1 April 2024

From OneNote to RansomNote: An Ice Cold Intrusion

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor From OneNote to RansomNote: An Ice Cold Intrusion
19 March 2024

Rewterz Threat Alert – China-Linked Earth Krahang APT Breached 70 Organizations in 23 Nations – Active IOCs - Rewterz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rewterz Threat Alert – China-Linked Earth Krahang APT Breached 70 Organizations in 23 Nations – Active IOCs - Rewterz
1 March 2024

Malware Analysis — Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Analysis — Cobalt Strike
28 February 2024

Spam trends campaigns senior superlatives 2023

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Spam trends campaigns senior superlatives 2023
9 February 2024

A Beginner's Guide to Tracking Malware Infrastructure - Censys

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Beginner's Guide to Tracking Malware Infrastructure - Censys
26 January 2024

JSAC2024_2_7_hara_shoji_higashi_vickie-su_nick-dai_en.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor JSAC2024_2_7_hara_shoji_higashi_vickie-su_nick-dai_en.pdf
12 January 2024

Q4%202023%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Q4%202023%20Botnet%20Threat%20Update.pdf
9 January 2024

2023 Adversary Infrastructure Report

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023 Adversary Infrastructure Report
8 December 2023

How to Use Ghidra to Analyse Shellcode and Extract Cobalt Strike Command & Control Servers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How to Use Ghidra to Analyse Shellcode and Extract Cobalt Strike Command & Control Servers
4 December 2023

SQL Brute Force Leads to BlueSky Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor SQL Brute Force Leads to BlueSky Ransomware
1 December 2023

Russian developer of Trickbot malware pleads guilty, faces 35-year sentence

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Russian developer of Trickbot malware pleads guilty, faces 35-year sentence
1 December 2023

Monthly news - December 2023

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Monthly news - December 2023
26 November 2023

From Infection to Encryption: Tracing the Impact of RYUK Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From Infection to Encryption: Tracing the Impact of RYUK Ransomware
19 November 2023

Combining Pivot Points to Identify Malware Infrastructure - Redline, Smokeloader and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Combining Pivot Points to Identify Malware Infrastructure - Redline, Smokeloader and Cobalt Strike
14 November 2023

HostingHunter Series: CHANG WAY TECHNOLOGIES CO. LIMITED

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor HostingHunter Series: CHANG WAY TECHNOLOGIES CO. LIMITED
10 November 2023

The New APT Group DarkCasino and the Global Surge in WinRAR 0-Day Exploits - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.

Malpedia library date NSFOCUS fromORKLCCS '25 data

Archived copy on ORKL Detailsfor The New APT Group DarkCasino and the Global Surge in WinRAR 0-Day Exploits - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.
7 November 2023

New Gootloader Variant “GootBot” Changes the Game in Malware Tactics

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Gootloader Variant “GootBot” Changes the Game in Malware Tactics
6 November 2023

Malware Unpacking With Hardware Breakpoints - Cobalt Strike Shellcode Loader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Unpacking With Hardware Breakpoints - Cobalt Strike Shellcode Loader
1 November 2023

Popping Blisters for research: An overview of past payloads and exploring recent developments

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Popping Blisters for research: An overview of past payloads and exploring recent developments
23 October 2023

Cobalt Strike .VBS Loader - Decoding with Advanced CyberChef and Emulation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike .VBS Loader - Decoding with Advanced CyberChef and Emulation
20 October 2023

Cobalt Strike Malware Analysis With CyberChef and Emulation - .HTA Loader Example

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Malware Analysis With CyberChef and Emulation - .HTA Loader Example
18 October 2023

Ghidra Tutorial - Using Entropy To Locate Cobalt Strike Decryption Functions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ghidra Tutorial - Using Entropy To Locate Cobalt Strike Decryption Functions
12 October 2023

Forensic Timeline of an IcedID Infection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Forensic Timeline of an IcedID Infection
12 October 2023

2023%20Q3%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023%20Q3%20Botnet%20Threat%20Update.pdf
10 October 2023

Grayling: Previously Unseen Threat Actor Targets Multiple Organizations in Taiwan

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Grayling: Previously Unseen Threat Actor Targets Multiple Organizations in Taiwan
3 October 2023

Lighting the Exfiltration Infrastructure of a LockBit Affiliate (and more)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lighting the Exfiltration Infrastructure of a LockBit Affiliate (and more)
29 September 2023

2023 State of The Threat – A Year in Review

Malpedia library date Secureworks fromORKL

Archived copy on ORKL Detailsfor 2023 State of The Threat – A Year in Review
22 September 2023

Backchannel Diplomacy: APT29's Rapidly Evolving Diplomatic Phishing Operations | Mandiant

Malpedia library date Mandiant fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Backchannel Diplomacy: APT29's Rapidly Evolving Diplomatic Phishing Operations | Mandiant
22 September 2023

Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda
12 September 2023

CERTFR-2023-CTI-007.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERTFR-2023-CTI-007.pdf
7 September 2023

Multiple Foreign Nationals Charged in Connection with Trickbot Malware and Conti Ransomware Conspiracies

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Multiple Foreign Nationals Charged in Connection with Trickbot Malware and Conti Ransomware Conspiracies
30 August 2023

Trickbot in Light of Trickleaks Data

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trickbot in Light of Trickleaks Data
30 August 2023

Earth Estries Targets Government, Tech for Cyberespionage

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Estries Targets Government, Tech for Cyberespionage
28 August 2023

HTML Smuggling Leads to Domain Wide Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor HTML Smuggling Leads to Domain Wide Ransomware
18 August 2023

Understanding Syscalls: Direct, Indirect, and Cobalt Strike Implementation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Understanding Syscalls: Direct, Indirect, and Cobalt Strike Implementation
18 August 2023

Unmasking CamoFei An In-depth Analysis of an Emerging APT Group Focused on Healthcare Sectors in East Asia

date in the CCS '25 data Team T5 fromCCS '25 data

Detailsfor Unmasking CamoFei An In-depth Analysis of an Emerging APT Group Focused on Healthcare Sectors in East Asia
17 August 2023

Chinese Entanglement | DLL Hijacking in the Asian Gambling Sector

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese Entanglement | DLL Hijacking in the Asian Gambling Sector
16 August 2023

Unmasking CamoFei

file creation date fromORKL

Archived copy on ORKL Detailsfor Unmasking CamoFei
10 August 2023

Focus on DroxiDat/SystemBC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Focus on DroxiDat/SystemBC
7 August 2023

RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale
29 July 2023

gcat_threathorizons_full_jul2023.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor gcat_threathorizons_full_jul2023.pdf
27 July 2023

Are Akira Ransomware's Crypto-Locking Malware Days Numbered?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Are Akira Ransomware's Crypto-Locking Malware Days Numbered?
26 July 2023

Conti and Akira: Chained Together | Arctic Wolf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti and Akira: Chained Together | Arctic Wolf
11 July 2023

2023%20Q2%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023%20Q2%20Botnet%20Threat%20Update.pdf
7 July 2023

Beyond appearances: unknown actor using APT29’s TTP against Chinese users

Malpedia library date Lab52 fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Beyond appearances: unknown actor using APT29’s TTP against Chinese users
30 June 2023

Cobalt Strike’s Deployment with Hardware Breakpoint for AMSI Bypass

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike’s Deployment with Hardware Breakpoint for AMSI Bypass
16 June 2023

PicassoLoader and Cobalt Strike Beacon Detection: UAC-0057 aka GhostWriter Hacking Group Attacks the Ukrainian Leading Military Educational Institution

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PicassoLoader and Cobalt Strike Beacon Detection: UAC-0057 aka GhostWriter Hacking Group Attacks the Ukrainian Leading Military Educational Institution
15 June 2023

eSentire Threat Intelligence Malware Analysis: Resident Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eSentire Threat Intelligence Malware Analysis: Resident Campaign
8 June 2023

Threat Intelligence Query Examples - Real World Queries for Identifying Malware Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Intelligence Query Examples - Real World Queries for Identifying Malware Infrastructure
11 May 2023

Malware development trick - part 28: Dump lsass.exe. Simple C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development trick - part 28: Dump lsass.exe. Simple C++ example.
20 April 2023

m_trends_2023_report.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor m_trends_2023_report.pdf
20 April 2023

Malware-Analysis/Cobalt Strike/Indirect Syscalls.md at main · dodo-sec/Malware-Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware-Analysis/Cobalt Strike/Indirect Syscalls.md at main · dodo-sec/Malware-Analysis
14 April 2023

Ex-Conti and FIN7 Actors Collaborate with New Domino Backdoor

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Ex-Conti and FIN7 Actors Collaborate with New Domino Backdoor
12 April 2023

2023%20Q1%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023%20Q1%20Botnet%20Threat%20Update.pdf
11 April 2023

BumbleBee hunting with a Velociraptor

Malpedia library date SEC Consult fromORKLCCS '25 data

Archived copy on ORKL Detailsfor BumbleBee hunting with a Velociraptor
10 April 2023

Ransomware_eCrime22.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor Ransomware_eCrime22.pdf
3 April 2023

Malicious ISO File Leads to Domain Wide Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Malicious ISO File Leads to Domain Wide Ransomware
30 March 2023

1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf
30 March 2023

With KEYPLUG, China’s RedGolf Spies On, Steals From Wide Field of Targets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor With KEYPLUG, China’s RedGolf Spies On, Steals From Wide Field of Targets
30 March 2023

eSentire Threat Intelligence Malware Analysis: BatLoader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eSentire Threat Intelligence Malware Analysis: BatLoader
28 March 2023

Mélofée: a new alien malware in the Panda's toolset targeting Linux hosts

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mélofée: a new alien malware in the Panda's toolset targeting Linux hosts
10 March 2023

From Royal with Love

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From Royal with Love
1 March 2023

OneNote | ThreatLabz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OneNote | ThreatLabz
23 February 2023

Technical Advisory: Various Threat Actors Targeting ManageEngine Exploit CVE-2022-47966

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Technical Advisory: Various Threat Actors Targeting ManageEngine Exploit CVE-2022-47966
22 February 2023

Hydrochasma: Previously Unknown Group Targets Medical and Shipping Organizations in Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hydrochasma: Previously Unknown Group Targets Medical and Shipping Organizations in Asia
13 February 2023

Royal Ransomware Deep Dive

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Royal Ransomware Deep Dive
13 February 2023

Dalbit (m00nlight): Chinese Hacker Group's APT Attack Campaign - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dalbit (m00nlight): Chinese Hacker Group's APT Attack Campaign - ASEC
10 February 2023

Malware analysis: part 8. Yara rule example for MurmurHash2. MurmurHash2 in Conti ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware analysis: part 8. Yara rule example for MurmurHash2. MurmurHash2 in Conti ransomware
9 February 2023

United States and United Kingdom Sanction Members of Russia-Based Trickbot Cybercrime Gang

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor United States and United Kingdom Sanction Members of Russia-Based Trickbot Cybercrime Gang
8 February 2023

Earth Zhulong Familiar Patterns Target Southeast Asian Firms

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Zhulong Familiar Patterns Target Southeast Asian Firms
2 February 2023

Hive Ransomware Technical Analysis and Initial Access Discovery

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hive Ransomware Technical Analysis and Initial Access Discovery
1 February 2023

LockBit Green ransomware variant borrows code from Conti one

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor LockBit Green ransomware variant borrows code from Conti one
30 January 2023

Following the Scent of TrickGate: 6-Year-Old Packer Used to Deploy the Most Wanted Malware - Check Point Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Following the Scent of TrickGate: 6-Year-Old Packer Used to Deploy the Most Wanted Malware - Check Point Research
24 January 2023

The Year of the Wiper | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Year of the Wiper | FortiGuard Labs
23 January 2023

Black Basta - Technical Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Black Basta - Technical Analysis
16 January 2023

Ransomware Diaries: Volume 1 | Analyst1

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware Diaries: Volume 1 | Analyst1
5 January 2023

Bluebottle: Campaign Hits Banks in French-speaking Countries in Africa

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bluebottle: Campaign Hits Banks in French-speaking Countries in Africa
4 January 2023

Malware development tricks: part 26. Mutex. C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development tricks: part 26. Mutex. C++ example.
27 December 2022

Navigating the Vast Ocean of Sandbox Evasions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Navigating the Vast Ocean of Sandbox Evasions
16 December 2022

The DPRK delicate sound of cyber

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The DPRK delicate sound of cyber
16 December 2022

The DPRK delicate sound of cyber

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The DPRK delicate sound of cyber
15 December 2022

Trojanized Windows 10 Operating System Installers Targeted Ukrainian Government | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trojanized Windows 10 Operating System Installers Targeted Ukrainian Government | Mandiant
8 December 2022

Breaking the silence - Recent Truebot activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Breaking the silence - Recent Truebot activity
6 December 2022

Eu_Repo_C_APT_profile_Conti_Wizard_Spider_dc2a733e18.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Eu_Repo_C_APT_profile_Conti_Wizard_Spider_dc2a733e18.pdf
2 December 2022

Blowing Cobalt Strike Out of the Water With Memory Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Blowing Cobalt Strike Out of the Water With Memory Analysis
21 November 2022

Threat Assessment: Luna Moth Callback Phishing Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Assessment: Luna Moth Callback Phishing Campaign
15 November 2022

Somnia Malware Detection: UAC-0118 aka FRwL Launches Cyber Attacks Against Organizations in Ukraine Using Enhanced Malware Strains

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Somnia Malware Detection: UAC-0118 aka FRwL Launches Cyber Attacks Against Organizations in Ukraine Using Enhanced Malware Strains
9 November 2022

BlackCat Ransomware: Tactics and Techniques From a Targeted Attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BlackCat Ransomware: Tactics and Techniques From a Targeted Attack
9 November 2022

BlackCat Ransomware- Tactics and Techniques From a Targeted Attack

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor BlackCat Ransomware- Tactics and Techniques From a Targeted Attack
9 November 2022

Hack the Real Box: APT41’s New Subgroup Earth Longzhi

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hack the Real Box: APT41’s New Subgroup Earth Longzhi
3 November 2022

Cobalt Strike Analysis and Tutorial: Identifying Beacon Team Servers in the Wild

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Analysis and Tutorial: Identifying Beacon Team Servers in the Wild
3 November 2022

French-speaking gang OPERA1ER APT in Africa | Group-IB Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor French-speaking gang OPERA1ER APT in Africa | Group-IB Blog
31 October 2022

Banking Trojan Techniques: How Financially Motivated Malware Became Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Banking Trojan Techniques: How Financially Motivated Malware Became Infrastructure
31 October 2022

Orion Threat Alert: Qakbot TTPs Arsenal and the Black Basta Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Orion Threat Alert: Qakbot TTPs Arsenal and the Black Basta Ransomware
20 October 2022

eset_threat_report_t22021.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor eset_threat_report_t22021.pdf
13 October 2022

2022%20Q3%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2022%20Q3%20Botnet%20Threat%20Update.pdf
13 October 2022

Microsoft Security Response Center Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Security Response Center Blog
12 October 2022

Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike
3 October 2022

Bumblebee: increasing its capacity and evolving its TTPs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bumblebee: increasing its capacity and evolving its TTPs
3 October 2022

Water Labbu Abuses Malicious DApps to Steal Cryptocurrency

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Water Labbu Abuses Malicious DApps to Steal Cryptocurrency
26 September 2022

BumbleBee: Round Two

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor BumbleBee: Round Two
20 September 2022

Threat Report: Illuminating Volume Shadow Deletion

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Report: Illuminating Volume Shadow Deletion
16 September 2022

Bumblebee Malware Loader- Threat Analysis

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Bumblebee Malware Loader- Threat Analysis
14 September 2022

2022OverWatchThreatHuntingReport.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor 2022OverWatchThreatHuntingReport.pdf
13 September 2022

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense
12 September 2022

Dead or Alive? An Emotet Story

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Dead or Alive? An Emotet Story
7 September 2022

Cyble - Bumblebee Returns With New Infection Technique

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyble - Bumblebee Returns With New Infection Technique
7 September 2022

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog
7 September 2022

Conti vs. Monti: A Reinvention or Just a Simple Rebranding?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti vs. Monti: A Reinvention or Just a Simple Rebranding?
7 September 2022

Conti vs. Monti- A Reinvention or Just a Simple Rebranding-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Conti vs. Monti- A Reinvention or Just a Simple Rebranding-
7 September 2022

Initial access broker repurposing techniques in targeted attacks against Ukraine

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Initial access broker repurposing techniques in targeted attacks against Ukraine
7 September 2022

Initial access broker repurposing techniques in targeted attacks against Ukraine

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Initial access broker repurposing techniques in targeted attacks against Ukraine
6 September 2022

Estudio del análisis de Nobelium

file creation date fromORKL

Archived copy on ORKL Detailsfor Estudio del análisis de Nobelium
6 September 2022

incibe-cert_estudio_analisis_nobelium_2022_v1.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor incibe-cert_estudio_analisis_nobelium_2022_v1.pdf
6 September 2022

Malware development tricks: parent PID spoofing. Simple C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development tricks: parent PID spoofing. Simple C++ example.
6 September 2022

#StopRansomware: Vice Society | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor #StopRansomware: Vice Society | CISA
1 September 2022

Ransomware Spotlight: Black Basta

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware Spotlight: Black Basta
31 August 2022

Ryuk Ransomware: History, Timeline, and Adversary Simulation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ryuk Ransomware: History, Timeline, and Adversary Simulation
30 August 2022

Hacker Infrastructure Used in Cisco Breach Discovered Attacking a Top Workforce Management Corporation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hacker Infrastructure Used in Cisco Breach Discovered Attacking a Top Workforce Management Corporation
25 August 2022

BlueSky Ransomware | AD Lateral Movement, Evasion and Fast Encryption Put Threat on the Radar

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BlueSky Ransomware | AD Lateral Movement, Evasion and Fast Encryption Put Threat on the Radar
24 August 2022

Looking for the ‘Sliver’ lining- Hunting for emerging command-and-control frameworks

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Looking for the ‘Sliver’ lining- Hunting for emerging command-and-control frameworks
24 August 2022

Looking for the ‘Sliver’ lining: Hunting for emerging command-and-control frameworks | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Looking for the ‘Sliver’ lining: Hunting for emerging command-and-control frameworks | Microsoft Security Blog
19 August 2022

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research
18 August 2022

新APT组织穆伦鲨(MurenShark) 调查报告：袭向土耳其海军的鱼雷 – 绿盟科技技术博客

Malpedia library date NSFOCUS fromORKLCCS '25 data

Archived copy on ORKL Detailsfor 新APT组织穆伦鲨(MurenShark) 调查报告：袭向土耳其海军的鱼雷 – 绿盟科技技术博客
18 August 2022

From Ramnit To Bumblebee (via NeverQuest)- Similarities and Code Overlap Shed Light On Relationships Between Malware Developers

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor From Ramnit To Bumblebee (via NeverQuest)- Similarities and Code Overlap Shed Light On Relationships Between Malware Developers
18 August 2022

