HAFNIUM

Log4Shell attacks expand to nation-state groups from China, Iran, North Korea, and Turkey

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Log4Shell attacks expand to nation-state groups from China, Iran, North Korea, and Turkey

Alleged Chinese hacker tied to Silk Typhoon arrested for cyberespionage

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Alleged Chinese hacker tied to Silk Typhoon arrested for cyberespionage

APT annual review 2021

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor APT annual review 2021

UNC6201 Exploiting a Dell RecoverPoint for Virtual Machines Zero-Day

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UNC6201 Exploiting a Dell RecoverPoint for Virtual Machines Zero-Day

Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors

CERTFR-2025-CTI-009.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERTFR-2025-CTI-009.pdf

Weaver Ant, the Web Shell Whisperer: Tracking a Live China-nexus Operation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Weaver Ant, the Web Shell Whisperer: Tracking a Live China-nexus Operation

Silk Typhoon targeting IT supply chain | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Silk Typhoon targeting IT supply chain | Microsoft Security Blog

Operation Diplomatic Specter: An Active Chinese Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Diplomatic Specter: An Active Chinese Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia

Wirtschaftsspionage gegen Volkwagen: VW-Konzern wurde jahrelang ausge…

Malpedia library date fromORKL

The title opens archive.today, not the publisher’s page. Archived copy on ORKL Detailsfor Wirtschaftsspionage gegen Volkwagen: VW-Konzern wurde jahrelang ausge…

Modern Asia APT groups TTPs

file creation date Kaspersky fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Modern Asia APT groups TTPs

BunnyLoader | ThreatLabz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BunnyLoader | ThreatLabz

Through the Cortex XDR Lens: Uncovering a New Activity Group Targeting Governments in the Middle East and Africa - Palo Alto Networks Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Through the Cortex XDR Lens: Uncovering a New Activity Group Targeting Governments in the Middle East and Africa - Palo Alto Networks Blog

Malware development trick - part 28: Dump lsass.exe. Simple C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development trick - part 28: Dump lsass.exe. Simple C++ example.

Dalbit (m00nlight): Chinese Hacker Group's APT Attack Campaign - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dalbit (m00nlight): Chinese Hacker Group's APT Attack Campaign - ASEC

APT41 — The spy who failed to encrypt me

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT41 — The spy who failed to encrypt me

Conceptualizing a Continuum of Cyber Threat Attribution

date ORKL added it fromORKL

The original link failed its last check. Original publisher Detailsfor Conceptualizing a Continuum of Cyber Threat Attribution

Top CVEs Actively Exploited By People's Republic of China State-Sponsored Cyber Actors

file creation date CISA, NSA, FBI fromORKL

Archived copy on ORKL Detailsfor Top CVEs Actively Exploited By People's Republic of China State-Sponsored Cyber Actors

DeftTorero: tactics, techniques and procedures of intrusions revealed

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DeftTorero: tactics, techniques and procedures of intrusions revealed

Witchetty: Group Uses Updated Toolset in Attacks on Governments in Middle East

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Witchetty: Group Uses Updated Toolset in Attacks on Governments in Middle East

Malicious IIS extensions quietly open persistent backdoors into servers | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malicious IIS extensions quietly open persistent backdoors into servers | Microsoft Security Blog

Attacks on industrial control systems using ShadowPad | Kaspersky ICS CERT EN

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attacks on industrial control systems using ShadowPad | Kaspersky ICS CERT EN

Attacks on industrial control systems using ShadowPad _ Kaspersky ICS CERT

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Attacks on industrial control systems using ShadowPad _ Kaspersky ICS CERT

Attacks on industrial control systems using ShadowPad

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Attacks on industrial control systems using ShadowPad

Backdoor via XFF – Mysterious Threat Actor Under Radar

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Backdoor via XFF – Mysterious Threat Actor Under Radar

yir-cyber-threats-annex-download.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor yir-cyber-threats-annex-download.pdf

