Transparent Tribe

SideCopy APT: Connecting lures to victims, payloads to infrastructure

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor SideCopy APT: Connecting lures to victims, payloads to infrastructure

A look into APT36's (Transparent Tribe) tradecraft

date ORKL added it fromORKL

The original link failed its last check. Original publisher Detailsfor A look into APT36's (Transparent Tribe) tradecraft

Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia

Practical Queries for Malware Infrastructure - Part 3 (Advanced Examples)

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Practical Queries for Malware Infrastructure - Part 3 (Advanced Examples)

Cyber Espionage in India: Decoding APT-36's New Linux Malware Campaign

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Cyber Espionage in India: Decoding APT-36's New Linux Malware Campaign

Definitive Dossier of Devilish Debug Details — Part One: PDB Paths and Malware | Mandiant

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Definitive Dossier of Devilish Debug Details — Part One: PDB Paths and Malware | Mandiant

Transparent Tribe campaign uses new bespoke malware to target Indian government officials

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Transparent Tribe campaign uses new bespoke malware to target Indian government officials

APT trends report Q1 2019

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor APT trends report Q1 2019

Transparent Tribe (APT36) | Pakistan-Aligned Threat Actor Expands Interest in Indian Education Sector

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Transparent Tribe (APT36) | Pakistan-Aligned Threat Actor Expands Interest in Indian Education Sector

NjRAT (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor NjRAT (Malware Family)

SpyNote (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor SpyNote (Malware Family)

Turla, Waterbug, Venomous Bear - Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Turla, Waterbug, Venomous Bear - Threat Group Cards: A Threat Actor Encyclopedia

AsyncRAT (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor AsyncRAT (Malware Family)

APT36 jumps on the coronavirus bandwagon, delivers Crimson RAT

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor APT36 jumps on the coronavirus bandwagon, delivers Crimson RAT

New STEPPY#KAVACH Attack Campaign Likely Targeting Indian Government: Technical Insights and Detection Using Securonix

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor New STEPPY#KAVACH Attack Campaign Likely Targeting Indian Government: Technical Insights and Detection Using Securonix

Andromeda (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Andromeda (Malware Family)

njRAT runs MassLogger

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor njRAT runs MassLogger

APT and financial attacks on industrial organizations in Q3 2025 | Kaspersky ICS CERT EN

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT and financial attacks on industrial organizations in Q3 2025 | Kaspersky ICS CERT EN

Sindoor Dropper: New Phishing Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sindoor Dropper: New Phishing Campaign

TAG-144’s Persistent Grip on South American Organizations

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TAG-144’s Persistent Grip on South American Organizations

DRAT V2: Updated DRAT Emerges in TAG-140’s Arsenal

file creation date fromORKL

Archived copy on ORKL Detailsfor DRAT V2: Updated DRAT Emerges in TAG-140’s Arsenal

Analysis of TAG-140 Campaign and DRAT V2 Development Targeting Indian Government Organizations

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis of TAG-140 Campaign and DRAT V2 Development Targeting Indian Government Organizations

Firewalls and Frontlines: The India-Pakistan Cyber Battlefield Crisis - CYFIRMA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Firewalls and Frontlines: The India-Pakistan Cyber Battlefield Crisis - CYFIRMA

APT36-Linked ClickFix Campaign Spoofs Indian Ministry of Defence, Targets Windows & Linux Users

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT36-Linked ClickFix Campaign Spoofs Indian Ministry of Defence, Targets Windows & Linux Users

Advisory: Pahalgam Attack themed decoys used by APT36 to target the Indian Government

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Advisory: Pahalgam Attack themed decoys used by APT36 to target the Indian Government

Goodbye HTA, Hello MSI: New TTPs and Clusters of an APT driven by Multi-Platform Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Goodbye HTA, Hello MSI: New TTPs and Clusters of an APT driven by Multi-Platform Attacks

Blind Eagle Hacks Colombian Institutions Using NTLM Flaw, RATs and GitHub-Based Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Blind Eagle Hacks Colombian Institutions Using NTLM Flaw, RATs and GitHub-Based Attacks

Defying tunneling: A Wicked approach to detecting malicious network traffic

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Defying tunneling: A Wicked approach to detecting malicious network traffic