APT41 World Tour 2021 on a tight schedule

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT41 World Tour 2021 on a tight schedule
18 August 2022

Overview of the Cyber Weapons Used in the Ukraine - Russia War | Trustwave

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Overview of the Cyber Weapons Used in the Ukraine - Russia War | Trustwave
17 August 2022

THREAT ANALYSIS REPORT: Bumblebee Loader – The High Road to Enterprise Domain Control

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor THREAT ANALYSIS REPORT: Bumblebee Loader – The High Road to Enterprise Domain Control
15 August 2022

DCShadow Attacks: Detecting a Rogue Domain Controller

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DCShadow Attacks: Detecting a Rogue Domain Controller
12 August 2022

Monster Libra (TA551/Shathak) pushes IcedID (Bokbot) with Dark VNC and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Monster Libra (TA551/Shathak) pushes IcedID (Bokbot) with Dark VNC and Cobalt Strike
11 August 2022

The Increase in Ransomware Attacks on Local Governments - SecurityScorecard

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Increase in Ransomware Attacks on Local Governments - SecurityScorecard
11 August 2022

LNK forensic and config extraction of a cobalt strike beacon

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor LNK forensic and config extraction of a cobalt strike beacon
10 August 2022

Avast Q2/2022 threat report

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Avast Q2/2022 threat report
8 August 2022

BumbleBee Roasts Its Way to Domain Admin

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor BumbleBee Roasts Its Way to Domain Admin
8 August 2022

BumbleBee Roasts Its Way to Domain Admin

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor BumbleBee Roasts Its Way to Domain Admin
6 August 2022

A Look Back at BazarLoader’s DGA – Malware Book Reports

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Look Back at BazarLoader’s DGA – Malware Book Reports
3 August 2022

Flight of the Bumblebee: Email Lures and File Sharing Services Lead to Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Flight of the Bumblebee: Email Lures and File Sharing Services Lead to Malware
2 August 2022

Manjusaka: A Chinese sibling of Sliver and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Manjusaka: A Chinese sibling of Sliver and Cobalt Strike
2 August 2022

Initial Access Brokers Are Key to Rise in Ransomware Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Initial Access Brokers Are Key to Rise in Ransomware Attacks
30 July 2022

Malware AV evasion - part 8. Encode payload via Z85 algorithm. C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware AV evasion - part 8. Encode payload via Z85 algorithm. C++ example.
28 July 2022

Living Off Windows Defender | LockBit Ransomware Sideloads Cobalt Strike Through Microsoft Security Tool

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Living Off Windows Defender | LockBit Ransomware Sideloads Cobalt Strike Through Microsoft Security Tool
27 July 2022

Cyble - Targeted Attacks Being Carried Out Via DLL SideLoading

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyble - Targeted Attacks Being Carried Out Via DLL SideLoading
27 July 2022

RL Blog | ReversingLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RL Blog | ReversingLabs
27 July 2022

Gootkit Loader’s Updated Tactics and Fileless Delivery of Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Gootkit Loader’s Updated Tactics and Fileless Delivery of Cobalt Strike
22 July 2022

Binary Ninja - Reverse Engineering a Cobalt Strike Dropper With Binary Ninja

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Binary Ninja - Reverse Engineering a Cobalt Strike Dropper With Binary Ninja
20 July 2022

Analysis of a trojanized jQuery script: GootLoader unleashed

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis of a trojanized jQuery script: GootLoader unleashed
20 July 2022

Luna and Black Basta — new ransomware for Windows, Linux and ESXi

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Luna and Black Basta — new ransomware for Windows, Linux and ESXi
20 July 2022

Evacuation and Humanitarian Documents used to Spear Phish Ukrainian Entities | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Evacuation and Humanitarian Documents used to Spear Phish Ukrainian Entities | Mandiant
20 July 2022

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense
19 July 2022

Russian APT29 Hackers Use Online Storage Services, DropBox and Google Drive

Malpedia library date Palo Alto fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Russian APT29 Hackers Use Online Storage Services, DropBox and Google Drive
18 July 2022

Russian Ransomware C2 Network Discovered in Censys Data

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Russian Ransomware C2 Network Discovered in Censys Data
13 July 2022

Cobalt Strikes again: UAC-0056 continues to target Ukraine in its latest campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strikes again: UAC-0056 continues to target Ukraine in its latest campaign
13 July 2022

Cobalt Strike Analysis and Tutorial: CS Metadata Encryption and Decryption

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Analysis and Tutorial: CS Metadata Encryption and Decryption
11 July 2022

CERT-UA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERT-UA
7 July 2022

Unprecedented Shift- The Trickbot Group is Systematically Attacking Ukraine

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Unprecedented Shift- The Trickbot Group is Systematically Attacking Ukraine
7 July 2022

Emotet infection with Cobalt Strike - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet infection with Cobalt Strike - SANS ISC
6 July 2022

CERT-UA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERT-UA
5 July 2022

Hive ransomware gets upgrades in Rust | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hive ransomware gets upgrades in Rust | Microsoft Security Blog
5 July 2022

Hive ransomware gets upgrades in Rust

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Hive ransomware gets upgrades in Rust
30 June 2022

Black Basta Ransomware Operators Expand Their Attack Arsenal With QakBot Trojan and PrintNightmare Exploit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Black Basta Ransomware Operators Expand Their Attack Arsenal With QakBot Trojan and PrintNightmare Exploit
27 June 2022

Attacks on industrial control systems using ShadowPad | Kaspersky ICS CERT EN

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attacks on industrial control systems using ShadowPad | Kaspersky ICS CERT EN
26 June 2022

Overview of Russian GRU and SVR Cyberespionage Campaigns 1H 2022

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Overview of Russian GRU and SVR Cyberespionage Campaigns 1H 2022
24 June 2022

There Is More Than One Way to Sleep: Dive Deep Into the Implementations of API Hammering by Various Malware Families

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor There Is More Than One Way to Sleep: Dive Deep Into the Implementations of API Hammering by Various Malware Families
23 June 2022

Matanbuchus Loader Resurfaces - Cyble

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Matanbuchus Loader Resurfaces - Cyble
23 June 2022

The hateful eight: Kaspersky’s guide to modern ransomware groups’ TTPs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The hateful eight: Kaspersky’s guide to modern ransomware groups’ TTPs
21 June 2022

Avos ransomware group expands with new attack arsenal

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Avos ransomware group expands with new attack arsenal
17 June 2022

Malspam pushes Matanbuchus malware, leads to Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malspam pushes Matanbuchus malware, leads to Cobalt Strike
15 June 2022

First Conti, then Hive: Costa Rica gets hit with ransomware again

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor First Conti, then Hive: Costa Rica gets hit with ransomware again
15 June 2022

Attack Graph Emulating the Conti Ransomware Team’s Behaviors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attack Graph Emulating the Conti Ransomware Team’s Behaviors
13 June 2022

The many lives of BlackCat ransomware | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The many lives of BlackCat ransomware | Microsoft Security Blog
13 June 2022

The many lives of BlackCat ransomware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The many lives of BlackCat ransomware
12 June 2022

Malware development: persistence - part 7. Winlogon. Simple C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development: persistence - part 7. Winlogon. Simple C++ example.
7 June 2022

Cyble - Bumblebee Loader On The Rise

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyble - Bumblebee Loader On The Rise
7 June 2022

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense
4 June 2022

[QuickNote] CobaltStrike SMB Beacon Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor [QuickNote] CobaltStrike SMB Beacon Analysis
3 June 2022

Attack Graph Response to US CERT AA22-152A: Karakurt Data Extortion Group

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attack Graph Response to US CERT AA22-152A: Karakurt Data Extortion Group
2 June 2022

Conti Targets Critical Firmware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti Targets Critical Firmware
2 June 2022

To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions | Mandiant
1 June 2022

CUBA Ransomware Campaign Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CUBA Ransomware Campaign Analysis
27 May 2022

BAZARLOADER: Analysing The Main Loader | 0ffset Training Solutions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BAZARLOADER: Analysing The Main Loader | 0ffset Training Solutions
26 May 2022

eset_threat_report_t12022

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor eset_threat_report_t12022
25 May 2022

SocGholish Campaigns and Initial Access Kit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SocGholish Campaigns and Initial Access Kit
25 May 2022

Bablosoft; Lowering the Barrier of Entry for Malicious Actors

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Bablosoft; Lowering the Barrier of Entry for Malicious Actors
24 May 2022

Emotet Botnet Rises Again | Bitsight

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet Botnet Rises Again | Bitsight
24 May 2022

Malware Analysis- Trickbot

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Malware Analysis- Trickbot
24 May 2022

Malware Analysis: Trickbot

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Analysis: Trickbot
23 May 2022

LockBit, Conti, and BlackCat Lead Pack Amid Rise in Active RaaS and Extortion Groups: Ransomware in Q1 2022

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor LockBit, Conti, and BlackCat Lead Pack Amid Rise in Active RaaS and Extortion Groups: Ransomware in Q1 2022
23 May 2022

LockBit, Conti, and BlackCat Lead Pack Amid Rise in Active RaaS and Extortion Groups

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor LockBit, Conti, and BlackCat Lead Pack Amid Rise in Active RaaS and Extortion Groups
20 May 2022

Why Remediation Alone Is Not Enough When Infected by Malware - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Why Remediation Alone Is Not Enough When Infected by Malware - ASEC
20 May 2022

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense
20 May 2022

Malicious 'pymafka' Package Drops Cobalt Strike | Sonatype

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malicious 'pymafka' Package Drops Cobalt Strike | Sonatype
20 May 2022

Malware Targets InfoSec: Fake PoC Delivers Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Targets InfoSec: Fake PoC Delivers Cobalt Strike
19 May 2022

ITG23 Crypters Highlight Cooperation Between Cybercriminal Groups

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor ITG23 Crypters Highlight Cooperation Between Cybercriminal Groups
19 May 2022

Bumblebee Malware from TransferXL URLs - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bumblebee Malware from TransferXL URLs - SANS ISC
19 May 2022

ITG23 crypters cooperation between cybercriminal groups

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor ITG23 crypters cooperation between cybercriminal groups
19 May 2022

Bumblebee Malware from TransferXL URLs - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bumblebee Malware from TransferXL URLs - SANS ISC
18 May 2022

WizardSpider

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor WizardSpider
17 May 2022

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense
17 May 2022

Ransomware Spotlight: RansomEXX

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware Spotlight: RansomEXX
12 May 2022

What malware to look for if you want to prevent a ransomware attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What malware to look for if you want to prevent a ransomware attack
12 May 2022

AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf
12 May 2022

Network Footprints of Gamaredon Group

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Network Footprints of Gamaredon Group
12 May 2022

Network Footprints of Gamaredon Group

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Network Footprints of Gamaredon Group
12 May 2022

Gootloader.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Gootloader.pdf
12 May 2022

The Goot cause: Detecting Gootloader and its follow-on activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Goot cause: Detecting Gootloader and its follow-on activity
11 May 2022

Operation RestyLink: 日本企業を狙った標的型攻撃キャンペーン

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation RestyLink: 日本企業を狙った標的型攻撃キャンペーン
11 May 2022

TA578 using thread-hijacked emails to push ISO files for Bumblebee malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TA578 using thread-hijacked emails to push ISO files for Bumblebee malware
9 May 2022

Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself | Microsoft Security Blog
9 May 2022

Malware development: persistence - part 4. Windows services. Simple C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development: persistence - part 4. Windows services. Simple C++ example.
9 May 2022

Ransomware-as-a-service- Understanding the cybercrime gig economy and how to protect yourself

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Ransomware-as-a-service- Understanding the cybercrime gig economy and how to protect yourself
9 May 2022

Hiding in Plain Sight: Obscuring C2s by Abusing CDN Services

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hiding in Plain Sight: Obscuring C2s by Abusing CDN Services
9 May 2022

SEO Poisoning - A Gootloader Story

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor SEO Poisoning - A Gootloader Story
6 May 2022

Cobalt Strike Analysis and Tutorial: CS Metadata Encoding and Decoding

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Analysis and Tutorial: CS Metadata Encoding and Decoding
6 May 2022

Russian Cyber Attack campaigns and actors - NOBELIUM has struck again.pdf

file creation date fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Russian Cyber Attack campaigns and actors - NOBELIUM has struck again.pdf
6 May 2022

This New Fileless Malware Hides Shellcode in Windows Event Logs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor This New Fileless Malware Hides Shellcode in Windows Event Logs
6 May 2022

Russian cyber attack campaigns and actors.pdf

file creation date fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Russian cyber attack campaigns and actors.pdf
5 May 2022

Mustang Panda deploys a new wave of malware targeting Europe

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mustang Panda deploys a new wave of malware targeting Europe
5 May 2022

Cybercrime loves company: Conti cooperated with other ransomware gangs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cybercrime loves company: Conti cooperated with other ransomware gangs
4 May 2022

A new secret stash for “fileless” malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A new secret stash for “fileless” malware
3 May 2022

SOLARDEFLECTION C2 Infrastructure Used by NOBELIUM in Company Brand Misuse

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SOLARDEFLECTION C2 Infrastructure Used by NOBELIUM in Company Brand Misuse
3 May 2022

ransomware-chats.pdf?1651576098

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor ransomware-chats.pdf?1651576098
2 May 2022

ショートカットとISOファイルを悪用する攻撃キャンペーン | セキュリティ研究センターブログ

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ショートカットとISOファイルを悪用する攻撃キャンペーン | セキュリティ研究センターブログ
29 April 2022

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research
28 April 2022

Ransomware: How Attackers are Breaching Corporate Networks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware: How Attackers are Breaching Corporate Networks
28 April 2022

yir-cyber-threats-annex-download.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor yir-cyber-threats-annex-download.pdf
28 April 2022

Tracking APT29 Phishing Campaigns | Atlassian Trello

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tracking APT29 Phishing Campaigns | Atlassian Trello
27 April 2022

The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection
27 April 2022

LockBit Ransomware Side-loads Cobalt Strike Beacon with Legitimate VMware Utility

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor LockBit Ransomware Side-loads Cobalt Strike Beacon with Legitimate VMware Utility
27 April 2022

20220427_NP_TLPWHITE_ANSSI_FIN7.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 20220427_NP_TLPWHITE_ANSSI_FIN7.pdf
27 April 2022

Botconf2022-40-LunghiHorejsi.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Botconf2022-40-LunghiHorejsi.pdf
27 April 2022

https://documents.trendmicro.com/assets/txt/earth-berberoka-windows-iocs-2.txt

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor https://documents.trendmicro.com/assets/txt/earth-berberoka-windows-iocs-2.txt
27 April 2022

UNC2452 Merged into APT29 | Russia-Based Espionage Group

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UNC2452 Merged into APT29 | Russia-Based Espionage Group
26 April 2022

How Cybercriminals Abuse Cloud Tunneling Services

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How Cybercriminals Abuse Cloud Tunneling Services
26 April 2022

Conti and Emotet: A constantly destructive duo

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti and Emotet: A constantly destructive duo
25 April 2022

Defeating BazarLoader Anti-Analysis Techniques

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Defeating BazarLoader Anti-Analysis Techniques
25 April 2022

New Core Impact Backdoor Delivered Via VMWare Vulnerability

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Core Impact Backdoor Delivered Via VMWare Vulnerability
25 April 2022

Quantum Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Quantum Ransomware
22 April 2022

FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7 | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7 | Mandiant
21 April 2022

Understanding Cobalt Strike Profiles - Updated for Cobalt Strike 4.6

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Understanding Cobalt Strike Profiles - Updated for Cobalt Strike 4.6
21 April 2022

GOLD ULRICK Continues Conti Operations Despite Public Disclosures

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor GOLD ULRICK Continues Conti Operations Despite Public Disclosures
20 April 2022

Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure

file creation date CISA, NSA, FBI fromORKL

Archived copy on ORKL Detailsfor Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure
20 April 2022

Microsoft Exchange servers hacked to deploy Hive ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Exchange servers hacked to deploy Hive ransomware
20 April 2022

Russian State-Sponsored and Criminal Cyber .pdf

file creation date fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Russian State-Sponsored and Criminal Cyber .pdf
20 April 2022

AA22-110A_Joint_CSA_Russian_State-Sponsored_and_Criminal_Cyber_Threats_to_Critical_Infrastructure_4_20_22_Final.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AA22-110A_Joint_CSA_Russian_State-Sponsored_and_Criminal_Cyber_Threats_to_Critical_Infrastructure_4_20_22_Final.pdf
20 April 2022

Alert (AA22-110A)- Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Alert (AA22-110A)- Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure
20 April 2022

Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure | CISA
19 April 2022

BAZARLOADER: Unpacking an ISO File Infection - 0ffset Training Solutions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BAZARLOADER: Unpacking an ISO File Infection - 0ffset Training Solutions
19 April 2022

Hive Ransomware Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hive Ransomware Analysis
18 April 2022

A blueprint for evading industry leading endpoint protection in 2022

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A blueprint for evading industry leading endpoint protection in 2022
18 April 2022

PYSA Ransomware: Technical Overview and Protection Strategies

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PYSA Ransomware: Technical Overview and Protection Strategies
18 April 2022

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense
17 April 2022

Lessons from the Conti Leaks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lessons from the Conti Leaks
15 April 2022

Karakurt revealed as data extortion arm of Conti cybercrime syndicate

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Karakurt revealed as data extortion arm of Conti cybercrime syndicate
15 April 2022

The Karakurt Web: Threat Intel and Blockchain Analysis Reveals Extension of Conti Business Model

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Karakurt Web: Threat Intel and Blockchain Analysis Reveals Extension of Conti Business Model
14 April 2022

Orion Threat Alert: Flight of the BumbleBee

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Orion Threat Alert: Flight of the BumbleBee
13 April 2022

Dismantling ZLoader: How malicious ads led to disabled security tools and ransomware | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dismantling ZLoader: How malicious ads led to disabled security tools and ransomware | Microsoft Security Blog
13 April 2022

Notorious cybercrime gang’s botnet disrupted - Microsoft On the Issues

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Notorious cybercrime gang’s botnet disrupted - Microsoft On the Issues
13 April 2022

ESET takes part in global operation to disrupt Zloader botnets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET takes part in global operation to disrupt Zloader botnets
12 April 2022

Resource Center | ConnectWise

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Resource Center | ConnectWise
11 April 2022

Conti ransomware source code investigation - part 2.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti ransomware source code investigation - part 2.
9 April 2022

Hackers use Conti's leaked ransomware to attack Russian companies

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hackers use Conti's leaked ransomware to attack Russian companies
8 April 2022

ConversingLabs Ep. 2- Conti pivots as ransomware as a service struggles

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor ConversingLabs Ep. 2- Conti pivots as ransomware as a service struggles
8 April 2022

RL Blog | ReversingLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RL Blog | ReversingLabs
7 April 2022