Tarrask malware uses scheduled tasks for defense evasion

date in the CCS '25 data microsoft fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Tarrask malware uses scheduled tasks for defense evasion

Tarrask malware uses scheduled tasks for defense evasion | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tarrask malware uses scheduled tasks for defense evasion | Microsoft Security Blog

Tarrask malware uses scheduled tasks for defense evasion

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Tarrask malware uses scheduled tasks for defense evasion

Ransomware Threat Report 2022

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Ransomware Threat Report 2022

Adam Kozy Testimony

Malpedia library date Adam Kozy fromORKL

Archived copy on ORKL Detailsfor Adam Kozy Testimony

The APT Fallout of Vulnerabilities such as ProxyLogon, OGNL Injection, and log4shell

date in the title HVS Consulting fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The APT Fallout of Vulnerabilities such as ProxyLogon, OGNL Injection, and log4shell

What We Can Do against the Chaotic A41APT Campaign（公開版）

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What We Can Do against the Chaotic A41APT Campaign（公開版）

Full Spectrum Detections for 5 Popular Web Shells: Alfa, SharPyShell, Krypton, ASPXSpy, and TWOFACE

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Full Spectrum Detections for 5 Popular Web Shells: Alfa, SharPyShell, Krypton, ASPXSpy, and TWOFACE

Guidance for preventing, detecting, and hunting for exploitation of the Log4j 2 vulnerability | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Guidance for preventing, detecting, and hunting for exploitation of the Log4j 2 vulnerability | Microsoft Security Blog

Guidance for preventing, detecting, and hunting for exploitation of the Log4j 2 vulnerability

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Guidance for preventing, detecting, and hunting for exploitation of the Log4j 2 vulnerability

Microsoft Exchange vulnerabilities exploited once again for ransomware, this time with Babuk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Exchange vulnerabilities exploited once again for ransomware, this time with Babuk

Russian cyberattacks pose greater risk to governments and other insights from our annual report

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Russian cyberattacks pose greater risk to governments and other insights from our annual report

Microsoft Digital Defense Report OCTOBER 2021

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Microsoft Digital Defense Report OCTOBER 2021

China's Microsoft Hack May Have Had A Bigger Purpose Than Just Spying

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor China's Microsoft Hack May Have Had A Bigger Purpose Than Just Spying

DeadRinger_ Exposing Chinese Threat Actors Targeting Major Telcos

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor DeadRinger_ Exposing Chinese Threat Actors Targeting Major Telcos

DeadRinger- Exposing Chinese Threat Actors Targeting Major Telcos

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor DeadRinger- Exposing Chinese Threat Actors Targeting Major Telcos

DeadRinger: Exposing Chinese Threat Actors Targeting Major Telcos

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DeadRinger: Exposing Chinese Threat Actors Targeting Major Telcos

UK and allies hold Chinese state responsible for a pervasive pattern of hacking

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UK and allies hold Chinese state responsible for a pervasive pattern of hacking

UK and allies hold Chinese state responsible for a pervasive pattern of hacking

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor UK and allies hold Chinese state responsible for a pervasive pattern of hacking

BackdoorDiplomacy: Upgrading from Quarian to Turian

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BackdoorDiplomacy: Upgrading from Quarian to Turian

eset_threat_report_t12021.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eset_threat_report_t12021.pdf

eset_threat_report_t12021

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor eset_threat_report_t12021

Lemon Duck spreads its wings: Actors target Microsoft Exchange servers, incorporate new TTPs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lemon Duck spreads its wings: Actors target Microsoft Exchange servers, incorporate new TTPs

Proxylogon: A Coinminer, a Ransomware, and a Botnet Join the Party

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Proxylogon: A Coinminer, a Ransomware, and a Botnet Join the Party

Multi-Factor Authentication: Headache for Cyber Actors Inspires New Attack Techniques

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Multi-Factor Authentication: Headache for Cyber Actors Inspires New Attack Techniques

APT_trends_report_Q1_2021_Securelist

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT_trends_report_Q1_2021_Securelist

APT trends report Q1 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q1 2021