Jul-Dec%202024%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Jul-Dec%202024%20Botnet%20Threat%20Update.pdf

Snowblind: The invisible hand of Secret Blizzard

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Snowblind: The invisible hand of Secret Blizzard

Frequent freeloader part I: Secret Blizzard compromising Storm-0156 infrastructure for espionage | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Frequent freeloader part I: Secret Blizzard compromising Storm-0156 infrastructure for espionage | Microsoft Security Blog

Stealth in the Cloud: How APT36's ElizaRAT is Redefining Cyber Espionage

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Stealth in the Cloud: How APT36's ElizaRAT is Redefining Cyber Espionage

DarkComet RAT: Technical Analysis of Attack Chain - ANY.RUN's Cybersecurity Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DarkComet RAT: Technical Analysis of Attack Chain - ANY.RUN's Cybersecurity Blog

https://breachnova.com/blog.php?id=27

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor https://breachnova.com/blog.php?id=27

Umbrella of Pakistani Threats: Converging Tactics of Cyber-operations Targeting India

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Umbrella of Pakistani Threats: Converging Tactics of Cyber-operations Targeting India

Threat actors target recent Election Results

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat actors target recent Election Results

Jan-Jun%202024%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Jan-Jun%202024%20Botnet%20Threat%20Update.pdf

Threat Actor Groups Tracked by Palo Alto Networks Unit 42 (Updated Aug. 1, 2025)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Actor Groups Tracked by Palo Alto Networks Unit 42 (Updated Aug. 1, 2025)

Foxit PDF “Flawed Design” Exploitation - Check Point Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Foxit PDF “Flawed Design” Exploitation - Check Point Research

Pakistani APTs Escalate Attacks on Indian Gov. Seqrite Labs Unveils Threats and Connections

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Pakistani APTs Escalate Attacks on Indian Gov. Seqrite Labs Unveils Threats and Connections

Malware Analysis — njRAT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Analysis — njRAT

Q4%202023%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Q4%202023%20Botnet%20Threat%20Update.pdf

Operation RusticWeb targets Indian Govt: From Rust-based malware to Web-service exfiltration

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation RusticWeb targets Indian Govt: From Rust-based malware to Web-service exfiltration

Practical Queries for Malware Infrastructure - Part 3 (Advanced Examples)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Practical Queries for Malware Infrastructure - Part 3 (Advanced Examples)

Unmasking NJRat: A Deep Dive into a Notorious Remote Access Trojan Part1

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unmasking NJRat: A Deep Dive into a Notorious Remote Access Trojan Part1

SideCopy’s Multi-platform Onslaught: Leveraging WinRAR Zero-Day and Linux Variant of Ares RAT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SideCopy’s Multi-platform Onslaught: Leveraging WinRAR Zero-Day and Linux Variant of Ares RAT

Unfolding NJ RAT 0.7NC & 0.6.4

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unfolding NJ RAT 0.7NC & 0.6.4

2023%20Q3%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023%20Q3%20Botnet%20Threat%20Update.pdf

CapraTube | Transparent Tribe’s CapraRAT Mimics YouTube to Hijack Android Phones

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CapraTube | Transparent Tribe’s CapraRAT Mimics YouTube to Hijack Android Phones

APT36's Updated Arsenal | ThreatLabz

Malpedia library date Zscaler fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT36's Updated Arsenal | ThreatLabz

[Research Summary]: APT 36 Campaign - Poseidon Malware - Brandefense

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor [Research Summary]: APT 36 Campaign - Poseidon Malware - Brandefense

2023%20Q2%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023%20Q2%20Botnet%20Threat%20Update.pdf

Android app breaking bad: From legitimate screen recording to file exfiltration within a year

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Android app breaking bad: From legitimate screen recording to file exfiltration within a year

Android app breaking bad- From legitimate screen recording to file exfiltration within a year

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Android app breaking bad- From legitimate screen recording to file exfiltration within a year

The Hunt for VENOM SPIDER PART 2

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Hunt for VENOM SPIDER PART 2

Transparent Tribe APT actively lures Indian Army amidst increased targeting of Educational Institutions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Transparent Tribe APT actively lures Indian Army amidst increased targeting of Educational Institutions