You Bet Your Lsass: Hunting LSASS Access | Splunk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor You Bet Your Lsass: Hunting LSASS Access | Splunk
7 April 2022

Advanced Network Detection & Response - MetaDefender NDR - OPSWAT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Advanced Network Detection & Response - MetaDefender NDR - OPSWAT
6 April 2022

TRM Analysis Corroborates Suspected Ties Between Conti and Ryuk Ransomware Groups and Wizard Spider

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor TRM Analysis Corroborates Suspected Ties Between Conti and Ryuk Ransomware Groups and Wizard Spider
6 April 2022

GitHub - infinitumitlabs/Karakurt-Hacking-Team-CTI: IOC Data Obtained From Karakurt Hacking Team's Internal Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GitHub - infinitumitlabs/Karakurt-Hacking-Team-CTI: IOC Data Obtained From Karakurt Hacking Team's Internal Infrastructure
6 April 2022

TRM Analysis Corroborates Suspected Ties Between Conti and Ryuk Ransomware Groups and Wizard Spider | TRM Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TRM Analysis Corroborates Suspected Ties Between Conti and Ryuk Ransomware Groups and Wizard Spider | TRM Blog
5 April 2022

Move fast and commit crimes: Conti’s development teams mirror corporate tech

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Move fast and commit crimes: Conti’s development teams mirror corporate tech
4 April 2022

Stolen Images Campaign Ends in Conti Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Stolen Images Campaign Ends in Conti Ransomware
4 April 2022

FIN7 Power Hour Adversary Archaeology and the Evolution of FIN7

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor FIN7 Power Hour Adversary Archaeology and the Evolution of FIN7
4 April 2022

FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7 | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7 | Mandiant
4 April 2022

FIN7 Power Hour- Adversary Archaeology and the Evolution of FIN7

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor FIN7 Power Hour- Adversary Archaeology and the Evolution of FIN7
2 April 2022

Malware development tricks. Find kernel32.dll base: asm style. C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development tricks. Find kernel32.dll base: asm style. C++ example.
31 March 2022

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research
30 March 2022

Phishing campaign targets Russian govt dissidents with Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Phishing campaign targets Russian govt dissidents with Cobalt Strike
29 March 2022

From the Front Lines | Hive Ransomware Deploys Novel IPfuscation Technique To Avoid Detection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From the Front Lines | Hive Ransomware Deploys Novel IPfuscation Technique To Avoid Detection
29 March 2022

New spear phishing campaign targets Russian dissidents

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New spear phishing campaign targets Russian dissidents
28 March 2022

CobaltStrike UUID stager

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CobaltStrike UUID stager
27 March 2022

Conti ransomware source code investigation - part 1.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti ransomware source code investigation - part 1.
25 March 2022

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research
25 March 2022

Despite Leaks, Conti Ransomware Attacks Persist | Zscaler

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Despite Leaks, Conti Ransomware Attacks Persist | Zscaler
23 March 2022

GOLD ULRICK Leaks Reveal Organizational Structure and Relationships

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor GOLD ULRICK Leaks Reveal Organizational Structure and Relationships
23 March 2022

Gone in 52 Seconds…and 42 Minutes: A Comparative Analysis of Ransomware Encryption Speed | Splunk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Gone in 52 Seconds…and 42 Minutes: A Comparative Analysis of Ransomware Encryption Speed | Splunk
23 March 2022

Conti puts the ‘organized’ in organized crime

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti puts the ‘organized’ in organized crime
22 March 2022

The Conti ransomware leaks demonstrate what happens when hackers support Russia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Conti ransomware leaks demonstrate what happens when hackers support Russia
22 March 2022

Cobalt Strike: Overview – Part 7

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike: Overview – Part 7
22 March 2022

2022_ThreatDetectionReport_RedCanary.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2022_ThreatDetectionReport_RedCanary.pdf
21 March 2022

Sandworm: A tale of disruption told anew

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sandworm: A tale of disruption told anew
21 March 2022

Sandworm- A tale of disruption told anew

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Sandworm- A tale of disruption told anew
21 March 2022

Conti Affiliate Exposed- New Domain Names, IP Addresses and Email Addresses Uncovered

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Conti Affiliate Exposed- New Domain Names, IP Addresses and Email Addresses Uncovered
21 March 2022

Conti Ransomware V. 3, Including Decryptor, Leaked

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti Ransomware V. 3, Including Decryptor, Leaked
21 March 2022

Conti Affiliate Exposed: New Domain Names, IP Addresses and Email Addresses Uncovered by eSentire

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti Affiliate Exposed: New Domain Names, IP Addresses and Email Addresses Uncovered by eSentire
18 March 2022

Analysis of Leaked Conti Intrusion Procedures by eSentire’s Threat Response Unit (TRU)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis of Leaked Conti Intrusion Procedures by eSentire’s Threat Response Unit (TRU)
18 March 2022

Mēris and TrickBot standing on the shoulders of giants

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mēris and TrickBot standing on the shoulders of giants
17 March 2022

Navigating New Frontiers: Trend Micro 2021 Annual Cybersecurity Report

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Navigating New Frontiers: Trend Micro 2021 Annual Cybersecurity Report
17 March 2022

Exposing initial access broker with ties to Conti

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Exposing initial access broker with ties to Conti
17 March 2022

Exposing initial access broker with ties to Conti

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Exposing initial access broker with ties to Conti
16 March 2022

Cobalt Strike Analysis and Tutorial: How Malleable C2 Profiles Make Cobalt Strike Difficult to Detect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Analysis and Tutorial: How Malleable C2 Profiles Make Cobalt Strike Difficult to Detect
16 March 2022

The Ransomware Threat Landscape: What to Expect in 2022

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor The Ransomware Threat Landscape: What to Expect in 2022
16 March 2022

Uncovering Trickbot’s use of IoT devices in command-and-control infrastructure | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Uncovering Trickbot’s use of IoT devices in command-and-control infrastructure | Microsoft Security Blog
16 March 2022

Suspected Conti Ransomware Activity in the Auto Manufacturing Sector

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Suspected Conti Ransomware Activity in the Auto Manufacturing Sector
16 March 2022

Qakbot infection with Cobalt Strike and VNC activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Qakbot infection with Cobalt Strike and VNC activity
16 March 2022

Qakbot infection with Cobalt Strike and VNC activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Qakbot infection with Cobalt Strike and VNC activity
15 March 2022

What Wicked Webs We Un-weave

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor What Wicked Webs We Un-weave
15 March 2022

Threat Actor UAC-0056 Targeting Ukraine with Fake Translation Software

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Actor UAC-0056 Targeting Ukraine with Fake Translation Software
14 March 2022

Fake antivirus updates used to deploy Cobalt Strike in Ukraine

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Fake antivirus updates used to deploy Cobalt Strike in Ukraine
12 March 2022

Analyzing Malware with Hooks, Stomps, and Return-addresses

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing Malware with Hooks, Stomps, and Return-addresses
11 March 2022

CERT-UA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERT-UA
10 March 2022

Leaks of Conti Ransomware Group Paint Picture of a Surprisingly Normal Tech Start-Up… Sort Of

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Leaks of Conti Ransomware Group Paint Picture of a Surprisingly Normal Tech Start-Up… Sort Of
10 March 2022

Corporate website contact forms used to spread BazarBackdoor malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Corporate website contact forms used to spread BazarBackdoor malware
9 March 2022

BazarLoader Actors Initiate Contact via Contact Forms

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BazarLoader Actors Initiate Contact via Contact Forms
9 March 2022

CISA updates Conti ransomware alert with nearly 100 domain names

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CISA updates Conti ransomware alert with nearly 100 domain names
9 March 2022

BazarLoader Actors Initiate Contact via Website Contact Forms

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor BazarLoader Actors Initiate Contact via Website Contact Forms
8 March 2022

MBSD_Summary_of_ContiLeaks_Rev3.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MBSD_Summary_of_ContiLeaks_Rev3.pdf
8 March 2022

Inside Conti leaks: The Panama Papers of ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Inside Conti leaks: The Panama Papers of ransomware
8 March 2022

APT41 Targeting U.S. State Government Networks | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT41 Targeting U.S. State Government Networks | Mandiant
7 March 2022

2021 Year In Review

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor 2021 Year In Review
7 March 2022

Ransomware gang Conti has already bounced back from damage caused by chat leaks, experts say

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware gang Conti has already bounced back from damage caused by chat leaks, experts say
4 March 2022

Legitimate Sites used as Cobalt Strike C2s against Indian Government

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Legitimate Sites used as Cobalt Strike C2s against Indian Government
3 March 2022

Cyberattacks are Prominent in the Russia-Ukraine Conflict

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyberattacks are Prominent in the Russia-Ukraine Conflict
2 March 2022

Conti Ransomware Decryptor, TrickBot Source Code Leaked

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti Ransomware Decryptor, TrickBot Source Code Leaked
2 March 2022

Conti Ransomware Group Diaries, Part II: The Office

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti Ransomware Group Diaries, Part II: The Office
2 March 2022

Conti Group Leaked!

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti Group Leaked!
2 March 2022

Capos del cibercrimen avisan de que "contratacarán" si se hackea a Rusia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Capos del cibercrimen avisan de que "contratacarán" si se hackea a Rusia
1 March 2022

Conti Ransomware | Arctic Wolf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti Ransomware | Arctic Wolf
1 March 2022

Conti Ransomware source code leaked by Ukrainian researcher

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti Ransomware source code leaked by Ukrainian researcher
1 March 2022

2021trends.pdf

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor 2021trends.pdf
28 February 2022

Analyzing conti-leaks without speaking russian — only methodology

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing conti-leaks without speaking russian — only methodology
27 February 2022

Conti ransomware gang chats leaked by pro-Ukraine member

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti ransomware gang chats leaked by pro-Ukraine member
27 February 2022

Conti ransomware's internal chats leaked after siding with Russia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti ransomware's internal chats leaked after siding with Russia
25 February 2022

Il ransomware Conti si schiera a favore della Russia nella cyberwar.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Il ransomware Conti si schiera a favore della Russia nella cyberwar.
25 February 2022

New malware TrickBot AnchorDNS backdoor upgrades AnchorMail

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor New malware TrickBot AnchorDNS backdoor upgrades AnchorMail
25 February 2022

Trickbot Group’s AnchorDNS Backdoor Upgrades to AnchorMail

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Trickbot Group’s AnchorDNS Backdoor Upgrades to AnchorMail
25 February 2022

TrickBot malware suddenly got quiet, researchers say, but it’s hardly the end for its operators

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot malware suddenly got quiet, researchers say, but it’s hardly the end for its operators
24 February 2022

Notorious TrickBot Malware Gang Shuts Down its Botnet Infrastructure

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Notorious TrickBot Malware Gang Shuts Down its Botnet Infrastructure
24 February 2022

TrickBot gang shuts down botnet after months of inactivity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot gang shuts down botnet after months of inactivity
24 February 2022

[QuickNote] Techniques for decrypting BazarLoader strings

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor [QuickNote] Techniques for decrypting BazarLoader strings
24 February 2022

Nobelium Returns to the Political World Stage | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Nobelium Returns to the Political World Stage | FortiGuard Labs
24 February 2022

TrickBot Gang Likely Shifting Operations to Switch to New Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot Gang Likely Shifting Operations to Switch to New Malware
24 February 2022

Notorious TrickBot Malware Gang Shuts Down its Botnet Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Notorious TrickBot Malware Gang Shuts Down its Botnet Infrastructure
24 February 2022

New Wave of Emotet - When Project X Turns Into Y

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Wave of Emotet - When Project X Turns Into Y
23 February 2022

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense
23 February 2022

What the Pack(er)? | cyber.wtf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What the Pack(er)? | cyber.wtf
23 February 2022

An Empirically Comparative Analysis of Ransomware Binaries

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor An Empirically Comparative Analysis of Ransomware Binaries
22 February 2022

Cybercrime Moves: Conti Ransomware Absorbs TrickBot Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cybercrime Moves: Conti Ransomware Absorbs TrickBot Malware
22 February 2022

Cybercrime Moves- Conti Ransomware Absorbs TrickBot Malware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Cybercrime Moves- Conti Ransomware Absorbs TrickBot Malware
22 February 2022

Vulnerable Microsoft SQL Servers targeted with Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Vulnerable Microsoft SQL Servers targeted with Cobalt Strike
22 February 2022

IcedID to Cobalt Strike In Under 20 Minutes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor IcedID to Cobalt Strike In Under 20 Minutes
21 February 2022

Cobalt Strike Being Distributed to Unsecured MS-SQL Servers - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Being Distributed to Unsecured MS-SQL Servers - ASEC
21 February 2022

Qbot and Zerologon Lead To Full Domain Compromise

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Qbot and Zerologon Lead To Full Domain Compromise
20 February 2022

Trickbot operation is now controlled by Conti ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trickbot operation is now controlled by Conti ransomware
20 February 2022

Detecting Cobalt Strike Beacons

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detecting Cobalt Strike Beacons
18 February 2022

Hackers No Hashing | Huntress

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hackers No Hashing | Huntress
18 February 2022

Conti ransomware gang takes over TrickBot malware operation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti ransomware gang takes over TrickBot malware operation
16 February 2022

Quick Malware Analysis: Emotet Epoch 5 and Cobalt Strike pcap from 2022-02-08

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Quick Malware Analysis: Emotet Epoch 5 and Cobalt Strike pcap from 2022-02-08
16 February 2022

Report2022GTR.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Report2022GTR.pdf
16 February 2022

A Modern Ninja: Evasive Trickbot Attacks Customers of 60 High-Profile Companies

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Modern Ninja: Evasive Trickbot Attacks Customers of 60 High-Profile Companies
16 February 2022

TrickBot Ravages Customers of Amazon, PayPal and Other Top Brands

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot Ravages Customers of Amazon, PayPal and Other Top Brands
16 February 2022

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense
16 February 2022

Highway to Conti: Analysis of Bazarloader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Highway to Conti: Analysis of Bazarloader
15 February 2022

Increase in Emotet Activity and Cobalt Strike Deployment

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Increase in Emotet Activity and Cobalt Strike Deployment
14 February 2022

Report2022GTR

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Report2022GTR
14 February 2022

404: This page could not be found.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 404: This page could not be found.
10 February 2022

THREAT ANALYSIS: Cobalt Strike - IcedID, Emotet and QBot

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor THREAT ANALYSIS: Cobalt Strike - IcedID, Emotet and QBot
9 February 2022

eset_threat_report_t32021.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eset_threat_report_t32021.pdf
9 February 2022

VMware Exposing Malware In Linux Based Multi Cloud Environments

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor VMware Exposing Malware In Linux Based Multi Cloud Environments
8 February 2022

PrivateLoader: The first step in many malware schemes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PrivateLoader: The first step in many malware schemes
8 February 2022

eset_threat_report_t32021

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor eset_threat_report_t32021
4 February 2022

HHS: Conti ransomware encrypted 80% of Ireland's HSE IT systems

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor HHS: Conti ransomware encrypted 80% of Ireland's HSE IT systems
2 February 2022

TrickBot gang template-based metaprogramming Bazar malware

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor TrickBot gang template-based metaprogramming Bazar malware
1 February 2022

Inside Trickbot, Russia’s Notorious Ransomware Gang

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Inside Trickbot, Russia’s Notorious Ransomware Gang
31 January 2022

Analyzing Malware with Hooks, Stomps and Return-addresses

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing Malware with Hooks, Stomps and Return-addresses
28 January 2022

Log4j Exploit Hits Again: Vulnerable Unifi Network Application (Ubiquiti) at Risk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Log4j Exploit Hits Again: Vulnerable Unifi Network Application (Ubiquiti) at Risk
27 January 2022

Ransomware as a Service Innovation Trends to Watch

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware as a Service Innovation Trends to Watch
27 January 2022

Taiwanese Apple and Tesla contractor hit by Conti ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Taiwanese Apple and Tesla contractor hit by Conti ransomware
27 January 2022

What We Can Do against the Chaotic A41APT Campaign（公開版）

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What We Can Do against the Chaotic A41APT Campaign（公開版）
26 January 2022

ALPHV ransomware gang analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ALPHV ransomware gang analysis
26 January 2022

ALPHV ransomware gang analysis

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor ALPHV ransomware gang analysis
26 January 2022

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog
25 January 2022

Threats Looming Over the Horizon

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threats Looming Over the Horizon
24 January 2022

The Road to Ransomware Resilience, Part 2: Behavior Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Road to Ransomware Resilience, Part 2: Behavior Analysis
24 January 2022

Cobalt Strike, a Defender’s Guide - Part 2

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Cobalt Strike, a Defender’s Guide - Part 2
24 January 2022

Deep Dive into Trickbot's Web Injection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Deep Dive into Trickbot's Web Injection
22 January 2022

BazarISO Analysis - Loading with Advpack.dll

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BazarISO Analysis - Loading with Advpack.dll
20 January 2022

FBI links Diavol ransomware to the TrickBot cybercrime group

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor FBI links Diavol ransomware to the TrickBot cybercrime group
20 January 2022

Log4j Exploit Hits Again: Vulnerable VMWare Horizon Servers at Risk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Log4j Exploit Hits Again: Vulnerable VMWare Horizon Servers at Risk
20 January 2022

FBI links Diavol ransomware to the TrickBot cybercrime group

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor FBI links Diavol ransomware to the TrickBot cybercrime group
19 January 2022

Kraken the Code on Prometheus

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Kraken the Code on Prometheus
19 January 2022

Microsoft Word - DiavolFLASH Approved FINAL 01192022

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Microsoft Word - DiavolFLASH Approved FINAL 01192022
19 January 2022

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog
18 January 2022

2021 Adversary Infrastructure Report

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2021 Adversary Infrastructure Report
16 January 2022

Analyzing a CACTUSTORCH HTA Leading to Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing a CACTUSTORCH HTA Leading to Cobalt Strike
15 January 2022

BazarLoader – Back From Holiday Break – Malware Book Reports

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BazarLoader – Back From Holiday Break – Malware Book Reports
15 January 2022

VMware Horizon Servers Actively Being Hit With Cobalt Strike | Huntress

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor VMware Horizon Servers Actively Being Hit With Cobalt Strike | Huntress
11 January 2022

Threat Analysis Report: DatopLoader Exploits ProxyShell to Deliver QBOT and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Analysis Report: DatopLoader Exploits ProxyShell to Deliver QBOT and Cobalt Strike
11 January 2022

Signed DLL campaigns as a service

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Signed DLL campaigns as a service
9 January 2022

Inspecting a PowerShell Cobalt Strike Beacon

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Inspecting a PowerShell Cobalt Strike Beacon
6 January 2022

NOBELIUM’s EnvyScout infection chain goes in the registry, targeting embassies

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor NOBELIUM’s EnvyScout infection chain goes in the registry, targeting embassies
2 January 2022

Malicious CSV text files used to install BazarBackdoor malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malicious CSV text files used to install BazarBackdoor malware
29 December 2021

