Tonto Team

Hunt.io Insights: Gamaredon’s Flux-Like Infrastructure and a Look at Recent ShadowPad Activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hunt.io Insights: Gamaredon’s Flux-Like Infrastructure and a Look at Recent ShadowPad Activity

Operation FishMedley targeting governments, NGOs, and think tanks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation FishMedley targeting governments, NGOs, and think tanks

Updated Shadowpad Malware Leads to Ransomware Deployment

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Updated Shadowpad Malware Leads to Ransomware Deployment

Meet NailaoLocker: a ransomware distributed in Europe by ShadowPad and PlugX backdoors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Meet NailaoLocker: a ransomware distributed in Europe by ShadowPad and PlugX backdoors

Updated Shadowpad Malware Leads to Ransomware Deployment

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Updated Shadowpad Malware Leads to Ransomware Deployment

ScatterBrain: Unmasking the Shadow of PoisonPlug's Obfuscator

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ScatterBrain: Unmasking the Shadow of PoisonPlug's Obfuscator

JSAC2025_1_5_leon-chang_theo-chen_en.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor JSAC2025_1_5_leon-chang_theo-chen_en.pdf

APT41 likely compromised Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT41 likely compromised Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike

Malware Transmutation! - Unveiling the Hidden Traces of BloodAlchemy

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Transmutation! - Unveiling the Hidden Traces of BloodAlchemy

Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks

Anxun and Chinese APT Activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Anxun and Chinese APT Activity

Inside The Lab - HarfangLab

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Inside The Lab - HarfangLab

Tracking ShadowPad Infrastructure Via Non-Standard Certificates

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tracking ShadowPad Infrastructure Via Non-Standard Certificates

2023 Adversary Infrastructure Report

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023 Adversary Infrastructure Report

Modern Asia APT groups TTPs

file creation date Kaspersky fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Modern Asia APT groups TTPs

Possible supply chain attack targeting South Asian government delivers Shadowpad

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Possible supply chain attack targeting South Asian government delivers Shadowpad

Slides-Possible-supply-chain-attack-targeting-South-Asian-government-delivers-Shadowpad.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Slides-Possible-supply-chain-attack-targeting-South-Asian-government-delivers-Shadowpad.pdf

Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda

Multi-year Chinese APT Campaign Targets South Korean Academic, Government, and Political Entities

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Multi-year Chinese APT Campaign Targets South Korean Academic, Government, and Political Entities

Redfly: Espionage Actors Continue to Target Critical Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Redfly: Espionage Actors Continue to Target Critical Infrastructure

RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale

Possible Supply Chain Attack Targeting Pakistani Government Delivers Shadowpad

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Possible Supply Chain Attack Targeting Pakistani Government Delivers Shadowpad

Lancefly: Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lancefly: Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors

“PortDoor” Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor “PortDoor” Malware

The Approach of TA413 for Tibetan Targets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Approach of TA413 for Tibetan Targets

Update to the REF2924 intrusion set and related campaigns

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Update to the REF2924 intrusion set and related campaigns

Threat Analysis: Active C2 Discovery Using Protocol Emulation Part3 (ShadowPad)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Analysis: Active C2 Discovery Using Protocol Emulation Part3 (ShadowPad)

VB2022-Tracking-the-entire-iceberg.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor VB2022-Tracking-the-entire-iceberg.pdf

VB2020-06.pdf

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor VB2020-06.pdf

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research

Chinese State-Sponsored Group TA413 Adopts New Capabilities in Pursuit of Tibetan Targets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese State-Sponsored Group TA413 Adopts New Capabilities in Pursuit of Tibetan Targets

Tracking the entire iceberg – long‑term APT malware C2 protocol emulation and scanning

Malpedia library date Virus Bulletin fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Tracking the entire iceberg – long‑term APT malware C2 protocol emulation and scanning

New Wave of Espionage Activity Targets Asian Governments

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Wave of Espionage Activity Targets Asian Governments

Worok: The big picture

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Worok: The big picture

APT trends report Q2 2020

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT trends report Q2 2020

Targets of Interest | Russian Organizations Increasingly Under Attack By Chinese APTs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Targets of Interest | Russian Organizations Increasingly Under Attack By Chinese APTs

Targets of Interest - Russian Organizations Increasingly Under Attack By Chinese APTs

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Targets of Interest - Russian Organizations Increasingly Under Attack By Chinese APTs

Attacks on industrial control systems using ShadowPad | Kaspersky ICS CERT EN

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attacks on industrial control systems using ShadowPad | Kaspersky ICS CERT EN

CERT-UA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERT-UA

Space Pirates: analyzing the tools and connections of a new hacker group

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Space Pirates: analyzing the tools and connections of a new hacker group

AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf

Moshen Dragon’s Triad-and-Error Approach | Abusing Security Software to Sideload PlugX and ShadowPad

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Moshen Dragon’s Triad-and-Error Approach | Abusing Security Software to Sideload PlugX and ShadowPad

China accused of cyberattacks on Indian power grid

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China accused of cyberattacks on Indian power grid

2021%20ICS%20OT%20Cybersecurity%20Year%20In%20Review%20-%20Dragos%202021.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2021%20ICS%20OT%20Cybersecurity%20Year%20In%20Review%20-%20Dragos%202021.pdf

Researchers Link ShadowPad Malware Attacks to Chinese Ministry and PLA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Researchers Link ShadowPad Malware Attacks to Chinese Ministry and PLA

ShadowPad Malware Analysis

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor ShadowPad Malware Analysis

ShadowPad Malware Analysis _ Secureworks

date in the CCS '25 data SecureWorks fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ShadowPad Malware Analysis _ Secureworks

Microsoft Word - FLASH TLP WHITE CVE Zoho Desktop Servers v1.4 Updated template

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Microsoft Word - FLASH TLP WHITE CVE Zoho Desktop Servers v1.4 Updated template

Winnti is Coming - Evolution after Prosecution@HITCON2021

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Winnti is Coming - Evolution after Prosecution@HITCON2021

Chasing Shadows: A deep dive into the latest obfuscation methods being used by ShadowPad

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chasing Shadows: A deep dive into the latest obfuscation methods being used by ShadowPad

It’s a BEE! It’s a… no, it’s ShadowPad.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor It’s a BEE! It’s a… no, it’s ShadowPad.

Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf

Malpedia library date Kaspersky fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf

D1T1%20-%20%20ShadowPad%20-%20A%20Masterpiece%20of%20Privately%20Sold%20Malware%20in%20Chinese%20Espionage%20-%20Yi-Jhen%20Hsieh%20&%20Joey%20Chen.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor D1T1%20-%20%20ShadowPad%20-%20A%20Masterpiece%20of%20Privately%20Sold%20Malware%20in%20Chinese%20Espionage%20-%20Yi-Jhen%20Hsieh%20&%20Joey%20Chen.pdf

ShadowPad | A Masterpiece of Privately Sold Malware in Chinese Espionage - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ShadowPad | A Masterpiece of Privately Sold Malware in Chinese Espionage - SentinelLabs

Презентация PowerPoint

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Презентация PowerPoint

PortDoor: New Chinese APT Backdoor Attack Targets Russian Defense Sector

date in the CCS '25 data Cybereason fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor PortDoor: New Chinese APT Backdoor Attack Targets Russian Defense Sector

the-operations-of-winnti-group.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor the-operations-of-winnti-group.pdf

RedEcho group parks domains after public exposure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RedEcho group parks domains after public exposure

Examining Exchange Exploitation and its Lessons for Defenders

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Examining Exchange Exploitation and its Lessons for Defenders

Lessons from Exchange Exploitation for Defenders

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lessons from Exchange Exploitation for Defenders

Exchange servers under siege from at least 10 APT groups

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Exchange servers under siege from at least 10 APT groups

China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions

Cyber Threats 2020: A Year in Retrospect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Threats 2020: A Year in Retrospect

Report2021GTR.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Report2021GTR.pdf

Higaisa or Winnti? APT41 backdoors, old and new

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Higaisa or Winnti? APT41 backdoors, old and new

Microsoft Word - Global Perspective of the SideWinder APT (pre-release final).docx

Malpedia library date AlienVault fromORKLCCS '25 data

The original link failed its last check. Original publisher Detailsfor Microsoft Word - Global Perspective of the SideWinder APT (pre-release final).docx

nao-sec.org-Royal Road ReDive

date in the CCS '25 data nao_sec fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor nao-sec.org-Royal Road ReDive

Royal Road! Re-Dive

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Royal Road! Re-Dive

nao-sec.org

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor nao-sec.org

Operation StealthyTrident: corporate software under attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation StealthyTrident: corporate software under attack

APT trends report Q3 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q3 2020

VB2020 paper: Earth Akhlut: exploring the tools, tactics, and procedures of an advanced threat actor operating a large infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor VB2020 paper: Earth Akhlut: exploring the tools, tactics, and procedures of an advanced threat actor operating a large infrastructure

winnti-2020-rus.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor winnti-2020-rus.pdf

APT41: Indictments Put Chinese Espionage Group in the Spotlight

Malpedia library date Symantec fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT41: Indictments Put Chinese Espionage Group in the Spotlight

CactusPete APT group’s updated Bisonal backdoor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CactusPete APT group’s updated Bisonal backdoor

CactusPete APT group’s updated Bisonal backdoor _ Securelist

date in the CCS '25 data FireEye fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor CactusPete APT group’s updated Bisonal backdoor _ Securelist