Tomiris called, they want their Turla malware back

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tomiris called, they want their Turla malware back

AllaKore(d) the SideCopy Train

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AllaKore(d) the SideCopy Train

AllaKore(d) the SideCopy Train

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor AllaKore(d) the SideCopy Train

2023%20Q1%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023%20Q1%20Botnet%20Threat%20Update.pdf

March 2023’s Most Wanted Malware: New Emotet Campaign Bypasses Microsoft Blocks to Distribute Malicious OneNote Files

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor March 2023’s Most Wanted Malware: New Emotet Campaign Bypasses Microsoft Blocks to Distribute Malicious OneNote Files

APT-C-36: from NjRAT to LimeRAT

Malpedia library date Lab52 fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT-C-36: from NjRAT to LimeRAT

Analysis of APT-C-56 (Transparent Tribe) camouflage resume attack campaign

date in the CCS '25 data CoreSec360 fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Analysis of APT-C-56 (Transparent Tribe) camouflage resume attack campaign

Love scam or espionage? Transparent Tribe lures Indian and Pakistani officials

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Love scam or espionage? Transparent Tribe lures Indian and Pakistani officials

Love scam or espionage- Transparent Tribe lures Indian and Pakistani officials

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Love scam or espionage- Transparent Tribe lures Indian and Pakistani officials

Technical Advisory: Various Threat Actors Targeting ManageEngine Exploit CVE-2022-47966

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Technical Advisory: Various Threat Actors Targeting ManageEngine Exploit CVE-2022-47966

Earth Bogle: Campaigns Target the Middle East with Geopolitical Lures

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Bogle: Campaigns Target the Middle East with Geopolitical Lures

Turla: A Galaxy of Opportunity | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Turla: A Galaxy of Opportunity | Mandiant

njRAT malware spreading through Discord CDN and Facebook Ads

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor njRAT malware spreading through Discord CDN and Facebook Ads

Analysis of suspected APT-C-56 (Transparent Tribe) attacks against terrorism

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Analysis of suspected APT-C-56 (Transparent Tribe) attacks against terrorism

APT-36 Uses New TTPs and New Tools to Target Indian Governmental Organizations

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT-36 Uses New TTPs and New Tools to Target Indian Governmental Organizations

Indian Governmental Organizations Targeted by APT-36

date in the CCS '25 data Zscaler fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Indian Governmental Organizations Targeted by APT-36

Indian Governmental Organizations Targeted by APT-36

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Indian Governmental Organizations Targeted by APT-36

2022%20Q3%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2022%20Q3%20Botnet%20Threat%20Update.pdf

TA558 Threat Actor Targets Hospitality & Travel | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TA558 Threat Actor Targets Hospitality & Travel | Proofpoint US

Mythic Leopard APT Group - Brandefense

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mythic Leopard APT Group - Brandefense

Quarterly-Adversarial-Threat-Report-Q2-2022.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Quarterly-Adversarial-Threat-Report-Q2-2022.pdf

APT trends report Q2 2022

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q2 2022

Transparent Tribe begins targeting education sector in latest campaign

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Transparent Tribe begins targeting education sector in latest campaign

Transparent Tribe begins targeting education sector in latest campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Transparent Tribe begins targeting education sector in latest campaign

Avos ransomware group expands with new attack arsenal

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Avos ransomware group expands with new attack arsenal

New SYK Crypter Distributed Via Discord

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New SYK Crypter Distributed Via Discord

Transparent Tribe Targets Educational Institution

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Transparent Tribe Targets Educational Institution

Transparent Tribe Targets Educational Institution

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Transparent Tribe Targets Educational Institution

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog

APT_trends_report_Q2_2022_Securelist

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT_trends_report_Q2_2022_Securelist

yir-cyber-threats-report-download.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor yir-cyber-threats-report-download.pdf

20220427_NP_TLPWHITE_ANSSI_FIN7.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 20220427_NP_TLPWHITE_ANSSI_FIN7.pdf

APT trends report Q1 2022

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q1 2022

How Cybercriminals Abuse Cloud Tunneling Services

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How Cybercriminals Abuse Cloud Tunneling Services

Transparent Tribe campaign uses new bespoke malware to target Indian government officials

file creation date Cisco fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Transparent Tribe campaign uses new bespoke malware to target Indian government officials