AQUATIC PANDA in Possession of Log4Shell Exploit Tools | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AQUATIC PANDA in Possession of Log4Shell Exploit Tools | CrowdStrike
23 December 2021

Log4j Vulnerabilities: Attack Insights

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Log4j Vulnerabilities: Attack Insights
17 December 2021

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense
16 December 2021

Winnti is Coming - Evolution after Prosecution@HITCON2021

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Winnti is Coming - Evolution after Prosecution@HITCON2021
16 December 2021

Intelligence Insights: December 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Intelligence Insights: December 2021
13 December 2021

Diavol Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Diavol Ransomware
13 December 2021

Diavol Ransomware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Diavol Ransomware
10 December 2021

What We Think | Business & Technology Insights

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What We Think | Business & Technology Insights
8 December 2021

The double extortion business- Conti Ransomware Gang finds new avenues of negotiation

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The double extortion business- Conti Ransomware Gang finds new avenues of negotiation
7 December 2021

Emotet now drops Cobalt Strike, fast forwards ransomware attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet now drops Cobalt Strike, fast forwards ransomware attacks
6 December 2021

Suspected Russian Activity Targeting Government and Business Entities Around the Globe | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Suspected Russian Activity Targeting Government and Business Entities Around the Globe | Mandiant
3 December 2021

24/7 managed detection, response, and expert cybersecurity services - GoSecure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 24/7 managed detection, response, and expert cybersecurity services - GoSecure
2 December 2021

CERTFR-2021-CTI-011.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERTFR-2021-CTI-011.pdf
1 December 2021

Ransomware Spotlight: Conti

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware Spotlight: Conti
30 November 2021

Yanluowang: Further Insights on New Ransomware Threat

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Yanluowang: Further Insights on New Ransomware Threat
29 November 2021

CONTInuing the Bazar Ransomware Story

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor CONTInuing the Bazar Ransomware Story
29 November 2021

Kitten.gif: Meet the Sabbath Ransomware Affiliate Program, Again

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Kitten.gif: Meet the Sabbath Ransomware Affiliate Program, Again
23 November 2021

Mummy Spider’s Emotet Malware is Back After a Year Hiatus; Wizard Spider’s TrickBot Observed in Its Return

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Mummy Spider’s Emotet Malware is Back After a Year Hiatus; Wizard Spider’s TrickBot Observed in Its Return
23 November 2021

Mummy Spider's Emotet Malware is Back After a Year Hiatus; Wizard Spider's TrickBot Observed in Its Return

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mummy Spider's Emotet Malware is Back After a Year Hiatus; Wizard Spider's TrickBot Observed in Its Return
23 November 2021

BazarLoader Adds Compromised Installers, ISO to Arrival and Delivery Vectors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BazarLoader Adds Compromised Installers, ISO to Arrival and Delivery Vectors
19 November 2021

Squirrelwaffle Exploits ProxyShell and ProxyLogon to Hijack Email Chains

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Squirrelwaffle Exploits ProxyShell and ProxyLogon to Hijack Email Chains
18 November 2021

Conti Ransomware Group In-Depth Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti Ransomware Group In-Depth Analysis
18 November 2021

Conti Ransomware Nets at Least $25.5 Million in Four Months

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti Ransomware Nets at Least $25.5 Million in Four Months
18 November 2021

Malware reverse engineering (Ryuk Ransomware)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware reverse engineering (Ryuk Ransomware)
18 November 2021

Intelligence Insights: November 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Intelligence Insights: November 2021
18 November 2021

Conti Ransomware

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Conti Ransomware
18 November 2021

Conti Ransomware Nets at Least $25.5 Million in Four Months

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Conti Ransomware Nets at Least $25.5 Million in Four Months
17 November 2021

DNS Over HTTPS for Cobalt Strike - Black Hills Information Security, Inc.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DNS Over HTTPS for Cobalt Strike - Black Hills Information Security, Inc.
17 November 2021

Cobalt Strike: Decrypting Obfuscated Traffic – Part 4

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike: Decrypting Obfuscated Traffic – Part 4
17 November 2021

Analyzing ProxyShell-related Incidents via Trend Micro Managed XDR

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing ProxyShell-related Incidents via Trend Micro Managed XDR
16 November 2021

FINDING BEACONS IN THE DARK 1650728751599

Malpedia library date BlackBerry fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor FINDING BEACONS IN THE DARK 1650728751599
16 November 2021

Attackers use domain fronting technique to target Myanmar with Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attackers use domain fronting technique to target Myanmar with Cobalt Strike
16 November 2021

Excel 4 macro code obfuscation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Excel 4 macro code obfuscation
16 November 2021

TrickBot helps Emotet come back from the dead

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot helps Emotet come back from the dead
15 November 2021

ProxyShell, QBot, and Conti ransomware combined in a series of cyber attacks - Truesec

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ProxyShell, QBot, and Conti ransomware combined in a series of cyber attacks - Truesec
13 November 2021

Threat Spotlight - Domain Fronting

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Spotlight - Domain Fronting
12 November 2021

A multi-stage PowerShell based attack targets Kazakhstan

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A multi-stage PowerShell based attack targets Kazakhstan
12 November 2021

The Business of Fraud: Botnet Malware Dissemination

Malpedia library date Insikt Group® fromORKL

Archived copy on ORKL Detailsfor The Business of Fraud: Botnet Malware Dissemination
11 November 2021

HTML smuggling surges- Highly evasive loader technique increasingly used in banking malware, targeted attacks

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor HTML smuggling surges- Highly evasive loader technique increasingly used in banking malware, targeted attacks
11 November 2021

HTML smuggling surges: Highly evasive loader technique increasingly used in banking malware, targeted attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor HTML smuggling surges: Highly evasive loader technique increasingly used in banking malware, targeted attacks
11 November 2021

Quakbot Strikes with QuakNightmare Exploitation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Quakbot Strikes with QuakNightmare Exploitation
10 November 2021

Walking on APT31 infrastructure footprints

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Walking on APT31 infrastructure footprints
9 November 2021

THREAT ANALYSIS REPORT- From Shatak Emails to the Conti Ransomware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor THREAT ANALYSIS REPORT- From Shatak Emails to the Conti Ransomware
9 November 2021

THREAT ANALYSIS REPORT: From Shathak Emails to the Conti Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor THREAT ANALYSIS REPORT: From Shathak Emails to the Conti Ransomware
5 November 2021

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog
5 November 2021

An Analysis of Buer Loader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor An Analysis of Buer Loader
3 November 2021

Cobalt Strike: Using Process Memory To Decrypt Traffic – Part 3

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike: Using Process Memory To Decrypt Traffic – Part 3
2 November 2021

Detecting CONTI CobaltStrike Lateral Movement Techniques - Part 2 | Cyb3rSn0rlax

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Detecting CONTI CobaltStrike Lateral Movement Techniques - Part 2 | Cyb3rSn0rlax
2 November 2021

Cybercrime underground flush with shipping companies’ credentials

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cybercrime underground flush with shipping companies’ credentials
1 November 2021

Accenture | Security Solutions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Accenture | Security Solutions
1 November 2021

From Zero to Domain Admin

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor From Zero to Domain Admin
29 October 2021

12 targeted for involvement in ransomware attacks against critical infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 12 targeted for involvement in ransomware attacks against critical infrastructure
29 October 2021

Національна поліція України

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Національна поліція України
28 October 2021

Russian National Extradited to United States to Face Charges for Alleged Role in Cybercriminal Organization

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Russian National Extradited to United States to Face Charges for Alleged Role in Cybercriminal Organization
27 October 2021

TrickBot ... many tricks - VinCSS Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot ... many tricks - VinCSS Blog
27 October 2021

Cobalt Strike: Using Known Private Keys To Decrypt Traffic – Part 2

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike: Using Known Private Keys To Decrypt Traffic – Part 2
26 October 2021

SQUIRRELWAFFLE Leverages malspam to deliver Qakbot, Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SQUIRRELWAFFLE Leverages malspam to deliver Qakbot, Cobalt Strike
26 October 2021

Detecting CONTI CobaltStrike Lateral Movement Techniques - Part 1 | Cyb3rSn0rlax

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Detecting CONTI CobaltStrike Lateral Movement Techniques - Part 1 | Cyb3rSn0rlax
25 October 2021

Conti Ransom Gang Starts Selling Access to Victims

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti Ransom Gang Starts Selling Access to Victims
22 October 2021

Advanced IP Scanner: the preferred scanner in the A(P)T toolbox

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Advanced IP Scanner: the preferred scanner in the A(P)T toolbox
22 October 2021

Advanced IP Scanner- the preferred scanner in the A(P)T toolbox

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Advanced IP Scanner- the preferred scanner in the A(P)T toolbox
21 October 2021

Stopping GRACEFUL SPIDER: Falcon Complete’s Fast Response to Recent SolarWinds Serv-U Exploit Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Stopping GRACEFUL SPIDER: Falcon Complete’s Fast Response to Recent SolarWinds Serv-U Exploit Campaign
21 October 2021

Cobalt Strike: Using Known Private Keys To Decrypt Traffic – Part 1

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike: Using Known Private Keys To Decrypt Traffic – Part 1
19 October 2021

Trickbot module descriptions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trickbot module descriptions
18 October 2021

Harvester: Nation-State-Backed Group Uses New Toolset to Target Victims in South Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Harvester: Nation-State-Backed Group Uses New Toolset to Target Victims in South Asia
18 October 2021

Case Study: From BazarLoader to Network Reconnaissance

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Case Study: From BazarLoader to Network Reconnaissance
18 October 2021

IcedID to XingLocker Ransomware in 24 hours

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor IcedID to XingLocker Ransomware in 24 hours
14 October 2021

Investigation into the state of NIM malware Part 2

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Investigation into the state of NIM malware Part 2
13 October 2021

Trickbot Rising — Gang Doubles Down on Infection Efforts to Amass Network Footholds

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Trickbot Rising — Gang Doubles Down on Infection Efforts to Amass Network Footholds
13 October 2021

TrickBot gang doubles down enterprise infection

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor TrickBot gang doubles down enterprise infection
13 October 2021

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog
12 October 2021

Cobalt Strike | Defining Cobalt Strike Components & BEACON

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike | Defining Cobalt Strike Components & BEACON
11 October 2021

Secure AI Build Resilience & Accelerate Value with Accenture

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure AI Build Resilience & Accelerate Value with Accenture
8 October 2021

New Trickbot and BazarLoader delivery vectors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Trickbot and BazarLoader delivery vectors
8 October 2021

SQUIRRELWAFFLE – Analysing The Main Loader | 0ffset

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SQUIRRELWAFFLE – Analysing The Main Loader | 0ffset
7 October 2021

fin12-group-profile.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor fin12-group-profile.pdf
7 October 2021

SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot
7 October 2021

FIN12- The Prolific Ransomware Intrusion Threat Actor That Has Aggressively Pursued Healthcare Targets

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor FIN12- The Prolific Ransomware Intrusion Threat Actor That Has Aggressively Pursued Healthcare Targets
7 October 2021

FIN12: The Prolific Ransomware Intrusion Threat Actor That Has Aggressively Pursued Healthcare Targets | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor FIN12: The Prolific Ransomware Intrusion Threat Actor That Has Aggressively Pursued Healthcare Targets | Mandiant
6 October 2021

sneak-peek-ch1-2-finding-beacons-in-the-dark.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor sneak-peek-ch1-2-finding-beacons-in-the-dark.pdf
5 October 2021

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog
5 October 2021

Ransomware as a Service: Enabler of Widespread Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware as a Service: Enabler of Widespread Attacks
4 October 2021

BazarLoader and the Conti Leaks

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor BazarLoader and the Conti Leaks
4 October 2021

Threat hunting in large datasets by clustering security events

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat hunting in large datasets by clustering security events
3 October 2021

PowerPoint-Präsentation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PowerPoint-Präsentation
1 October 2021

HP Wolf Security Threat Insights Report Q3 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor HP Wolf Security Threat Insights Report Q3 2021
1 October 2021

SQUIRRELWAFFLE – Analysing the Custom Packer | 0ffset

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SQUIRRELWAFFLE – Analysing the Custom Packer | 0ffset
30 September 2021

Masters of Mimicry: new APT group ChamelGang and its arsenal

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Masters of Mimicry: new APT group ChamelGang and its arsenal
30 September 2021

How CrowdStrike Threat Hunters Identified a Confluence Exploit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How CrowdStrike Threat Hunters Identified a Confluence Exploit
30 September 2021

Masters of Mimicry: new APT group ChamelGang and its arsenal

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Masters of Mimicry: new APT group ChamelGang and its arsenal
29 September 2021

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense
28 September 2021

The Squirrelwaffle: New Loader Delivers Cobalt Strikes |Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Squirrelwaffle: New Loader Delivers Cobalt Strikes |Blog
27 September 2021

A Virtual Baffle to Battle SquirrelWaffle

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Virtual Baffle to Battle SquirrelWaffle
26 September 2021

Insights into Ransomware Spread Using Exchange 1-Day Vulnerabilities 1-2 - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Insights into Ransomware Spread Using Exchange 1-Day Vulnerabilities 1-2 - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.
24 September 2021

Examining the Cring Ransomware Techniques

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Examining the Cring Ransomware Techniques
23 September 2021

eset_threat_report_t22021

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor eset_threat_report_t22021
21 September 2021

Ransomware Hackers Attack a Top Safety Testing Org. Using Tactics and Techniques Borrowed from Chinese Espionage Groups

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware Hackers Attack a Top Safety Testing Org. Using Tactics and Techniques Borrowed from Chinese Espionage Groups
21 September 2021

The Squirrel Strikes Back: Analysis of the newly emerged cobalt-strike loader “SquirrelWaffle”

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Squirrel Strikes Back: Analysis of the newly emerged cobalt-strike loader “SquirrelWaffle”
21 September 2021

A Ransomware Near Miss: ProxyShell, a RAT, and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Ransomware Near Miss: ProxyShell, a RAT, and Cobalt Strike
21 September 2021

Scanning VirusTotal's firehose | Sky Blueteam

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Scanning VirusTotal's firehose | Sky Blueteam
17 September 2021

4 Popular Defensive Evasion Techniques in 2021 | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 4 Popular Defensive Evasion Techniques in 2021 | CrowdStrike
17 September 2021

The default: 63 6f 62 61 6c 74 strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The default: 63 6f 62 61 6c 74 strike
17 September 2021

Falcon OverWatch Hunts Down Adversaries Where They Hide

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Falcon OverWatch Hunts Down Adversaries Where They Hide
16 September 2021

Pointer: Hunting Cobalt Strike globally

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Pointer: Hunting Cobalt Strike globally
15 September 2021

Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability
15 September 2021

Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability | Microsoft Security Blog
14 September 2021

Big Game Hunting TTPs Continue to Shift After DarkSide Pipeline Attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Big Game Hunting TTPs Continue to Shift After DarkSide Pipeline Attack
14 September 2021

Big Game Hunting TTPs Continue to Shift After DarkSide Pipeline Attack

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Big Game Hunting TTPs Continue to Shift After DarkSide Pipeline Attack
14 September 2021

Full-Spectrum Cobalt Strike Detection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Full-Spectrum Cobalt Strike Detection
13 September 2021

BazarLoader to Conti Ransomware in 32 Hours

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor BazarLoader to Conti Ransomware in 32 Hours
10 September 2021

Rendering Threats: A Network Perspective

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rendering Threats: A Network Perspective
9 September 2021

Remote Code Execution Zero-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Remote Code Execution Zero-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs
8 September 2021

Hook Heaps and Live Free

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hook Heaps and Live Free
7 September 2021

Report2021ThreatHunting

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Report2021ThreatHunting
6 September 2021

TrickBot gang developer arrested when trying to leave Korea

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot gang developer arrested when trying to leave Korea
6 September 2021

Quick analysis CobaltStrike loader and shellcode

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Quick analysis CobaltStrike loader and shellcode
4 September 2021

AV engines evasion for C++ simple malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AV engines evasion for C++ simple malware
3 September 2021

The State of SSL/TLS Certificate Usage in Malware C&C Communications

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The State of SSL/TLS Certificate Usage in Malware C&C Communications
2 September 2021

Translated: Talos' insights from the recently leaked Conti ransomware playbook

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Translated: Talos' insights from the recently leaked Conti ransomware playbook
31 August 2021

Cobalt Strike and Ransomware – Tracking An Effective Ransomware Campaign - BreakPoint Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike and Ransomware – Tracking An Effective Ransomware Campaign - BreakPoint Labs
31 August 2021

Sidoh- WIZARD SPIDER’s Mysterious Exfiltration Tool

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Sidoh- WIZARD SPIDER’s Mysterious Exfiltration Tool
31 August 2021

An Analysis of Sidoh: WIZARD SPIDER's Exfiltration Tool | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor An Analysis of Sidoh: WIZARD SPIDER's Exfiltration Tool | CrowdStrike
30 August 2021

奇安信威胁情报中心

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 奇安信威胁情报中心
29 August 2021

Cobalt Strike, a Defender's Guide

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Cobalt Strike, a Defender's Guide
29 August 2021

Cobalt Strike, a Defender’s Guide

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Cobalt Strike, a Defender’s Guide
27 August 2021

Blog Archive

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Blog Archive
27 August 2021

https://www.aon.com/cyber-solutions/aon_cyber_labs/cobalt-strike-configuration-extractor-and-parser/

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor https://www.aon.com/cyber-solutions/aon_cyber_labs/cobalt-strike-configuration-extractor-and-parser/
24 August 2021

The SideWalk may be as dangerous as the CROSSWALK

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The SideWalk may be as dangerous as the CROSSWALK
24 August 2021

Earth Baku Returns: Uncovering the Upgraded Toolset Behind the APT Group’s New Cyberespionage Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Baku Returns: Uncovering the Upgraded Toolset Behind the APT Group’s New Cyberespionage Campaign
23 August 2021

210823.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 210823.pdf
19 August 2021

An insider insights into Conti operations – Part Two

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor An insider insights into Conti operations – Part Two
19 August 2021

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog
18 August 2021

How to Detect Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How to Detect Cobalt Strike
17 August 2021

Analysis of Diavol Ransomware Reveals Possible Link to TrickBot Gang

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Analysis of Diavol Ransomware Reveals Possible Link to TrickBot Gang
17 August 2021

An insider insights into Conti operations – Part One

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor An insider insights into Conti operations – Part One
17 August 2021

An insider insights into Conti operations – Part one

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor An insider insights into Conti operations – Part one
15 August 2021

The Ransomware Threat (White Paper)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Ransomware Threat (White Paper)
11 August 2021

Nationstate_ransomware_with_consecutive_endnotes.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Nationstate_ransomware_with_consecutive_endnotes.pdf
10 August 2021

A Detailed Analysis of The Last Version of Conti Ransomware

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor A Detailed Analysis of The Last Version of Conti Ransomware
9 August 2021