APT trends report Q1 2021

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT trends report Q1 2021

Hello Ransomware Uses Updated China Chopper Web Shell, SharePoint Vulnerability

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hello Ransomware Uses Updated China Chopper Web Shell, SharePoint Vulnerability

Could the Microsoft Exchange breach be stopped-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Could the Microsoft Exchange breach be stopped-

Microsoft Exchange Breach in Jan. 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Exchange Breach in Jan. 2021

Actor Exploits Microsoft Exchange Server Vulnerabilities, Cortex XDR Blocks Harvesting of Credentials

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Actor Exploits Microsoft Exchange Server Vulnerabilities, Cortex XDR Blocks Harvesting of Credentials

The Unseen One- Hades Ransomware Gang or Hafnium

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Unseen One- Hades Ransomware Gang or Hafnium

Imperva Observes Hive of Activity Following Hafnium Microsoft Exchange Disclosures

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Imperva Observes Hive of Activity Following Hafnium Microsoft Exchange Disclosures

Imperva Observes Hive of Activity Following Hafnium Microsoft Exchange Disclosures

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Imperva Observes Hive of Activity Following Hafnium Microsoft Exchange Disclosures

Web Shell Threat Hunting with Azure Sentinel

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Web Shell Threat Hunting with Azure Sentinel

Web Shell Threat Hunting with Azure Sentinel

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Web Shell Threat Hunting with Azure Sentinel

Analyzing attacks taking advantage of the Exchange Server vulnerabilities

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing attacks taking advantage of the Exchange Server vulnerabilities

CVE-2021-26855- Microsoft Exchange Server-Side Request Forgery

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor CVE-2021-26855- Microsoft Exchange Server-Side Request Forgery

HAFNIUM, China Chopper and ASP.NET Runtime

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor HAFNIUM, China Chopper and ASP.NET Runtime

https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/hafnium-china-chopper-and-aspnet-runtime/

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/hafnium-china-chopper-and-aspnet-runtime/

How China’s Devastating Microsoft Hack Puts Us All at Risk

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor How China’s Devastating Microsoft Hack Puts Us All at Risk

Detection and Investigation Using Devo- HAFNIUM 0-day Exploits on Microsoft Exchange Service

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Detection and Investigation Using Devo- HAFNIUM 0-day Exploits on Microsoft Exchange Service

Microsoft Exchange Server Attack Timeline

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Microsoft Exchange Server Attack Timeline

Exploits on Organizations Worldwide Tripled after Microsoft’s Revelation of Four Zero-days

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Exploits on Organizations Worldwide Tripled after Microsoft’s Revelation of Four Zero-days

You Don't Know the HAFNIUM of it...

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor You Don't Know the HAFNIUM of it...

Microsoft Exchange Server Attack Timeline

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Exchange Server Attack Timeline

Update - Detection and Response for HAFNIUM Activity

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Update - Detection and Response for HAFNIUM Activity

You Don't Know the HAFNIUM of it...

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor You Don't Know the HAFNIUM of it...

Norway parliament data stolen in Microsoft Exchange attack

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Norway parliament data stolen in Microsoft Exchange attack

Tactics, Techniques, and Procedures (TTPs) Used by HAFNIUM to Target Microsoft Exchange Servers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tactics, Techniques, and Procedures (TTPs) Used by HAFNIUM to Target Microsoft Exchange Servers

Examining Exchange Exploitation and its Lessons for Defenders

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Examining Exchange Exploitation and its Lessons for Defenders

Lessons from Exchange Exploitation for Defenders

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lessons from Exchange Exploitation for Defenders

Tactics, Techniques, and Procedures (TTPs) Used by HAFNIUM to Target Microsoft Exchange Servers

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Tactics, Techniques, and Procedures (TTPs) Used by HAFNIUM to Target Microsoft Exchange Servers

Exchange servers under siege from at least 10 APT groups

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Exchange servers under siege from at least 10 APT groups

Exchange servers under siege from at least 10 APT groups

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Exchange servers under siege from at least 10 APT groups