Hackers use modified MFA tool against Indian govt employees

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hackers use modified MFA tool against Indian govt employees

Transparent Tribe campaign uses new bespoke malware to target Indian government officials

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Transparent Tribe campaign uses new bespoke malware to target Indian government officials

Hackers use modified MFA tool against Indian govt employees

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Hackers use modified MFA tool against Indian govt employees

Microsoft Word - EC-2022-049_Campañas_de_distribución_Malware_Ecuador_V1.docx

Malpedia library date jfreire fromORKL

Archived copy on ORKL Detailsfor Microsoft Word - EC-2022-049_Campañas_de_distribución_Malware_Ecuador_V1.docx

Very very lazy Lazyscripter’s scripts: double compromise in a single obfuscation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Very very lazy Lazyscripter’s scripts: double compromise in a single obfuscation

Threat Roundup for February 4 to February 11

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Roundup for February 4 to February 11

What’s with the shared VBA code between Transparent Tribe and other threat actors?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What’s with the shared VBA code between Transparent Tribe and other threat actors?

What’s with the shared VBA code between Transparent Tribe and other threat actors-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor What’s with the shared VBA code between Transparent Tribe and other threat actors-

Modified Elephant APT and a Decade of Fabricating Evidence

Malpedia library date Sentinal One fromORKL

Archived copy on ORKL Detailsfor Modified Elephant APT and a Decade of Fabricating Evidence

ModifiedElephant APT and a Decade of Fabricating Evidence

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ModifiedElephant APT and a Decade of Fabricating Evidence

PrivateLoader: The first step in many malware schemes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PrivateLoader: The first step in many malware schemes

njRAT Installed from a MSI

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor njRAT Installed from a MSI

Investigating APT36 or Earth Karkaddan’s Attack Chain and Malware Arsenal

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Investigating APT36 or Earth Karkaddan’s Attack Chain and Malware Arsenal

New TransparenTribe Operation- Targeting India with weaponized COVID-19 lure documents

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New TransparenTribe Operation- Targeting India with weaponized COVID-19 lure documents

Investigating APT36 or Earth Karkaddans Attack Chain and Malware Arsenal

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Investigating APT36 or Earth Karkaddans Attack Chain and Malware Arsenal

Microsoft Word - Earth Karkaddan Tech Brief_ed_CC.docx

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Microsoft Word - Earth Karkaddan Tech Brief_ed_CC.docx

Investigating APT36 or Earth Karkaddan's Attack Chain and Malware Arsenal (IOCs)

date in the CCS '25 data Trend Micro fromCCS '25 data

Detailsfor Investigating APT36 or Earth Karkaddan's Attack Chain and Malware Arsenal (IOCs)

Analysis of njRAT PowerPoint Macros

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis of njRAT PowerPoint Macros

APT Tracking Analytics- Transparent Tribe Attack Activity

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT Tracking Analytics- Transparent Tribe Attack Activity

APT Tracking Analytics Transparent Tribe Attack Activity

date in the CCS '25 data Know Chuangyu fromCCS '25 data

Detailsfor APT Tracking Analytics Transparent Tribe Attack Activity

SideCopy APT: Connecting lures to victims, payloads to infrastructure

Malpedia library date Malwarebytes fromORKLCCS '25 data

Archived copy on ORKL Detailsfor SideCopy APT: Connecting lures to victims, payloads to infrastructure

SideCopy APT- Connecting lures to victims, payloads to infrastructure

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor SideCopy APT- Connecting lures to victims, payloads to infrastructure

Just another analysis of the njRAT malware – A step-by-step approach – CYBER GEEKS

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Just another analysis of the njRAT malware – A step-by-step approach – CYBER GEEKS

Campaign Abusing Legitimate Remote Administrator Tools Uses Fake Cryptocurrency Websites

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Campaign Abusing Legitimate Remote Administrator Tools Uses Fake Cryptocurrency Websites

Intelligence Insights: November 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Intelligence Insights: November 2021

HTML smuggling surges: Highly evasive loader technique increasingly used in banking malware, targeted attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor HTML smuggling surges: Highly evasive loader technique increasingly used in banking malware, targeted attacks