A BazarLoader DGA that Breaks Down in the Summer

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A BazarLoader DGA that Breaks Down in the Summer
9 August 2021

APT Cobalt Strike Campaign targeting Slovakia (DEF CON talk)

Malpedia library date IstroSec fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT Cobalt Strike Campaign targeting Slovakia (DEF CON talk)
6 August 2021

Angry Affiliate Leaks Conti Ransomware Gang Playbook

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Angry Affiliate Leaks Conti Ransomware Gang Playbook
5 August 2021

Ransomware Gangs and the Name Game Distraction

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware Gangs and the Name Game Distraction
5 August 2021

Red Canary Intel: When Dridex and Cobalt Strike give you Grief

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Red Canary Intel: When Dridex and Cobalt Strike give you Grief
5 August 2021

Disgruntled ransomware affiliate leaks the Conti gang's technical manuals

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Disgruntled ransomware affiliate leaks the Conti gang's technical manuals
5 August 2021

Angry Conti ransomware affiliate leaks gang's attack playbook

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Angry Conti ransomware affiliate leaks gang's attack playbook
5 August 2021

Detecting Cobalt Strike Government-Sponsored Threat Groups (APT32)

date in the CCS '25 data SecureWorks fromCCS '25 data

Detailsfor Detecting Cobalt Strike Government-Sponsored Threat Groups (APT32)
4 August 2021

How PROPHET SPIDER Exploits Oracle WebLogic | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How PROPHET SPIDER Exploits Oracle WebLogic | CrowdStrike
4 August 2021

Hotcobalt - New Cobalt Strike DoS Vulnerability That Lets You Halt Operations - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hotcobalt - New Cobalt Strike DoS Vulnerability That Lets You Halt Operations - SentinelLabs
3 August 2021

DeadRinger: Exposing Chinese Threat Actors Targeting Major Telcos

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DeadRinger: Exposing Chinese Threat Actors Targeting Major Telcos
1 August 2021

BazarCall to Conti Ransomware via Trickbot and Cobalt Strike

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor BazarCall to Conti Ransomware via Trickbot and Cobalt Strike
30 July 2021

Decrypting BazarLoader strings with a Unicorn

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Decrypting BazarLoader strings with a Unicorn
29 July 2021

BazaCall: Phony call centers lead to exfiltration and ransomware | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BazaCall: Phony call centers lead to exfiltration and ransomware | Microsoft Security Blog
29 July 2021

BazaCall: Phony call centers lead to exfiltration and ransomware | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BazaCall: Phony call centers lead to exfiltration and ransomware | Microsoft Security Blog
27 July 2021

report-old-dogs-new-tricks.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor report-old-dogs-new-tricks.pdf
25 July 2021

Guide to Named Pipes and Hunting for Cobalt Strike Pipes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Guide to Named Pipes and Hunting for Cobalt Strike Pipes
22 July 2021

Cobalt Strike Hunting — simple PCAP and Beacon Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Hunting — simple PCAP and Beacon Analysis
21 July 2021

Detecting Trickbot with Splunk | Splunk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detecting Trickbot with Splunk | Splunk
21 July 2021

Detecting Trickbot with Splunk

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Detecting Trickbot with Splunk
19 July 2021

IcedID and Cobalt Strike vs Antivirus

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor IcedID and Cobalt Strike vs Antivirus
15 July 2021

Adjusting the Anchor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Adjusting the Anchor
14 July 2021

LuminousMoth APT: Sweeping attacks for the chosen few

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor LuminousMoth APT: Sweeping attacks for the chosen few
14 July 2021

BazarBackdoor sneaks in through nested RAR and ZIP archives

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BazarBackdoor sneaks in through nested RAR and ZIP archives
14 July 2021

Investigating a Suspicious Service - MDSec

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Investigating a Suspicious Service - MDSec
14 July 2021

How we protect users from 0-day attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How we protect users from 0-day attacks
12 July 2021

Macintosh HD:Users:Shared:dd:4work:Bitdefender-PR-Whitepaper-DarkNexus-creat4349-en_EN:Bitdefender-PR-Whitepaper-DarkNexus-creat4349-en_EN.indd

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Macintosh HD:Users:Shared:dd:4work:Bitdefender-PR-Whitepaper-DarkNexus-creat4349-en_EN:Bitdefender-PR-Whitepaper-DarkNexus-creat4349-en_EN.indd
9 July 2021

Hancitor tries XLL as initial malware file - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hancitor tries XLL as initial malware file - SANS ISC
8 July 2021

Decoding Cobalt Strike: Understanding payloads

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Decoding Cobalt Strike: Understanding payloads
7 July 2021

https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/diving-deeper-into-the-kaseya-vsa-attack-revil-returns-and-other-hackers-are-riding-their-coattails/

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/diving-deeper-into-the-kaseya-vsa-attack-revil-returns-and-other-hackers-are-riding-their-coattails/
7 July 2021

BIOPASS RAT New Malware Sniffs Victims via Live Streaming

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BIOPASS RAT New Malware Sniffs Victims via Live Streaming
7 July 2021

Ryuk Ransomware Now Targeting Webservers

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Ryuk Ransomware Now Targeting Webservers
6 July 2021

Is Diavol Ransomware Connected to Wizard Spider-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Is Diavol Ransomware Connected to Wizard Spider-
5 July 2021

Tracking Cobalt Strike: A Trend Micro Vision One Investigation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tracking Cobalt Strike: A Trend Micro Vision One Investigation
2 July 2021

Dridex Document to Cobalt Strike – Malware Book Reports

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dridex Document to Cobalt Strike – Malware Book Reports
2 July 2021

The Brothers Grim

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Brothers Grim
2 July 2021

TrickBot: New attacks see the botnet deploy new banking module, new ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot: New attacks see the botnet deploy new banking module, new ransomware
2 July 2021

TrickBot- New attacks see the botnet deploy new banking module, new ransomware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor TrickBot- New attacks see the botnet deploy new banking module, new ransomware
1 July 2021

TrickBot and Zeus

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot and Zeus
1 July 2021

Backdoored client from Mongolian CA MonPass

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Backdoored client from Mongolian CA MonPass
1 July 2021

Diavol - A New Ransomware Used By Wizard Spider-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Diavol - A New Ransomware Used By Wizard Spider-
1 July 2021

Mongolian certificate authority hacked eight times, compromised with malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mongolian certificate authority hacked eight times, compromised with malware
1 July 2021

Diavol - A New Ransomware Used By Wizard Spider? | Fortinet

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Diavol - A New Ransomware Used By Wizard Spider? | Fortinet
1 July 2021

Most Prolific Ransomware Families for Defenders

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Most Prolific Ransomware Families for Defenders
30 June 2021

Shelob Moonlight – Spinning a Larger Web From IcedID to CONTI, a Trojan and Ransomware collaboration

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Shelob Moonlight – Spinning a Larger Web From IcedID to CONTI, a Trojan and Ransomware collaboration
29 June 2021

Cobalt Strike: Favorite APT Tool to Crimeware | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike: Favorite APT Tool to Crimeware | Proofpoint US
29 June 2021

What We Think | Business & Technology Insights

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What We Think | Business & Technology Insights
28 June 2021

Hancitor Continues to Push Cobalt Strike

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Hancitor Continues to Push Cobalt Strike
22 June 2021

Response When Minutes Matter- Falcon Complete Disrupts WIZARD SPIDER eCrime Operators

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Response When Minutes Matter- Falcon Complete Disrupts WIZARD SPIDER eCrime Operators
22 June 2021

Response When Minutes Matter: Falcon Complete Disrupts WIZARD SPIDER eCrime Operators

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Response When Minutes Matter: Falcon Complete Disrupts WIZARD SPIDER eCrime Operators
20 June 2021

From Word to Lateral Movement in 1 Hour

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor From Word to Lateral Movement in 1 Hour
18 June 2021

Conti Ransomware Gang: An Overview

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti Ransomware Gang: An Overview
17 June 2021

Analysis of Hancitor – When Boring Begets Beacon

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis of Hancitor – When Boring Begets Beacon
16 June 2021

Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise
16 June 2021

How Initial Access Brokers Lead to Ransomware | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How Initial Access Brokers Lead to Ransomware | Proofpoint US
16 June 2021

Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise
16 June 2021

Національна поліція України

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Національна поліція України
16 June 2021

Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise
15 June 2021

Detecting UEFI Bootkits in the Wild (Part 1)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detecting UEFI Bootkits in the Wild (Part 1)
15 June 2021

Ransomware Double Extortion and Beyond: REvil, Clop, and Conti

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware Double Extortion and Beyond: REvil, Clop, and Conti
7 June 2021

Inside the SystemBC Malware-As-A-Service

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Inside the SystemBC Malware-As-A-Service
4 June 2021

Latvian National Charged for Alleged Role in Transnational Cybercrime Organization

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Latvian National Charged for Alleged Role in Transnational Cybercrime Organization
4 June 2021

Fresh Phish: Colonial Pipeline Ransomware Hack Unleashes Flood of Related Phishing Attempts

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Fresh Phish: Colonial Pipeline Ransomware Hack Unleashes Flood of Related Phishing Attempts
4 June 2021

US arrests Latvian woman who worked on Trickbot malware source code

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor US arrests Latvian woman who worked on Trickbot malware source code
2 June 2021

China-Linked Threat Group Targets Taiwan Critical Infrastructure, Smokescreen Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-Linked Threat Group Targets Taiwan Critical Infrastructure, Smokescreen Ransomware
2 June 2021

How to Defend Against Conti, DarkSide, REvil and Other Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How to Defend Against Conti, DarkSide, REvil and Other Ransomware
1 June 2021

New sophisticated email-based attack from NOBELIUM | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New sophisticated email-based attack from NOBELIUM | Microsoft Security Blog
1 June 2021

Looks like the page you're looking for doesn't exist or has moved.

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Looks like the page you're looking for doesn't exist or has moved.
1 June 2021

NobleBaron | New Poisoned Installers Could Be Used In Supply Chain Attacks - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor NobleBaron | New Poisoned Installers Could Be Used In Supply Chain Attacks - SentinelLabs
1 June 2021

Justice Department Announces Court-Authorized Seizure of Domain Names Used in Furtherance of Spear-Phishing Campaign Posing as U.S. Agency for International Development

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Justice Department Announces Court-Authorized Seizure of Domain Names Used in Furtherance of Spear-Phishing Campaign Posing as U.S. Agency for International Development
28 May 2021

Sophisticated Spearphishing Campaign Targets Government Organizations, IGOs, and NGOs | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sophisticated Spearphishing Campaign Targets Government Organizations, IGOs, and NGOs | CISA
28 May 2021

MAR 10339794-1.v1 – Cobalt Strike Beacon | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MAR 10339794-1.v1 – Cobalt Strike Beacon | CISA
28 May 2021

Breaking down NOBELIUM’s latest early-stage toolset | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Breaking down NOBELIUM’s latest early-stage toolset | Microsoft Security Blog
27 May 2021

Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns

Malpedia library date Volexity fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns
26 May 2021

A Deep Dive into Packing Software CryptOne

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Deep Dive into Packing Software CryptOne
25 May 2021

Cobalt Strikes Again: An Analysis of Obfuscated Malware | Huntress

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strikes Again: An Analysis of Obfuscated Malware | Huntress
21 May 2021

Microsoft社のデジタル署名を悪用した「Cobalt Strike loader」による標的型攻撃〜攻撃者グループAPT41 | LAC WATCH

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft社のデジタル署名を悪用した「Cobalt Strike loader」による標的型攻撃〜攻撃者グループAPT41 | LAC WATCH
21 May 2021

Leveraging Microsoft Teams to cover up Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Leveraging Microsoft Teams to cover up Cobalt Strike
20 May 2021

Conti Ransomware Attacks Impact Healthcare and First Responder Networks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti Ransomware Attacks Impact Healthcare and First Responder Networks
19 May 2021

Enterprise Scale Threat Hunting: C2 Beacon Detection with Unsupervised ML and KQL — Part 2

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Enterprise Scale Threat Hunting: C2 Beacon Detection with Unsupervised ML and KQL — Part 2
19 May 2021

Look how many cybercriminals love Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Look how many cybercriminals love Cobalt Strike
19 May 2021

BazarCall Method: Call Centers Help Spread BazarLoader Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BazarCall Method: Call Centers Help Spread BazarLoader Malware
18 May 2021

Darkside gang estimated to have made over $90 million from ransomware attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Darkside gang estimated to have made over $90 million from ransomware attacks
18 May 2021

DarkSide ransomware made $90 million in just nine months

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DarkSide ransomware made $90 million in just nine months
17 May 2021

Case Study: Incident Response is a relationship-driven business

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Case Study: Incident Response is a relationship-driven business
16 May 2021

HSE Conti 40521 UPDATE

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor HSE Conti 40521 UPDATE
14 May 2021

From ZLoader to DarkSide: A Ransomware Story

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From ZLoader to DarkSide: A Ransomware Story
12 May 2021

Enterprise Scale Threat Hunting: C2 Beacon Detection with Unsupervised ML and KQL — Part 1

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Enterprise Scale Threat Hunting: C2 Beacon Detection with Unsupervised ML and KQL — Part 1
12 May 2021

Conti Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Conti Ransomware
11 May 2021

Campo, a New Attack Campaign Targeting Japan - Mal-Eats

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Campo, a New Attack Campaign Targeting Japan - Mal-Eats
11 May 2021

Shining a Light on DARKSIDE Ransomware Operations

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Shining a Light on DARKSIDE Ransomware Operations
10 May 2021

日本を狙う新たな攻撃キャンペーン Campo の全体像 - Mal-Eats

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 日本を狙う新たな攻撃キャンペーン Campo の全体像 - Mal-Eats
7 May 2021

What is ransomware?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What is ransomware?
7 May 2021

Stats from Hunting Cobalt Strike Beacons

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Stats from Hunting Cobalt Strike Beacons
7 May 2021

PowerPoint 簡報

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PowerPoint 簡報
7 May 2021

Lemon Duck spreads its wings: Actors target Microsoft Exchange servers, incorporate new TTPs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lemon Duck spreads its wings: Actors target Microsoft Exchange servers, incorporate new TTPs
6 May 2021

CTIR_casestudy_2.pdf

file creation date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor CTIR_casestudy_2.pdf
6 May 2021

Proxylogon: A Coinminer, a Ransomware, and a Botnet Join the Party

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Proxylogon: A Coinminer, a Ransomware, and a Botnet Join the Party
6 May 2021

CTIR_casestudy_1.pdf

file creation date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor CTIR_casestudy_1.pdf
6 May 2021

Intel 471

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Intel 471
5 May 2021

Notorious Cybercriminals Evil Corp Actually Russian Spies? - Trulysuper

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Notorious Cybercriminals Evil Corp Actually Russian Spies? - Trulysuper
4 May 2021

Improving network-based detection of in-the-wild Cobalt Strike C2 servers while reducing the risk…

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Improving network-based detection of in-the-wild Cobalt Strike C2 servers while reducing the risk…
2 May 2021

Trickbot Brief: Creds and Beacons

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Trickbot Brief: Creds and Beacons
29 April 2021

the-operations-of-winnti-group.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor the-operations-of-winnti-group.pdf
29 April 2021

UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat | Mandiant
29 April 2021

Combating Ransomware - A Comprehensive Framework for Action: Key Recommendations from the Ransomware Task Force

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Combating Ransomware - A Comprehensive Framework for Action: Key Recommendations from the Ransomware Task Force
27 April 2021

Locked, Loaded, and in the Wrong Hands: Legitimate Tools Weaponized for Ransomware in 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Locked, Loaded, and in the Wrong Hands: Legitimate Tools Weaponized for Ransomware in 2021
27 April 2021

Hello Ransomware Uses Updated China Chopper Web Shell, SharePoint Vulnerability

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hello Ransomware Uses Updated China Chopper Web Shell, SharePoint Vulnerability
26 April 2021

Ransomware Attack Vectors shift as New Software Vulnerability Exploits Abound

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware Attack Vectors shift as New Software Vulnerability Exploits Abound
26 April 2021

Anatomy of Cobalt Strike’s DLL Stager

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Anatomy of Cobalt Strike’s DLL Stager
25 April 2021

Ransomware and Data Leak Site Publication Time Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware and Data Leak Site Publication Time Analysis
20 April 2021

CobaltStrike Stager Utilizing Floating Point Math

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CobaltStrike Stager Utilizing Floating Point Math
19 April 2021

Analysing a malware PCAP with IcedID and Cobalt Strike traffic

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysing a malware PCAP with IcedID and Cobalt Strike traffic
15 April 2021

Security Brief: Threat Actors Pair Tax-Themed Lures With COVID-19, Healthcare Themes | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Security Brief: Threat Actors Pair Tax-Themed Lures With COVID-19, Healthcare Themes | Proofpoint US
14 April 2021

April 2021 Forensic Quiz: Answers and Analysis - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor April 2021 Forensic Quiz: Answers and Analysis - SANS ISC
13 April 2021

Contiランサムウェアの内部構造を紐解く | 技術者ブログ | 三井物産セキュアディレクション株式会社

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Contiランサムウェアの内部構造を紐解く | 技術者ブログ | 三井物産セキュアディレクション株式会社
12 April 2021

A Spike in BazarCall and IcedID Activity Detected in March

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Spike in BazarCall and IcedID Activity Detected in March
12 April 2021

A Different Kind of Zoombomb

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Different Kind of Zoombomb
7 April 2021

Ransom Mafia - Analysis of the World's First Ransomware Cartel

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Ransom Mafia - Analysis of the World's First Ransomware Cartel
7 April 2021

Using Kaitai Struct to Parse Cobalt Strike Beacon Configs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Using Kaitai Struct to Parse Cobalt Strike Beacon Configs
7 April 2021

RANSOM-MAFIA-ANALYSIS-OF-THE-WORLD%E2%80%99S-FIRST-RANSOMWARE-CARTEL.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RANSOM-MAFIA-ANALYSIS-OF-THE-WORLD%E2%80%99S-FIRST-RANSOMWARE-CARTEL.pdf
6 April 2021

EtterSilent: the underground’s new favorite maldoc builder

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor EtterSilent: the underground’s new favorite maldoc builder
5 April 2021

TrickBot Crews New CobaltStrike Loader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot Crews New CobaltStrike Loader
1 April 2021

Hancitor’s Use of Cobalt Strike and a Noisy Network Ping Tool

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hancitor’s Use of Cobalt Strike and a Noisy Network Ping Tool
1 April 2021

COVID-19 Phishing With a Side of Cobalt Strike - DomainTools | Start Here. Know Now.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor COVID-19 Phishing With a Side of Cobalt Strike - DomainTools | Start Here. Know Now.
31 March 2021

Financial Cyberthreats in 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Financial Cyberthreats in 2020
31 March 2021

2021-Threat-Detection-Report.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2021-Threat-Detection-Report.pdf
30 March 2021

Yet Another Cobalt Strike Stager: GUID Edition

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Yet Another Cobalt Strike Stager: GUID Edition
30 March 2021

Campo Loader - Simple but effective

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Campo Loader - Simple but effective
30 March 2021

2021-Threat-Detection-Report

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 2021-Threat-Detection-Report
29 March 2021

Sodinokibi (aka REvil) Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Sodinokibi (aka REvil) Ransomware
21 March 2021

report-bb-2021-threat-report.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor report-bb-2021-threat-report.pdf
18 March 2021

Cobalt Strike – Post-Exploitation Attackers Toolkit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike – Post-Exploitation Attackers Toolkit
18 March 2021

SilverFish_TLPWHITE.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SilverFish_TLPWHITE.pdf
17 March 2021

unit42-ransomware-threat-report-2021.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor unit42-ransomware-threat-report-2021.pdf
17 March 2021

TrickBot Malware | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot Malware | CISA
16 March 2021

Detecting Cobalt Strike with memory signatures

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detecting Cobalt Strike with memory signatures
16 March 2021

Technical Analysis of Operation Diànxùn

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Technical Analysis of Operation Diànxùn
12 March 2021

TrickBot Malware Fact Sheet

file creation date fromORKL

Archived copy on ORKL Detailsfor TrickBot Malware Fact Sheet
11 March 2021

Myanmar – Multi-stage malware attack targets elected lawmakers – Qurium Media Foundation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Myanmar – Multi-stage malware attack targets elected lawmakers – Qurium Media Foundation
11 March 2021

You Don't Know the HAFNIUM of it...