Microsoft Exchange server exploitation- how to detect, mitigate, and stay calm

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Microsoft Exchange server exploitation- how to detect, mitigate, and stay calm

Remediation Steps for the Microsoft Exchange Server Vulnerabilities

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Remediation Steps for the Microsoft Exchange Server Vulnerabilities

Reproducing the Microsoft Exchange Proxylogon Exploit Chain

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Reproducing the Microsoft Exchange Proxylogon Exploit Chain

Microsoft Exchange attacks: how to detect, mitigate, and stay calm

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Exchange attacks: how to detect, mitigate, and stay calm

Microsoft Exchange attacks cause panic as criminals go shell collecting

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Microsoft Exchange attacks cause panic as criminals go shell collecting

Hafnium – Active Exploitation of Microsoft Exchange and Lateral Movement

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Hafnium – Active Exploitation of Microsoft Exchange and Lateral Movement

Hafnium Update- Continued Microsoft Exchange Server Exploitation

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Hafnium Update- Continued Microsoft Exchange Server Exploitation

Reproducing the Microsoft Exchange Proxylogon Exploit Chain

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Reproducing the Microsoft Exchange Proxylogon Exploit Chain

Analyzing Attacks Against Microsoft Exchange Server With China Chopper Webshells

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing Attacks Against Microsoft Exchange Server With China Chopper Webshells

How Symantec Stops Microsoft Exchange Server Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How Symantec Stops Microsoft Exchange Server Attacks

How Symantec Stops Microsoft Exchange Server Attacks

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor How Symantec Stops Microsoft Exchange Server Attacks

Analyzing Attacks Against Microsoft Exchange Server With China Chopper Webshells

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Analyzing Attacks Against Microsoft Exchange Server With China Chopper Webshells

Security scripts

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Security scripts

Microsoft Exchange Zero Days - Mitigations and Detections

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Microsoft Exchange Zero Days - Mitigations and Detections

Scan for HAFNIUM Exploitation Evidence with THOR Lite

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Scan for HAFNIUM Exploitation Evidence with THOR Lite

CSS-Exchange/Security at main · microsoft/CSS-Exchange

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CSS-Exchange/Security at main · microsoft/CSS-Exchange

Scan for HAFNIUM Exploitation Evidence with THOR Lite

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Scan for HAFNIUM Exploitation Evidence with THOR Lite

Hafnium Exchange Vuln Detection - KQL

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Hafnium Exchange Vuln Detection - KQL

GitHub - cert-lv/exchange_webshell_detection: Detect webshells dropped on Microsoft Exchange servers exploited through "proxylogon" group of vulnerabilites (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GitHub - cert-lv/exchange_webshell_detection: Detect webshells dropped on Microsoft Exchange servers exploited through "proxylogon" group of vulnerabilites (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065)

Chinese Hacking Spree Hit an ‘Astronomical’ Number of Victims

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Chinese Hacking Spree Hit an ‘Astronomical’ Number of Victims

HAFNIUM- Advice about the new nation-state attack

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor HAFNIUM- Advice about the new nation-state attack

Detection and Response to Exploitation of Microsoft Exchange Zero-Day Vulnerabilities | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detection and Response to Exploitation of Microsoft Exchange Zero-Day Vulnerabilities | Mandiant

Detection and Response for HAFNIUM Activity

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Detection and Response for HAFNIUM Activity

https://www.huntress.com/hubfs/Videos/Webinars/Overlay-Mass_Exploitation_of_Exchange.mp4

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor https://www.huntress.com/hubfs/Videos/Webinars/Overlay-Mass_Exploitation_of_Exchange.mp4

Detection and Response to Exploitation of Microsoft Exchange Zero-Day Vulnerabilities

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Detection and Response to Exploitation of Microsoft Exchange Zero-Day Vulnerabilities

Detection and Response for HAFNIUM Activity - Elastic Security - Discuss the Elastic Stack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detection and Response for HAFNIUM Activity - Elastic Security - Discuss the Elastic Stack