CactusPete APT group’s updated Bisonal backdoor

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor CactusPete APT group’s updated Bisonal backdoor

APT_trends_report_Q2_2020_Securelist

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT_trends_report_Q2_2020_Securelist

APT trends report Q2 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q2 2020

APT trends report Q2 2020

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT trends report Q2 2020

The Manufacturing Threat Landscape in 2020 | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Manufacturing Threat Landscape in 2020 | CrowdStrike

BackDoor.ShadowPad.1 — Dr.Web Malware description library

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BackDoor.ShadowPad.1 — Dr.Web Malware description library

Cycldek: Bridging the (air) gap

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cycldek: Bridging the (air) gap

Mikroceen: Spying backdoor leveraged in high-profile networks in Central Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mikroceen: Spying backdoor leveraged in high-profile networks in Central Asia

APT group planted backdoors targeting high profile networks in Central Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT group planted backdoors targeting high profile networks in Central Asia

APT trends report Q1 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q1 2020

On the Royal Road

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor On the Royal Road

New version of chinoxy backdoor using COVID19 alerts document lure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New version of chinoxy backdoor using COVID19 alerts document lure

Vicious Panda: The COVID Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Vicious Panda: The COVID Campaign

using RTF object dimensions to track APT phishing weaponizers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor using RTF object dimensions to track APT phishing weaponizers

신천지 비상연락처 위장한 Bisonal 악성코드 유포 중 (2020.03.05) - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 신천지 비상연락처 위장한 Bisonal 악성코드 유포 중 (2020.03.05) - ASEC

Bisonal: 10 years of play

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bisonal: 10 years of play

Cyber Threats 2019: A Year in Retrospect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Threats 2019: A Year in Retrospect

Winnti Group targeting universities in Hong Kong

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Winnti Group targeting universities in Hong Kong

nao-sec.org

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor nao-sec.org

An Overhead View of the Royal Road

file creation date fromORKL

Archived copy on ORKL Detailsfor An Overhead View of the Royal Road

Analytics

Malpedia library date Positive Technologies fromORKLCCS '25 data

The original link failed its last check. Original publisher Detailsfor Analytics

Rancor: The Year of The Phish

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rancor: The Year of The Phish

Chinese APT Uses Poison Ivy Malware to Target Government | Proofpoint US

Malpedia library date Proofpoint fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Chinese APT Uses Poison Ivy Malware to Target Government | Proofpoint US

APT_trends_report_Q1_2019_Securelist

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT_trends_report_Q1_2019_Securelist

중국 기반 해커, 국내 에너지 기관 공격

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor 중국 기반 해커, 국내 에너지 기관 공격

Operation ShadowHammer: a high-profile supply chain attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation ShadowHammer: a high-profile supply chain attack

C/C++ Runtime Library Code Tampering in Supply Chain

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor C/C++ Runtime Library Code Tampering in Supply Chain

ASEC%20REPORT_vol.93_ENG.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor ASEC%20REPORT_vol.93_ENG.pdf

Accenture Strategy Templates

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Accenture Strategy Templates

Another malicious document with CVE-2017–11882

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Another malicious document with CVE-2017–11882

Là 1937CN hay OceanLotus hay Lazarus …

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Là 1937CN hay OceanLotus hay Lazarus …

TRITON: The First ICS Cyberattack on Safety Instrument Systems

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TRITON: The First ICS Cyberattack on Safety Instrument Systems

Bisonal Malware Used in Attacks Against Russia and South Korea

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bisonal Malware Used in Attacks Against Russia and South Korea

Malicious document targets Vietnamese officials

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malicious document targets Vietnamese officials

Bisonal Malware Used in Attacks Against Russia and South Korea

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bisonal Malware Used in Attacks Against Russia and South Korea

Malicious document targets Vietnamese officials

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malicious document targets Vietnamese officials

BSides IR in Heterogeneous Environment

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor BSides IR in Heterogeneous Environment

Threat Actors Target Government of Belarus Using CMSTAR Trojan

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Actors Target Government of Belarus Using CMSTAR Trojan

Threat Actors Target Government of Belarus Using CMSTAR Trojan

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Threat Actors Target Government of Belarus Using CMSTAR Trojan

ShadowPad in corporate networks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ShadowPad in corporate networks

Researchers claim China trying to hack South Korea missile defense efforts

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Researchers claim China trying to hack South Korea missile defense efforts

PowerPoint Presentation

date in the CCS '25 data CrowdStrike fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor PowerPoint Presentation

securitykitten.github.io/_posts/2014-11-25-curious-korlia.md at master · malware-kitten/securitykitten.github.io

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor securitykitten.github.io/_posts/2014-11-25-curious-korlia.md at master · malware-kitten/securitykitten.github.io