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor You Don't Know the HAFNIUM of it...
10 March 2021

NimzaLoader: TA800’s New Initial Access Malware | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor NimzaLoader: TA800’s New Initial Access Malware | Proofpoint US
9 March 2021

Cloud Federated Credential Abuse & Cobalt Strike: Threat Research February 2021 | Splunk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cloud Federated Credential Abuse & Cobalt Strike: Threat Research February 2021 | Splunk
8 March 2021

Bazar Drops the Anchor

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Bazar Drops the Anchor
4 March 2021

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research
1 March 2021

Nimar Loader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Nimar Loader
1 March 2021

Investigation into the state of Nim malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Investigation into the state of Nim malware
28 February 2021

Cyber Threats 2020: A Year in Retrospect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Threats 2020: A Year in Retrospect
27 February 2021

Nice to meet you too My name is Ryuk

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Nice to meet you too My name is Ryuk
27 February 2021

Nice to meet you, too. My name is Ryuk.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Nice to meet you, too. My name is Ryuk.
26 February 2021

New Ransomware Tactic: Adversaries Target ESXi Servers | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Ransomware Tactic: Adversaries Target ESXi Servers | CrowdStrike
25 February 2021

So Unchill: Melting UNC2198 ICEDID to Ransomware Operations | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor So Unchill: Melting UNC2198 ICEDID to Ransomware Operations | Mandiant
25 February 2021

CERTFR-2021-CTI-006.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERTFR-2021-CTI-006.pdf
24 February 2021

investigations/2021-02-24_vietnam at master · AmnestyTech/investigations

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor investigations/2021-02-24_vietnam at master · AmnestyTech/investigations
24 February 2021

c2fs_jsac2021_submit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor c2fs_jsac2021_submit
23 February 2021

Report2021GTR.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Report2021GTR.pdf
23 February 2021

The_CrowdStrike_2021_Global_Threat_Report

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The_CrowdStrike_2021_Global_Threat_Report
17 February 2021

Supply Chain Attacks: Cyber Criminals Target the Weakest Link (White Paper)

file creation date fromORKL

Archived copy on ORKL Detailsfor Supply Chain Attacks: Cyber Criminals Target the Weakest Link (White Paper)
16 February 2021

Q4 2020 Threat Report | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Q4 2020 Threat Report | Proofpoint US
12 February 2021

New Bazar Trojan Variant is Being Spread in Recent Phishing Campaign – Part I | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Bazar Trojan Variant is Being Spread in Recent Phishing Campaign – Part I | FortiGuard Labs
12 February 2021

New Bazar Trojan Variant is Being Spread in Recent Phishing Campaign – Part II | Fortinet

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Bazar Trojan Variant is Being Spread in Recent Phishing Campaign – Part II | Fortinet
11 February 2021

A Baza Valentine’s Day | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Baza Valentine’s Day | Proofpoint US
11 February 2021

CTI-League-Darknet-Report-2021.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CTI-League-Darknet-Report-2021.pdf
9 February 2021

Extracting the Cobalt Strike Config from a TEARDROP Loader | Securehat

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Extracting the Cobalt Strike Config from a TEARDROP Loader | Securehat
8 February 2021

ESET_Threat_Report_Q42020.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET_Threat_Report_Q42020.pdf
4 February 2021

Conti-Ransomware.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti-Ransomware.pdf
3 February 2021

Excel spreadsheets push SystemBC malware - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Excel spreadsheets push SystemBC malware - SANS ISC
2 February 2021

How Vietnam-based hacking operation OceanLotus targets journalists - Committee to Protect Journalists

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How Vietnam-based hacking operation OceanLotus targets journalists - Committee to Protect Journalists
1 February 2021

Relay Attacks via Cobalt Strike Beacons

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Relay Attacks via Cobalt Strike Beacons
1 February 2021

24/7 managed detection, response, and expert cybersecurity services - GoSecure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 24/7 managed detection, response, and expert cybersecurity services - GoSecure
1 February 2021

TrickBot masrv Module

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot masrv Module
1 February 2021

What tracking an attacker email infrastructure tells us about persistent cybercriminal operations | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What tracking an attacker email infrastructure tells us about persistent cybercriminal operations | Microsoft Security Blog
1 February 2021

BlueCrab 랜섬웨어, 기업 환경에서는 CobaltStrike 해킹툴 설치 - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BlueCrab 랜섬웨어, 기업 환경에서는 CobaltStrike 해킹툴 설치 - ASEC
31 January 2021

Bazar, No Ryuk?

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Bazar, No Ryuk?
28 January 2021

MSP_Security_Summit___John_Hammond_Huntress___Analyzing_Ryuk.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MSP_Security_Summit___John_Hammond_Huntress___Analyzing_Ryuk.pdf
28 January 2021

지속적으로 탐지 우회를 시도 중인 BlueCrab 랜섬웨어 - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 지속적으로 탐지 우회를 시도 중인 BlueCrab 랜섬웨어 - ASEC
28 January 2021

Tailoring Cobalt Strike on Target

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tailoring Cobalt Strike on Target
28 January 2021

BazarLoader’s Elaborate Flower Shop Lure

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor BazarLoader’s Elaborate Flower Shop Lure
23 January 2021

Yet Another Bazar Loader DGA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Yet Another Bazar Loader DGA
20 January 2021

Anchor and Lazarus together again?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Anchor and Lazarus together again?
20 January 2021

Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop
19 January 2021

Wireshark Tutorial: Examining Emotet Infection Traffic

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Wireshark Tutorial: Examining Emotet Infection Traffic
18 January 2021

Raindrop: New Malware Discovered in SolarWinds Investigation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Raindrop: New Malware Discovered in SolarWinds Investigation
15 January 2021

Detecting Malicious C2 Activity -SpawnAs & SMB Lateral Movement in CobaltStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detecting Malicious C2 Activity -SpawnAs & SMB Lateral Movement in CobaltStrike
14 January 2021

Higaisa or Winnti? APT41 backdoors, old and new

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Higaisa or Winnti? APT41 backdoors, old and new
12 January 2021

Cybereason vs. Conti Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cybereason vs. Conti Ransomware
11 January 2021

Trickbot Still Alive and Well

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Trickbot Still Alive and Well
11 January 2021

Trickbot Still Alive and Well

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Trickbot Still Alive and Well
10 January 2021

MAN1, Moskal, Hancitor and a side of Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MAN1, Moskal, Hancitor and a side of Ransomware
9 January 2021

Malware Development: Leveraging Beacon Object Files for Remote Process Injection via Thread Hijacking

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Development: Leveraging Beacon Object Files for Remote Process Injection via Thread Hijacking
7 January 2021

Adversary Infrustructure Report 2020 - A Defender's View

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Adversary Infrustructure Report 2020 - A Defender's View
6 January 2021

Hunting for GetSystem commands in offensive security tools

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hunting for GetSystem commands in offensive security tools
6 January 2021

Holiday Bazar: Tracking a TrickBot-Related Ransomware Incident - DomainTools | Start Here. Know Now.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Holiday Bazar: Tracking a TrickBot-Related Ransomware Incident - DomainTools | Start Here. Know Now.
5 January 2021

Earth Wendigo Injects JavaScript Backdoor for Mailbox Exfiltration

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Wendigo Injects JavaScript Backdoor for Mailbox Exfiltration
4 January 2021

Malleable C2 Profiles and You

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malleable C2 Profiles and You
4 January 2021

Building a Custom Malware Analysis Lab Environment - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Building a Custom Malware Analysis Lab Environment - SentinelLabs
26 December 2020

Spoofing JARM signatures. I am the Cobalt Strike server now!

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Spoofing JARM signatures. I am the Cobalt Strike server now!
23 December 2020

blog.truesec.com-Collaboration between FIN7 and the RYUK group a Truesec Investigation

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor blog.truesec.com-Collaboration between FIN7 and the RYUK group a Truesec Investigation
22 December 2020

Collaboration between FIN7 and the RYUK group, a Truesec Investigation

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Collaboration between FIN7 and the RYUK group, a Truesec Investigation
21 December 2020

Collaboration Between FIN7 and the RYUK Group

date in the CCS '25 data Truesec fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Collaboration Between FIN7 and the RYUK Group
21 December 2020

Russian cyber attack campaigns and actors

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Russian cyber attack campaigns and actors
21 December 2020

TrickBot: A Closer Look

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot: A Closer Look
21 December 2020

What We Have Learned So Far about the “Sunburst”/SolarWinds Hack | FortiGuard labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What We Have Learned So Far about the “Sunburst”/SolarWinds Hack | FortiGuard labs
17 December 2020

DebUNCing Attribution How Mandiant Tracks Uncategorized Threat Actors

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor DebUNCing Attribution How Mandiant Tracks Uncategorized Threat Actors
16 December 2020

Secure AI Build Resilience & Accelerate Value with Accenture

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure AI Build Resilience & Accelerate Value with Accenture
16 December 2020

Next Version of the Bazar Loader DGA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Next Version of the Bazar Loader DGA
15 December 2020

Conti Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti Ransomware
15 December 2020

Tactics, Techniques, and Procedures (TTPs) Used in the SolarWinds Breach

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tactics, Techniques, and Procedures (TTPs) Used in the SolarWinds Breach
14 December 2020

Threat Brief: SolarStorm and SUNBURST Customer Coverage

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Brief: SolarStorm and SUNBURST Customer Coverage
11 December 2020

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog
10 December 2020

Cyber Actors Target K-12 Distance Learning Education to Cause Disruptions and Steal Data | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Actors Target K-12 Distance Learning Education to Cause Disruptions and Steal Data | CISA
10 December 2020

Threat Brief: FireEye Red Team Tool Breach

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Brief: FireEye Red Team Tool Breach
10 December 2020

Cybereason vs. Ryuk Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cybereason vs. Ryuk Ransomware
10 December 2020

No pandas, just people: The current state of China’s cybercrime underground

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor No pandas, just people: The current state of China’s cybercrime underground
9 December 2020

Recent Qakbot (Qbot) activity - SANS Internet Storm Center

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Recent Qakbot (Qbot) activity - SANS Internet Storm Center
9 December 2020

Microsoft Word - eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations-wp.docx

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Word - eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations-wp.docx
9 December 2020

Quarterly Report: Incident Response trends from Fall 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Quarterly Report: Incident Response trends from Fall 2020
8 December 2020

Report2020CrowdStrikeServicesCyberFrontLines.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor Report2020CrowdStrikeServicesCyberFrontLines.pdf
3 December 2020

TrickBot Now Offers "TrickBoot": Persist, Brick, Profit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot Now Offers "TrickBoot": Persist, Brick, Profit
30 November 2020

Threat actor leverages coin miner techniques to stay under the radar – here’s how to spot them | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat actor leverages coin miner techniques to stay under the radar – here’s how to spot them | Microsoft Security Blog
30 November 2020

eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations.pdf
26 November 2020

Cybereason vs. Egregor Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cybereason vs. Egregor Ransomware
25 November 2020

Egregor RaaS Continues the Chaos with Cobalt Strike and Rclone - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Egregor RaaS Continues the Chaos with Cobalt Strike and Rclone - SentinelLabs
23 November 2020

Bitdefender Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bitdefender Labs
20 November 2020

LightBot: TrickBot’s new reconnaissance malware for high-value targets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor LightBot: TrickBot’s new reconnaissance malware for high-value targets
20 November 2020

The malware that usually installs ransomware and you need to remove right away

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The malware that usually installs ransomware and you need to remove right away
19 November 2020

APT Exploits Microsoft Zerologon Bug: Targets Japanese Companies

Malpedia library date Threatpost fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT Exploits Microsoft Zerologon Bug: Targets Japanese Companies
18 November 2020

Analyzing Network Infrastructure as Composite Objects - DomainTools | Start Here. Know Now.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing Network Infrastructure as Composite Objects - DomainTools | Start Here. Know Now.
18 November 2020

Analyzing Network Infrastructure as Composite Objects

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Analyzing Network Infrastructure as Composite Objects
18 November 2020

Zooming into Darknet Threats Targeting Japanese Organizations

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Zooming into Darknet Threats Targeting Japanese Organizations
17 November 2020

Easily Identify Malicious Servers on the Internet with JARM - Salesforce Engineering Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Easily Identify Malicious Servers on the Internet with JARM - Salesforce Engineering Blog
15 November 2020

From virus alert to PowerShell Encrypted Loader – Trustnet

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From virus alert to PowerShell Encrypted Loader – Trustnet
14 November 2020

Deep Dive Into Ryuk Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Deep Dive Into Ryuk Ransomware
12 November 2020

Splunking with Sysmon Part 4: Detecting Trickbot

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Splunking with Sysmon Part 4: Detecting Trickbot
9 November 2020

Phishing campaign threatens job security, drops Bazar and Buer Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Phishing campaign threatens job security, drops Bazar and Buer Malware
9 November 2020

Fake Microsoft Teams updates lead to Cobalt Strike deployment

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Fake Microsoft Teams updates lead to Cobalt Strike deployment
6 November 2020

When Threat Actors Fly Under the Radar: Vatet, PyXie and Defray777

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor When Threat Actors Fly Under the Radar: Vatet, PyXie and Defray777
6 November 2020

OceanLotus: Extending Cyber Espionage Operations Through Fake Websites

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OceanLotus: Extending Cyber Espionage Operations Through Fake Websites
5 November 2020

Ryuk Speed Run, 2 Hours to Ransom

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Ryuk Speed Run, 2 Hours to Ransom
5 November 2020

Ryuk Speed Run, 2 Hours to Ransom

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Ryuk Speed Run, 2 Hours to Ransom
5 November 2020

SCYTHE Library: #ThreatThursday - Ryuk

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor SCYTHE Library: #ThreatThursday - Ryuk
4 November 2020

Trick or Threat: Ryuk Ransomware Targets Health Care Industry

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trick or Threat: Ryuk Ransomware Targets Health Care Industry
3 November 2020

APT trends report Q3 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q3 2020
3 November 2020

Attackers Exploiting WebLogic Servers via CVE-2020-14882 to install Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attackers Exploiting WebLogic Servers via CVE-2020-14882 to install Cobalt Strike
30 October 2020

UNC 1878 Indicators from Threatconnect

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor UNC 1878 Indicators from Threatconnect
30 October 2020

research-team/IOCs/WizardSpider-UNC1878-Ryuk.csv at master · ThreatConnect-Inc/research-team

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor research-team/IOCs/WizardSpider-UNC1878-Ryuk.csv at master · ThreatConnect-Inc/research-team
29 October 2020

A Bazar start: How one hospital thwarted a Ryuk ransomware outbreak

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Bazar start: How one hospital thwarted a Ryuk ransomware outbreak
29 October 2020

A Bazar start- How one hospital thwarted a Ryuk ransomware outbreak

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor A Bazar start- How one hospital thwarted a Ryuk ransomware outbreak
29 October 2020

Threat Assessment: Ryuk Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Assessment: Ryuk Ransomware
29 October 2020

Hacking group is targeting US hospitals with Ryuk ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hacking group is targeting US hospitals with Ryuk ransomware
29 October 2020

Building wave of ransomware attacks strike U.S. hospitals

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Building wave of ransomware attacks strike U.S. hospitals
29 October 2020

Hacking group is targeting US hospitals with Ryuk ransomware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Hacking group is targeting US hospitals with Ryuk ransomware
29 October 2020

Several hospitals targeted in new wave of ransomware attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Several hospitals targeted in new wave of ransomware attacks
28 October 2020

FBI, DHS, HHS Warn of Imminent, Credible Ransomware Threat Against U.S. Hospitals

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor FBI, DHS, HHS Warn of Imminent, Credible Ransomware Threat Against U.S. Hospitals
28 October 2020

Unhappy Hour Special- KEGTAP and SINGLEMALT With a Ransomware Chaser

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Unhappy Hour Special- KEGTAP and SINGLEMALT With a Ransomware Chaser
28 October 2020

Joint Cybersecurity Advisory - AA20-302A - Ransomware Activity Targeting the Healthcare and Public Health Sector

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Joint Cybersecurity Advisory - AA20-302A - Ransomware Activity Targeting the Healthcare and Public Health Sector
28 October 2020

FBI, DHS, HHS Warn of Imminent, Credible Ransomware Threat Against U.S. Hospitals

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor FBI, DHS, HHS Warn of Imminent, Credible Ransomware Threat Against U.S. Hospitals
28 October 2020

Unhappy Hour Special: KEGTAP and SINGLEMALT With a Ransomware Chaser | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unhappy Hour Special: KEGTAP and SINGLEMALT With a Ransomware Chaser | Mandiant
28 October 2020

UNC1878 Indicators

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor UNC1878 Indicators
28 October 2020

UNC1878 indicators

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor UNC1878 indicators
27 October 2020

Steelcase furniture giant hit by Ryuk ransomware attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Steelcase furniture giant hit by Ryuk ransomware attack
26 October 2020

Dropping the Anchor | NETSCOUT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dropping the Anchor | NETSCOUT
26 October 2020

ThreatConnect Research Roundup: Possible Ryuk Infrastructure | ThreatConnect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ThreatConnect Research Roundup: Possible Ryuk Infrastructure | ThreatConnect
26 October 2020

Exploit Developer Spotlight: The Story of PlayBit - Check Point Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Exploit Developer Spotlight: The Story of PlayBit - Check Point Research
22 October 2020