Lazarus-%EA%B7%B8%EB%A3%B9%EC%9D%98-NukeSped-%EC%95%85%EC%84%B1%EC%BD%94%EB%93%9C-%EB%B6%84%EC%84%9D-%EB%B3%B4%EA%B3%A0%EC%84%9C.pdf

Malpedia library date AhnLab, Inc. fromORKL

Archived copy on ORKL Detailsfor Lazarus-%EA%B7%B8%EB%A3%B9%EC%9D%98-NukeSped-%EC%95%85%EC%84%B1%EC%BD%94%EB%93%9C-%EB%B6%84%EC%84%9D-%EB%B3%B4%EA%B3%A0%EC%84%9C.pdf

Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf

Malpedia library date Kaspersky fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf

Global_APT_Research_Report_for_the_first_half_of_2021-360

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Global_APT_Research_Report_for_the_first_half_of_2021-360

Trouble in Asia and the Middle East. Tracking the TransparentTribe threat actor.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trouble in Asia and the Middle East. Tracking the TransparentTribe threat actor.

Trouble in Asia and the Middle East. Tracking the TransparentTribe threat actor.

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Trouble in Asia and the Middle East. Tracking the TransparentTribe threat actor.

Operation Armor Piercer: Targeted attacks in the Indian subcontinent using commercial RATs

date in the CCS '25 data Cisco fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Operation Armor Piercer: Targeted attacks in the Indian subcontinent using commercial RATs

Operation “Armor Piercer:” Targeted attacks in the Indian subcontinent using commercial RATs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation “Armor Piercer:” Targeted attacks in the Indian subcontinent using commercial RATs

Operation “Armor Piercer-” Targeted attacks in the Indian subcontinent using commercial RATs

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Operation “Armor Piercer-” Targeted attacks in the Indian subcontinent using commercial RATs

Water Basilisk Uses New HCrypt Variant to Flood Victims with RAT Payloads

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Water Basilisk Uses New HCrypt Variant to Flood Victims with RAT Payloads

Operation Layover: How we tracked an attack on the aviation industry to five years of compromise

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Layover: How we tracked an attack on the aviation industry to five years of compromise

APT Group Targets Indian Defense Officials Through Enhanced TTPs

date in the CCS '25 data Cyble fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor APT Group Targets Indian Defense Officials Through Enhanced TTPs

APT Group Targets Indian Defense Officials Through Enhanced TTPs

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT Group Targets Indian Defense Officials Through Enhanced TTPs

APT Group Targets Indian Defense Officials with TTPs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT Group Targets Indian Defense Officials with TTPs

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/apt-c-36-updates-its-long-term-spam-campaign-against-south-american-entities-with-commodity-rats/BlindEagleIOCList.txt

Malpedia library date Trend Micro fromORKLCCS '25 data

Archived copy on ORKL Detailsfor https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/apt-c-36-updates-its-long-term-spam-campaign-against-south-american-entities-with-commodity-rats/BlindEagleIOCList.txt

APT-C-36 Updates Its Long-term Spam Campaign Against South American Entities With Commodity RATs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT-C-36 Updates Its Long-term Spam Campaign Against South American Entities With Commodity RATs

APT-C-56 (Transparent Tribe) Latest Attack Analysis and Associated Suspected Gorgon Group Attack Analysis Alert

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT-C-56 (Transparent Tribe) Latest Attack Analysis and Associated Suspected Gorgon Group Attack Analysis Alert

Malicious Campaign Targets Latin America: The seller, The operator and a curious link

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malicious Campaign Targets Latin America: The seller, The operator and a curious link

ISOMorph Infection: In-Depth Analysis of a New HTML Smuggling Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ISOMorph Infection: In-Depth Analysis of a New HTML Smuggling Campaign

Automation to Combat Evolving Obfuscation – Cipher Tech Solutions, Inc.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Automation to Combat Evolving Obfuscation – Cipher Tech Solutions, Inc.