Detecting HAFNIUM Exchange Server Zero-Day Activity in Splunk

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Detecting HAFNIUM Exchange Server Zero-Day Activity in Splunk

Rapid Response: Mass Exploitation of On-Prem Exchange Servers | Huntress

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rapid Response: Mass Exploitation of On-Prem Exchange Servers | Huntress

Detecting HAFNIUM Exchange Server Zero-Day Activity in Splunk | Splunk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detecting HAFNIUM Exchange Server Zero-Day Activity in Splunk | Splunk

HAFNIUM

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor HAFNIUM

Operation Exchange Marauder- Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Operation Exchange Marauder- Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities

New nation-state cyberattacks (HAFNIUM)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New nation-state cyberattacks (HAFNIUM)

HAFNIUM targeting Exchange Servers with 0-day exploits

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor HAFNIUM targeting Exchange Servers with 0-day exploits

HAFNIUM targeting Exchange Servers with 0-day exploits | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor HAFNIUM targeting Exchange Servers with 0-day exploits | Microsoft Security Blog

On-Premises Exchange Server Vulnerabilities Resource Center - updated March 25, 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor On-Premises Exchange Server Vulnerabilities Resource Center - updated March 25, 2021

Operation Exchange Marauder_ Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities _ Volexity

date in the CCS '25 data Volexity fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation Exchange Marauder_ Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities _ Volexity

Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities

New nation-state cyberattacks

date in the CCS '25 data Microsoft fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor New nation-state cyberattacks

Multiple Security Updates Released for Exchange Server – updated March 8, 2021

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Multiple Security Updates Released for Exchange Server – updated March 8, 2021

HAFNIUM targeting Exchange Servers with 0-day exploits - Microsoft Security

date in the CCS '25 data Microsoft fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor HAFNIUM targeting Exchange Servers with 0-day exploits - Microsoft Security

Chopper ASPX Web Shell Used in Targeted Attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chopper ASPX Web Shell Used in Targeted Attack

China cyber attacks- the current threat landscape

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor China cyber attacks- the current threat landscape

Investigation with a twist: an accidental APT attack and averted data destruction

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Investigation with a twist: an accidental APT attack and averted data destruction

Potential for China Cyber Response to Heightened U.S.–China Tensions | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Potential for China Cyber Response to Heightened U.S.–China Tensions | CISA

MAR-10297887-1.v2 – Iranian Web Shells | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MAR-10297887-1.v2 – Iranian Web Shells | CISA

Iran-Based Threat Actor Exploits VPN Vulnerabilities | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Iran-Based Threat Actor Exploits VPN Vulnerabilities | CISA

Two Chinese Hackers Working with the Ministry of State Security Charged with Global Computer Intrusion Campaign Targeting Intellectual Property and Confidential Business Information, Including COVID-19 Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Two Chinese Hackers Working with the Ministry of State Security Charged with Global Computer Intrusion Campaign Targeting Intellectual Property and Confidential Business Information, Including COVID-19 Research

GALLIUM: Targeting global telecom

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GALLIUM: Targeting global telecom

China Chopper still active 9 years later

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China Chopper still active 9 years later

GAME OVER: Detecting and Stopping an APT41 Operation | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GAME OVER: Detecting and Stopping an APT41 Operation | Mandiant

Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers

Emissary Panda Attacks Middle East Government SharePoint Servers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emissary Panda Attacks Middle East Government SharePoint Servers

Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries | Mandiant

An End to “Smash-and-Grab” and a Move to More Targeted Approaches

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor An End to “Smash-and-Grab” and a Move to More Targeted Approaches

Microsoft Defender for Cloud Apps Archives | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Defender for Cloud Apps Archives | Microsoft Security Blog

Breaking Down the China Chopper Web Shell - Part I | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Breaking Down the China Chopper Web Shell - Part I | Mandiant

China Chopper Webshell - the 4KB that Owns your Web Server

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China Chopper Webshell - the 4KB that Owns your Web Server