French IT giant Sopra Steria hit by Ryuk ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor French IT giant Sopra Steria hit by Ryuk ransomware
22 October 2020

An Inside Look at How Ryuk Evolved Its Encryption and Evasion Techniques - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor An Inside Look at How Ryuk Evolved Its Encryption and Evasion Techniques - SentinelLabs
20 October 2020

Die Lage der IT-Sicherheit in Deutschland 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Die Lage der IT-Sicherheit in Deutschland 2020
20 October 2020

An update on disruption of Trickbot - Microsoft On the Issues

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor An update on disruption of Trickbot - Microsoft On the Issues
18 October 2020

Ryuk in 5 Hours

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Ryuk in 5 Hours
16 October 2020

Wizard Spider Modifies and Expands Toolset [Adversary Update]

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Wizard Spider Modifies and Expands Toolset [Adversary Update]
16 October 2020

ThreatConnect Research Roundup: Possible Ryuk Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ThreatConnect Research Roundup: Possible Ryuk Infrastructure
16 October 2020

WIZARD SPIDER Update- Resilient, Reactive and Resolute

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor WIZARD SPIDER Update- Resilient, Reactive and Resolute
15 October 2020

Officials Announce International Operation Targeting Transnational Criminal Organization QQAAZZ that Provided Money Laundering Services to High-Level Cybercriminals

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Officials Announce International Operation Targeting Transnational Criminal Organization QQAAZZ that Provided Money Laundering Services to High-Level Cybercriminals
13 October 2020

Tracing fresh Ryuk campaigns itw

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Tracing fresh Ryuk campaigns itw
12 October 2020

New action to combat ransomware ahead of U.S. elections - Microsoft On the Issues

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New action to combat ransomware ahead of U.S. elections - Microsoft On the Issues
12 October 2020

2020-10-06%20Trickbot%201%20Complaint%20with%20exs.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2020-10-06%20Trickbot%201%20Complaint%20with%20exs.pdf
12 October 2020

Trickbot: U.S. Court Order Hits Botnet’s Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trickbot: U.S. Court Order Hits Botnet’s Infrastructure
12 October 2020

ESET takes part in global operation to disrupt Trickbot

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET takes part in global operation to disrupt Trickbot
12 October 2020

Trickbot disrupted

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trickbot disrupted
11 October 2020

CyberThreatIntel/China/APT/Chimera/Analysis.md at master · StrangerealIntel/CyberThreatIntel

Malpedia library date Github (StrangerealIntel) fromORKLCCS '25 data

Archived copy on ORKL Detailsfor CyberThreatIntel/China/APT/Chimera/Analysis.md at master · StrangerealIntel/CyberThreatIntel
8 October 2020

Droppers, Downloaders and TrickBot: Detecting a Stealthy COVID-19-themed Campaign using Toolmarks | HP Wolf Security

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Droppers, Downloaders and TrickBot: Detecting a Stealthy COVID-19-themed Campaign using Toolmarks | HP Wolf Security
8 October 2020

Ryuk's Return

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Ryuk's Return
8 October 2020

Lined up in the sights of Vietnamese hackers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lined up in the sights of Vietnamese hackers
6 October 2020

Ransomware + Data Leak Extortion: Origins and Adversaries, Pt. 2

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware + Data Leak Extortion: Origins and Adversaries, Pt. 2
6 October 2020

Double Trouble- Ransomware with Data Leak Extortion, Part 2

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Double Trouble- Ransomware with Data Leak Extortion, Part 2
2 October 2020

Attacks Aimed at Disrupting the Trickbot Botnet

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attacks Aimed at Disrupting the Trickbot Botnet
2 October 2020

bazarloader.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor bazarloader.pdf
1 October 2020

Potential for China Cyber Response to Heightened U.S.–China Tensions | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Potential for China Cyber Response to Heightened U.S.–China Tensions | CISA
29 September 2020

What's behind the increase in ransomware attacks this year?

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor What's behind the increase in ransomware attacks this year?
29 September 2020

Getting the Bacon from Cobalt Strike's Beacon | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Getting the Bacon from Cobalt Strike's Beacon | CrowdStrike
29 September 2020

GitHub - Apr4h/CobaltStrikeScan: Scan files or process memory for CobaltStrike beacons and parse their configuration

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GitHub - Apr4h/CobaltStrikeScan: Scan files or process memory for CobaltStrike beacons and parse their configuration
29 September 2020

Spear Phishing Campaign Delivers Buer & Bazar | Zscaler Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Spear Phishing Campaign Delivers Buer & Bazar | Zscaler Blog
24 September 2020

KASPERSKY_H1_2020_ICS_REPORT_EN.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor KASPERSKY_H1_2020_ICS_REPORT_EN.pdf
24 September 2020

Federal Agency Compromised by Malicious Cyber Actor | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Federal Agency Compromised by Malicious Cyber Actor | CISA
22 September 2020

Detecting Threats in Real-time With Active C2 Information

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detecting Threats in Real-time With Active C2 Information
22 September 2020

What Service NSW has to do with Russia?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What Service NSW has to do with Russia?
18 September 2020

U.S. Justice Department Charges APT41 Hackers over Global Cyberattacks

Malpedia library date Trend Micro fromORKLCCS '25 data

Archived copy on ORKL Detailsfor U.S. Justice Department Charges APT41 Hackers over Global Cyberattacks
1 September 2020

Quarterly Report: Incident Response trends in Summer 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Quarterly Report: Incident Response trends in Summer 2020
31 August 2020

NetWalker Ransomware in 1 Hour

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor NetWalker Ransomware in 1 Hour
31 August 2020

Trickbot rdpscanDll – Transforming Candidate Credentials for Brute-Forcing RDP Servers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trickbot rdpscanDll – Transforming Candidate Credentials for Brute-Forcing RDP Servers
25 August 2020

Ryuk successor Conti Ransomware releases data leak site

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ryuk successor Conti Ransomware releases data leak site
20 August 2020

CERTFR-2020-CTI-009.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERTFR-2020-CTI-009.pdf
19 August 2020

調查局 08/19 公布中國對台灣政府機關駭侵事件說明

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 調查局 08/19 公布中國對台灣政府機關駭侵事件說明
9 August 2020

Banking Trojans: A Reference Guide to the Malware Family Tree

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Banking Trojans: A Reference Guide to the Malware Family Tree
7 August 2020

wp-spark-state-of-ransomware.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor wp-spark-state-of-ransomware.pdf
4 August 2020

us-20-Chen-Operation-Chimera-APT-Operation-Targets-Semiconductor-Vendors.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor us-20-Chen-Operation-Chimera-APT-Operation-Targets-Semiconductor-Vendors.pdf
29 July 2020

ESET_Threat_Report_Q22020.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET_Threat_Report_Q22020.pdf
29 July 2020

APT trends report Q2 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q2 2020
26 July 2020

In-Memory shellcode decoding to evade AVs/EDRs

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor In-Memory shellcode decoding to evade AVs/EDRs
22 July 2020

Enter the Maze: Demystifying an Affiliate Involved in Maze (SNOW) - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Enter the Maze: Demystifying an Affiliate Involved in Maze (SNOW) - SentinelLabs
20 July 2020

Emotet-TrickBot malware duo is back infecting Windows machines

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet-TrickBot malware duo is back infecting Windows machines
16 July 2020

A%20Bazar%20of%20Tricks%20Following%20Team9%E2%80%99s%20Development%20Cycles%20IOCs.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor A%20Bazar%20of%20Tricks%20Following%20Team9%E2%80%99s%20Development%20Cycles%20IOCs.pdf
16 July 2020

A Bazar of Tricks: Following Team9’s Development Cycles

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Bazar of Tricks: Following Team9’s Development Cycles
15 July 2020

The Defective Domain Generation Algorithm of BazarLoader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Defective Domain Generation Algorithm of BazarLoader
14 July 2020

The Domain Generation Algorithm of BazarLoader - A DGA based on the Emercoin TLD .bazar

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Domain Generation Algorithm of BazarLoader - A DGA based on the Emercoin TLD .bazar
13 July 2020

SCANdalous! (External Detection Using Network Scan Data and Automation)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor SCANdalous! (External Detection Using Network Scan Data and Automation)
13 July 2020

Deep Malware and Phishing Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Deep Malware and Phishing Analysis
13 July 2020

SCANdalous! (External Detection Using Network Scan Data and Automation) | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SCANdalous! (External Detection Using Network Scan Data and Automation) | Mandiant
11 July 2020

TrickBot malware mistakenly warns victims that they are infected

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot malware mistakenly warns victims that they are infected
7 July 2020

Cobalt Strike stagers used by FIN6 :: MWLab — Ladislav's Malware Lab

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike stagers used by FIN6 :: MWLab — Ladislav's Malware Lab
1 July 2020

Accenture | Let there be change

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Accenture | Let there be change
23 June 2020

Ryuk ransomware deployed two weeks after Trickbot infection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ryuk ransomware deployed two weeks after Trickbot infection
23 June 2020

Sodinokibi: Ransomware Attackers also Scanning for PoS Software, Leveraging Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sodinokibi: Ransomware Attackers also Scanning for PoS Software, Leveraging Cobalt Strike
23 June 2020

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research
22 June 2020

IndigoDrop spreads via military-themed lures to deliver Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor IndigoDrop spreads via military-themed lures to deliver Cobalt Strike
22 June 2020

Inside a TrickBot Cobalt Strike Attack Server - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Inside a TrickBot Cobalt Strike Attack Server - SentinelLabs
22 June 2020

CERTFR-2020-CTI-006.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERTFR-2020-CTI-006.pdf
19 June 2020

Targeted Attack Leverages India-China Border Dispute

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Targeted Attack Leverages India-China Border Dispute
17 June 2020

ATT&CK® Deep Dive: Process Injection - Red Canary

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ATT&CK® Deep Dive: Process Injection - Red Canary
15 June 2020

Global Malicious Spam Campaign Using Black Lives Matter as a Lure | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Global Malicious Spam Campaign Using Black Lives Matter as a Lure | FortiGuard Labs
15 June 2020

Quarterly report: Incident Response trends in Summer 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Quarterly report: Incident Response trends in Summer 2020
15 June 2020

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research
2 June 2020

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research
2 June 2020

In-depth analysis of the new Team9 malware family

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor In-depth analysis of the new Team9 malware family
1 June 2020

Russian Cyber Attack Campaigns and Actors - Threat Research

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Russian Cyber Attack Campaigns and Actors - Threat Research
28 May 2020

How Ransomware Adversaries Reacted to the DarkSide Attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How Ransomware Adversaries Reacted to the DarkSide Attack
28 May 2020

DarkSide Pipeline Attack Shakes Up the Ransomware-as-a-Service Landscape

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor DarkSide Pipeline Attack Shakes Up the Ransomware-as-a-Service Landscape
28 May 2020

Goodbye Mworm, Hello Nworm: TrickBot Updates Propagation Module

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Goodbye Mworm, Hello Nworm: TrickBot Updates Propagation Module
14 May 2020

Deep Dive Into TrickBot Executor Module "mexec": Reversing the Dropper Variant - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Deep Dive Into TrickBot Executor Module "mexec": Reversing the Dropper Variant - SentinelLabs
14 May 2020

The energy reserves in the Eastern Mediterranean Sea and a malicious campaign of APT10 against Turkey

Malpedia library date Lab52 fromORKLCCS '25 data

Archived copy on ORKL Detailsfor The energy reserves in the Eastern Mediterranean Sea and a malicious campaign of APT10 against Turkey
11 May 2020

The Anatomy of an APT Attack and CobaltStrike Beacon’s Encoded Configuration - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Anatomy of an APT Attack and CobaltStrike Beacon’s Encoded Configuration - SentinelLabs
5 May 2020

Deep Analysis of Ryuk Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Deep Analysis of Ryuk Ransomware
27 April 2020

Group Behind TrickBot Spreads Fileless BazarBackdoor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Group Behind TrickBot Spreads Fileless BazarBackdoor
24 April 2020

BazarBackdoor: TrickBot gang’s new stealthy network-hacking malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BazarBackdoor: TrickBot gang’s new stealthy network-hacking malware
24 April 2020

Ursnif via LOLbins

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Ursnif via LOLbins
19 April 2020

Reversing Ryuk: A Technical Analysis of Ryuk Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Reversing Ryuk: A Technical Analysis of Ryuk Ransomware
14 April 2020

Blog: Stay Ahead of Cyber Threats

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Blog: Stay Ahead of Cyber Threats
14 April 2020

Deobfuscating and hunting for OSTAP, Trickbot’s dropper and best friend

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Deobfuscating and hunting for OSTAP, Trickbot’s dropper and best friend
9 April 2020

TrickBot Emerges with a Few New Tricks | blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot Emerges with a Few New Tricks | blog
8 April 2020

Deep Dive Into TrickBot Executor Module "mexec": Hidden "Anchor" Bot Nexus Operations - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Deep Dive Into TrickBot Executor Module "mexec": Hidden "Anchor" Bot Nexus Operations - SentinelLabs
2 April 2020

Catching APT41 exploiting a zero-day vulnerability

date in the CCS '25 data Darktrace fromCCS '25 data

The original link failed its last check. Detailsfor Catching APT41 exploiting a zero-day vulnerability
1 April 2020

Navigating Cybersecurity During a Pandemic: Latest Malware and Threat Actors - Cisco Umbrella

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Navigating Cybersecurity During a Pandemic: Latest Malware and Threat Actors - Cisco Umbrella
31 March 2020

Trickbot: A primer

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trickbot: A primer
31 March 2020

It's Your Money and They Want It Now — The Cycle of Adversary Pursuit | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor It's Your Money and They Want It Now — The Cycle of Adversary Pursuit | Mandiant
31 March 2020

It’s Your Money and They Want It Now - The Cycle of Adversary Pursuit

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor It’s Your Money and They Want It Now - The Cycle of Adversary Pursuit
30 March 2020

Fantastic payloads and where we find them

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Fantastic payloads and where we find them
25 March 2020

APT41 Initiates Intrusion Campaign Using Multiple Exploits

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT41 Initiates Intrusion Campaign Using Multiple Exploits
25 March 2020

Trickbot to Ryuk in Two Hours

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trickbot to Ryuk in Two Hours
22 March 2020

Mustang Panda joins the COVID-19 bandwagon

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mustang Panda joins the COVID-19 bandwagon
20 March 2020

Analysis Of Exploitation: CVE-2020-10189

Malpedia library date RECON InfoSec fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Analysis Of Exploitation: CVE-2020-10189
18 March 2020

Macintosh HD:Users:Shared:dd:4work:Bitdefender-PR-Whitepaper-TrickBot-creat4305-en_EN:Bitdefender-PR-Whitepaper-TrickBot-creat4305-en_EN.indd

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Macintosh HD:Users:Shared:dd:4work:Bitdefender-PR-Whitepaper-TrickBot-creat4305-en_EN:Bitdefender-PR-Whitepaper-TrickBot-creat4305-en_EN.indd
16 March 2020

Ransomware Deployment Trends | They Come in the Night

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware Deployment Trends | They Come in the Night
16 March 2020

They Come in the Night- Ransomware Deployment Trends

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor They Come in the Night- Ransomware Deployment Trends
9 March 2020

New Variant of TrickBot Being Spread by Word Document | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Variant of TrickBot Being Spread by Word Document | FortiGuard Labs
5 March 2020

Human-operated ransomware attacks: A preventable disaster | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Human-operated ransomware attacks: A preventable disaster | Microsoft Security Blog
4 March 2020

Ryuk Ransomware Attacked Epiq Global Via TrickBot Infection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ryuk Ransomware Attacked Epiq Global Via TrickBot Infection
4 March 2020

Report2020CrowdStrikeGlobalThreatReport

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Report2020CrowdStrikeGlobalThreatReport
3 March 2020

Cyber Threats 2019: A Year in Retrospect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Threats 2019: A Year in Retrospect
2 March 2020

Was Emotet anrichtet – und welche Lehren die Opfer daraus ziehen

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Was Emotet anrichtet – und welche Lehren die Opfer daraus ziehen
28 February 2020

Trickbot Delivery Method Gets a New Upgrade Focusing on Windows 10

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trickbot Delivery Method Gets a New Upgrade Focusing on Windows 10
26 February 2020

Revealing the Trick | A Deep Dive into TrickLoader Obfuscation - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Revealing the Trick | A Deep Dive into TrickLoader Obfuscation - SentinelLabs
18 February 2020

Operation DRBControl: Uncovering a Cyberespionage Campaign Targeting Gambling Companies in Southeast Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation DRBControl: Uncovering a Cyberespionage Campaign Targeting Gambling Companies in Southeast Asia
18 February 2020

Building a bypass with MSBuild

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Building a bypass with MSBuild
13 February 2020

A Deep Dive Into Wakeup On Lan (WoL) Implementation of Ryuk - Home

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Deep Dive Into Wakeup On Lan (WoL) Implementation of Ryuk - Home
10 February 2020

2020_State-of-Malware-Report.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor 2020_State-of-Malware-Report.pdf
30 January 2020

TrickBot Uses a New Windows 10 UAC Bypass to Launch Quietly

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot Uses a New Windows 10 UAC Bypass to Launch Quietly
30 January 2020

Trickbot Trojan Leveraging a New Windows 10 UAC Bypass

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trickbot Trojan Leveraging a New Windows 10 UAC Bypass
29 January 2020

DOD contractor suffers ransomware infection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DOD contractor suffers ransomware infection
29 January 2020

CERTFR-2020-CTI-001.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERTFR-2020-CTI-001.pdf
29 January 2020

Malware Tries to Trump Security Software With POTUS Impeachment

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Tries to Trump Security Software With POTUS Impeachment
27 January 2020

Forensics Report True Hedge

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Forensics Report True Hedge
24 January 2020

RL Blog | ReversingLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RL Blog | ReversingLabs
24 January 2020

Hunting for Ransomware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Hunting for Ransomware
24 January 2020

New Ryuk Info Stealer Targets Government and Military Secrets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Ryuk Info Stealer Targets Government and Military Secrets
23 January 2020

TrickBot Now Steals Windows Active Directory Credentials

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot Now Steals Windows Active Directory Credentials
17 January 2020

JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf

Malpedia library date SecureWorks fromORKLCCS '25 data

Archived copy on ORKL Detailsfor JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf
17 January 2020

Battle Against Ursnif Malspam Campaign targeting Japan

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Battle Against Ursnif Malspam Campaign targeting Japan
16 January 2020

TrickBot Now Uses a Windows 10 UAC Bypass to Evade Detection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot Now Uses a Windows 10 UAC Bypass to Evade Detection
14 January 2020

Ryuk Ransomware Uses Wake-on-Lan To Encrypt Offline Devices

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ryuk Ransomware Uses Wake-on-Lan To Encrypt Offline Devices
10 January 2020

CSIS_Threat_Matrix_H1_2019.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CSIS_Threat_Matrix_H1_2019.pdf
9 January 2020

Top-Tier Russian Organized Cybercrime Group Unveils Fileless Stealthy “PowerTrick” Backdoor for High-Value Targets - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Top-Tier Russian Organized Cybercrime Group Unveils Fileless Stealthy “PowerTrick” Backdoor for High-Value Targets - SentinelLabs
26 December 2019

Ryuk Ransomware Stops Encrypting Linux Folders

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ryuk Ransomware Stops Encrypting Linux Folders
21 December 2019

How ransomware exploded in the age of Bitcoin

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How ransomware exploded in the age of Bitcoin
19 December 2019

Threat spotlight: the curious case of Ryuk ransomware | Malwarebytes Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat spotlight: the curious case of Ryuk ransomware | Malwarebytes Labs
19 December 2019

Threat spotlight- the curious case of Ryuk ransomware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Threat spotlight- the curious case of Ryuk ransomware
15 December 2019

Ryuk Ransomware Likely Behind New Orleans Cyberattack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ryuk Ransomware Likely Behind New Orleans Cyberattack
12 December 2019

[CB19] Cyber Threat Landscape in Japan – Revealing Threat in the Shadow by Chi En Shen (Ashley) Oleg Bondarenko

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor [CB19] Cyber Threat Landscape in Japan – Revealing Threat in the Shadow by Chi En Shen (Ashley) Oleg Bondarenko
11 December 2019

Dropping Anchor: From a TrickBot Infection to the Discovery of the Anchor Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dropping Anchor: From a TrickBot Infection to the Discovery of the Anchor Malware
11 December 2019

Story of the year 2019: Cities under ransomware siege

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Story of the year 2019: Cities under ransomware siege
10 December 2019

Anchor Project | The Deadly Planeswalker: How The TrickBot Group United High-Tech Crimeware & APT - SentinelLabs

Malpedia library date SentinelOne fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Anchor Project | The Deadly Planeswalker: How The TrickBot Group United High-Tech Crimeware & APT - SentinelLabs
9 December 2019

TrickBot Campaign Uses Fake Payroll Emails to Conduct Phishing Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot Campaign Uses Fake Payroll Emails to Conduct Phishing Attacks
9 December 2019

Caution! Ryuk Ransomware decryptor damages larger files, even if you pay

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Caution! Ryuk Ransomware decryptor damages larger files, even if you pay
29 November 2019

Aarhus_miniseminar_291118.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Aarhus_miniseminar_291118.pdf
22 November 2019

Trickbot Updates Password Grabber Module

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trickbot Updates Password Grabber Module
13 November 2019

2_40pm - Through The Eyes of the Adversary

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2_40pm - Through The Eyes of the Adversary
8 November 2019

Wireshark Tutorial: Examining Trickbot Infections

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Wireshark Tutorial: Examining Trickbot Infections
6 November 2019

Emotet, Trickbot, Ryuk – ein explosiver Malware-Cocktail

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet, Trickbot, Ryuk – ein explosiver Malware-Cocktail
5 November 2019

Hospital cyberattack could have been avoided

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hospital cyberattack could have been avoided
5 November 2019

CobaltStrike - beacon.dll : Your No Ordinary MZ Header

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CobaltStrike - beacon.dll : Your No Ordinary MZ Header
1 November 2019

WIZARD SPIDER Adds New Features to Ryuk | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor WIZARD SPIDER Adds New Features to Ryuk | CrowdStrike
1 November 2019

WIZARD SPIDER Adds New Features to Ryuk for Targeting Hosts on LAN

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor WIZARD SPIDER Adds New Features to Ryuk for Targeting Hosts on LAN
29 October 2019

TRICKBOT Analysis - Part II

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TRICKBOT Analysis - Part II
24 October 2019

How TrickBot Malware Hooking Engine Targets Windows 10 Browsers - SentinelLabs

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor How TrickBot Malware Hooking Engine Targets Windows 10 Browsers - SentinelLabs
3 October 2019

PowerPoint Presentation

file creation date fromORKL

Archived copy on ORKL Detailsfor PowerPoint Presentation
25 September 2019

Information on GovCERT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Information on GovCERT
22 September 2019

Rancor: The Year of The Phish

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rancor: The Year of The Phish
3 September 2019

Deobfuscating Ostap- TrickBot’s 34,000 Line JavaScript Downloader

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Deobfuscating Ostap- TrickBot’s 34,000 Line JavaScript Downloader
3 September 2019

Deobfuscating Ostap: TrickBot’s 34,000 Line JavaScript Downloader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Deobfuscating Ostap: TrickBot’s 34,000 Line JavaScript Downloader
27 August 2019

TrickBot Modifications Target U.S. Mobile Users

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor TrickBot Modifications Target U.S. Mobile Users
26 August 2019

Advanced Network Detection & Response - MetaDefender NDR - OPSWAT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Advanced Network Detection & Response - MetaDefender NDR - OPSWAT
5 August 2019

Trickbot Delivered via Highly Obfuscated JS File

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Trickbot Delivered via Highly Obfuscated JS File
12 July 2019

TrickBooster – TrickBot’s Email-Based Infection Module

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBooster – TrickBot’s Email-Based Infection Module
24 June 2019

Threat Group Cards: A Threat Actor Encyclopedia

file creation date ThaiCERT fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Threat Group Cards: A Threat Actor Encyclopedia
13 June 2019

Hunting and detecting Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hunting and detecting Cobalt Strike
13 June 2019

Hunting and detecting Cobalt Strike

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Hunting and detecting Cobalt Strike
12 June 2019

Threat Group Cards: A Threat Actor Encyclopedia

file creation date Martijn van der Heide fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia
4 June 2019

Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vitali Kremez

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vitali Kremez
4 June 2019

An APT Blueprint Gaining New Visibility into Financial Threats

date in the CCS '25 data Bitdefender fromCCS '25 data

Detailsfor An APT Blueprint Gaining New Visibility into Financial Threats
22 May 2019

TRICKBOT ANALYSIS

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TRICKBOT ANALYSIS
9 May 2019

Information on GovCERT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Information on GovCERT
8 May 2019

2019-data-breach-investigations-report.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2019-data-breach-investigations-report.pdf
2 May 2019

Detricking TrickBot Loader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detricking TrickBot Loader
24 April 2019

Sea Lotus APT organization's attack techniques against China in the first quarter of 2019 revealed

date in the CCS '25 data Weixin fromCCS '25 data

The original link failed its last check. Detailsfor Sea Lotus APT organization's attack techniques against China in the first quarter of 2019 revealed
15 April 2019

Cobalt Strike. Walkthrough for Red Teamers | Pen Test Partners

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike. Walkthrough for Red Teamers | Pen Test Partners
5 April 2019

Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware
5 April 2019

Trickbot — a concise treatise

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trickbot — a concise treatise
2 April 2019

Triple Threat: Emotet Deploys TrickBot to Steal Data & Spread Ryuk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Triple Threat: Emotet Deploys TrickBot to Steal Data & Spread Ryuk
1 April 2019

mpressioncss_ta_report_2019.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor mpressioncss_ta_report_2019.pdf
26 March 2019

CERTFR-2019-ACT-005.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERTFR-2019-ACT-005.pdf
24 March 2019

An OceanLotus (APT32) Backdoor – One Night in Norfolk

Malpedia library date One Night in Norfolk fromORKLCCS '25 data

Archived copy on ORKL Detailsfor An OceanLotus (APT32) Backdoor – One Night in Norfolk
21 March 2019

Interception- Dissecting BokBot’s “Man in the Browser”

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Interception- Dissecting BokBot’s “Man in the Browser”
21 March 2019

Dissecting BokBot’s “Man in the Browser” | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dissecting BokBot’s “Man in the Browser” | CrowdStrike
20 March 2019

New Evidence Proves Ongoing WIZARD SPIDER - LUNAR SPIDER Collaboration

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New Evidence Proves Ongoing WIZARD SPIDER - LUNAR SPIDER Collaboration
20 March 2019

New Evidence Proves Ongoing WIZARD/LUNAR SPIDER Collaboration

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Evidence Proves Ongoing WIZARD/LUNAR SPIDER Collaboration
13 March 2019

Report2019GlobalThreatReport

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Report2019GlobalThreatReport
6 March 2019

PINCHY SPIDER Affiliates Adopt “Big Game Hunting” Tactics to Distribute GandCrab Ransomware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor PINCHY SPIDER Affiliates Adopt “Big Game Hunting” Tactics to Distribute GandCrab Ransomware
6 March 2019

PINCHY SPIDER Adopts “Big Game Hunting” to Distribute GandCrab

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PINCHY SPIDER Adopts “Big Game Hunting” to Distribute GandCrab
5 March 2019

Quick Analysis of a Trickbot Sample with NSA's Ghidra SRE Framework

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Quick Analysis of a Trickbot Sample with NSA's Ghidra SRE Framework
27 February 2019

New Global Cyber Attack on Point of Sale Systems

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Global Cyber Attack on Point of Sale Systems
26 February 2019

Identifying Cobalt Strike team servers in the wild

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Identifying Cobalt Strike team servers in the wild
20 February 2019

CrowdStrike_GTR_2019.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor CrowdStrike_GTR_2019.pdf
18 February 2019

CrowdStrike_GTR_2019_.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor CrowdStrike_GTR_2019_.pdf
15 February 2019

“Sin”-ful SPIDERS- WIZARD SPIDER and LUNAR SPIDER Sharing the Same Web

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor “Sin”-ful SPIDERS- WIZARD SPIDER and LUNAR SPIDER Sharing the Same Web
15 February 2019

"Sin”-ful SPIDERS: WIZARD SPIDER and LUNAR SPIDER Sharing the Same Web

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor "Sin”-ful SPIDERS: WIZARD SPIDER and LUNAR SPIDER Sharing the Same Web
12 February 2019

Trickbot Adds Credential-Grabbing Capabilities

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Trickbot Adds Credential-Grabbing Capabilities
11 January 2019

A Nasty Trick- From Credential Theft Malware to Business Disruption

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor A Nasty Trick- From Credential Theft Malware to Business Disruption
11 January 2019

TrickBot Malware Infection Leads to Ryuk Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot Malware Infection Leads to Ryuk Ransomware
10 January 2019

What is Ryuk Ransomware? The Complete Breakdown

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What is Ryuk Ransomware? The Complete Breakdown
10 January 2019

Big Game Hunting with Ryuk- Another Lucrative Targeted Ransomware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Big Game Hunting with Ryuk- Another Lucrative Targeted Ransomware
29 December 2018

Malware attack disrupts delivery of L.A. Times and Tribune papers across the U.S. - Los Angeles Times

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware attack disrupts delivery of L.A. Times and Tribune papers across the U.S. - Los Angeles Times
12 December 2018

The TrickBot and MikroTik Connection – A Story of Investment and Collaboration

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The TrickBot and MikroTik Connection – A Story of Investment and Collaboration
19 November 2018

Not So Cozy: An Uncomfortable Examination of a Suspected APT29 Phishing Campaign | Mandiant

Malpedia library date FireEye fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Not So Cozy: An Uncomfortable Examination of a Suspected APT29 Phishing Campaign | Mandiant
18 November 2018

CozyBear – In from the Cold?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CozyBear – In from the Cold?
14 November 2018

Big Game Hunting- The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Big Game Hunting- The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware
14 November 2018

Big Game Hunting: The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Big Game Hunting: The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware
12 November 2018

What's new in TrickBot? Deobfuscating elements | Malwarebytes Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What's new in TrickBot? Deobfuscating elements | Malwarebytes Labs
8 November 2018

Deep Analysis of TrickBot New Module pwgrab

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Deep Analysis of TrickBot New Module pwgrab
1 November 2018

Trickbot Shows Off New Trick: Password Grabber Module

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Trickbot Shows Off New Trick: Password Grabber Module
25 October 2018

Cutwail Spam Campaign Uses Steganography to Distribute URLZone

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cutwail Spam Campaign Uses Steganography to Distribute URLZone
25 October 2018

Cutwail Spam Campaign Uses Steganography to Distribute URLZone

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Cutwail Spam Campaign Uses Steganography to Distribute URLZone
1 October 2018

CDS2018-Technical-S5-ATT&CKing FIN7_The Value of Using Frameworks for Threat Intelligence-FINAL_clean

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor CDS2018-Technical-S5-ATT&CKing FIN7_The Value of Using Frameworks for Threat Intelligence-FINAL_clean
20 August 2018

Ryuk Ransomware: A Targeted Campaign Break-Down

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ryuk Ransomware: A Targeted Campaign Break-Down
3 August 2018

Volatility Plugin for Detecting Cobalt Strike Beacon - JPCERT/CC Eyes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Volatility Plugin for Detecting Cobalt Strike Beacon - JPCERT/CC Eyes
3 July 2018

Smoking Guns - Smoke Loader learned new tricks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Smoking Guns - Smoke Loader learned new tricks
21 May 2018

APT攻撃者グループ menuPass(APT10) による新たな攻撃を確認 | LAC WATCH

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT攻撃者グループ menuPass(APT10) による新たな攻撃を確認 | LAC WATCH
3 May 2018

Burning Umbrella: An Intelligence Report on the Winnti Umbrella and Associated State-Sponsored Attackers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Burning Umbrella: An Intelligence Report on the Winnti Umbrella and Associated State-Sponsored Attackers
16 April 2018

TrickBot & UACME

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot & UACME
27 March 2018

Evolving Trickbot Adds Detection Evasion and Screen-Locking Features

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Evolving Trickbot Adds Detection Evasion and Screen-Locking Features
21 March 2018

TrickBot Banking Trojan Adapts with New Module | Webroot

Malpedia library date Webroot fromORKLCCS '25 data

Archived copy on ORKL Detailsfor TrickBot Banking Trojan Adapts with New Module | Webroot
1 March 2018

Report2018GlobalThreatReport.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor Report2018GlobalThreatReport.pdf
1 February 2018

Malware-Traffic-Analysis.net - 2018-02-01 - Quick test-drive of Trickbot (it now has a Monero module)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware-Traffic-Analysis.net - 2018-02-01 - Quick test-drive of Trickbot (it now has a Monero module)
29 January 2018

Weekly TrickBot Analysis - End of w/c 22-Jan-2018 to 1000119

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Weekly TrickBot Analysis - End of w/c 22-Jan-2018 to 1000119
22 November 2017

Flashpoint Weekly Vulnerability Insights and Prioritization Report

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Flashpoint Weekly Vulnerability Insights and Prioritization Report
1 August 2017

TrickBot comes up with new tricks: attacking Outlook and browsing data | Malwarebytes Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot comes up with new tricks: attacking Outlook and browsing data | Malwarebytes Labs
1 July 2017

TrickBot Banking Trojan - DOC00039217.doc

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot Banking Trojan - DOC00039217.doc
15 June 2017

Trickbot Expands Global Targets Beyond Banks and Payment Processors to CRMs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trickbot Expands Global Targets Beyond Banks and Payment Processors to CRMs
12 June 2017

Informe_Evoluci%C3%B3n_Trickbot.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Informe_Evoluci%C3%B3n_Trickbot.pdf
6 June 2017

Privileges and Credentials: Phished at the Request of Counsel | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Privileges and Credentials: Phished at the Request of Counsel | Mandiant
6 June 2017

Privileges and Credentials: Phished at the Request of Counsel | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Privileges and Credentials: Phished at the Request of Counsel | Mandiant
4 May 2017

Behind The Mystery Of Russia's 'Dyre' Hackers Who Stole Millions From American Business

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Behind The Mystery Of Russia's 'Dyre' Hackers Who Stole Millions From American Business
7 December 2016

2016-LT09-TrickBot-Adams.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2016-LT09-TrickBot-Adams.pdf
6 December 2016

Deep Analysis of the Online Banking Botnet TrickBot

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Deep Analysis of the Online Banking Botnet TrickBot
7 November 2016

Little Trickbot Growing Up: New Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Little Trickbot Growing Up: New Campaign
25 October 2016

TrickBot Banker Insights | NETSCOUT

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor TrickBot Banker Insights | NETSCOUT
24 October 2016

Introducing TrickBot, Dyreza's successor | Malwarebytes Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Introducing TrickBot, Dyreza's successor | Malwarebytes Labs
4 November 2015

A Technical Look At Dyreza | Malwarebytes Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Technical Look At Dyreza | Malwarebytes Labs

Newest first. Details opens the report in Explore.

Names and who uses them

Wizard Spider from AT ET
Periwinkle Tempest from AT MI ET MA Microsoft
DEV-0193 from AT MI ET MA Microsoft
UNC1878 from AT MI ET MA
TEMP.MixMaster from AT MI ET MA
FIN12 from AT MI ET MA
Pistachio Tempest from AT MI MA Microsoft
DEV-0237 from AT MI MA Microsoft
Storm-0230 from MI ET MA Microsoft
GOLD BLACKBURN from AT MI MA
WIZARD SPIDER from MI MA Microsoft
Grim Spider from AT ET
ITG23 from AT ET
GRIM SPIDER from MI MA

Show all 21 names Show fewer

GOLD ULRICK from MI MA
Storm-0193 from MI MA
Trickbot LLC from MI MA
UNC2053 from MI MA
Gold Blackburn from ET
Gold Ulrick from ET
Conti Team 1 from Microsoft

AT ATT&CK
MI MISP
ET ETDA
MA Malpedia

Origin and Motivation

Origin: Russia fromMISP ETDA Malpedia Microsoft
Motivation: Financial crime fromETDA
Financial gain fromETDA

Claimed targets (actor-level, per source)

Sources give these for the actor as a whole, not for a report or campaign.

Countries: United States fromETDA
Australia fromETDA
Canada fromETDA
Colombia fromETDA
France fromETDA
Indonesia fromETDA
Ireland fromETDA
Philippines fromETDA
South Korea fromETDA
Spain fromETDA
United Arab Emirates fromETDA
United Kingdom fromETDA
Sectors: Defense fromETDA
Financial fromETDA
Government fromETDA
Healthcare fromETDA
Telecommunications fromETDA
Education fromETDA
Manufacturing fromETDA
Technology fromETDA

Malware and Tools

AdFind fromATT&CK
Anchor fromATT&CK Malpedia
BITSAdmin fromATT&CK
Bazar fromATT&CK
BloodHound fromATT&CK
Cobalt Strike fromATT&CK Malpedia
Conti fromATT&CK Malpedia
Diavol fromATT&CK
Dyre fromATT&CK Malpedia
Emotet fromATT&CK
Empire fromATT&CK
GrimAgent fromATT&CK

Show all 24 malware and tools Show fewer

LaZagne fromATT&CK
Mimikatz fromATT&CK
Net fromATT&CK
Nltest fromATT&CK
Ping fromATT&CK
PsExec fromATT&CK
Rubeus fromATT&CK
Ryuk fromATT&CK Malpedia
SystemBC fromATT&CK
TrickBot fromATT&CK Malpedia
BazarBackdoor fromMalpedia
GRIMAGENT fromMalpedia