SQ_WhitepaperOperation SideCopy_072021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SQ_WhitepaperOperation SideCopy_072021

InSideCopy- How this APT continues to evolve its arsenal

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor InSideCopy- How this APT continues to evolve its arsenal

InSideCopy: How this APT continues to evolve its arsenal

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor InSideCopy: How this APT continues to evolve its arsenal

InSideCopy: How this APT continues to evolve its arsenal

Malpedia library date Talos fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor InSideCopy: How this APT continues to evolve its arsenal

Transparent Tribe APT Infrastructure Mapping Part 2- A Deeper Dive into the Identification of CrimsonRAT Infrastructure

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Transparent Tribe APT Infrastructure Mapping Part 2- A Deeper Dive into the Identification of CrimsonRAT Infrastructure

Geopolitical nation-state threat actor overview June 2021

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Geopolitical nation-state threat actor overview June 2021

Geopolitical nation-state threat actor overview May 2021

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Geopolitical nation-state threat actor overview May 2021

Transparent Tribe APT expands its Windows malware arsenal

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Transparent Tribe APT expands its Windows malware arsenal

blog.talosintelligence.com-Transparent Tribe APT expands its Windows malware arsenal

date in the CCS '25 data Cisco fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor blog.talosintelligence.com-Transparent Tribe APT expands its Windows malware arsenal

Transparent Tribe APT expands its Windows malware arsenal

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Transparent Tribe APT expands its Windows malware arsenal

Analysis of top non-HTTP/S threats | Zscaler Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis of top non-HTTP/S threats | Zscaler Blog

Transparent Tribe Operating with a New Variant of Crimson RAT

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Transparent Tribe Operating with a New Variant of Crimson RAT

APT trends report Q1 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q1 2021

Taking Action Against Hackers in Palestine

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Taking Action Against Hackers in Palestine

Transparent Tribe uses the new crown vaccine hotspot to analyze the targeted attacks on the Indian medical industry

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Transparent Tribe uses the new crown vaccine hotspot to analyze the targeted attacks on the Indian medical industry

Transparent Tribe APT Infrastructure Mapping Part 1- A High-Level Study of CrimsonRAT Infrastructure October 2020 – March 2021

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Transparent Tribe APT Infrastructure Mapping Part 1- A High-Level Study of CrimsonRAT Infrastructure October 2020 – March 2021

Transparent Tribe APT Infrastructure Mapping Part 1 A High-Level Study of CrimsonRAT Infrastructure October 2020 - March 2021

date in the CCS '25 data Team Cymru fromCCS '25 data

Detailsfor Transparent Tribe APT Infrastructure Mapping Part 1 A High-Level Study of CrimsonRAT Infrastructure October 2020 - March 2021

2021-Threat-Detection-Report.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2021-Threat-Detection-Report.pdf

MalSpam Campaigns Download njRAT from Paste Sites

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MalSpam Campaigns Download njRAT from Paste Sites

report-bb-2021-threat-report.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor report-bb-2021-threat-report.pdf

ObliqueRAT returns with new campaign using hijacked websites

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor ObliqueRAT returns with new campaign using hijacked websites

ObliqueRAT returns with new campaign using hijacked websites

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ObliqueRAT returns with new campaign using hijacked websites

Cyber Threats 2020: A Year in Retrospect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Threats 2020: A Year in Retrospect

Intezer-2020-Go-Malware-Round-Up.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Intezer-2020-Go-Malware-Round-Up.pdf

Operation Spalax: Targeted malware attacks in Colombia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Spalax: Targeted malware attacks in Colombia

来自Mustang Panda的攻击? 我兔又背锅了！

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 来自Mustang Panda的攻击? 我兔又背锅了！

2020: The year in malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2020: The year in malware

Remediate “Hidden” Malware with RTR

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Remediate “Hidden” Malware with RTR

No pandas, just people: The current state of China’s cybercrime underground

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor No pandas, just people: The current state of China’s cybercrime underground

njRAT Spreading Through Active Pastebin Command and Control Tunnel

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor njRAT Spreading Through Active Pastebin Command and Control Tunnel

APT annual review: What the world’s threat actors got up to in 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT annual review: What the world’s threat actors got up to in 2020

npm Malware: Bladabindi Trojan in Typosquatting Packages

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor npm Malware: Bladabindi Trojan in Typosquatting Packages

Group-IB_Hi-Tech_Crime_Trends_2020-2021_en

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Group-IB_Hi-Tech_Crime_Trends_2020-2021_en

Fake Microsoft Teams updates lead to Cobalt Strike deployment

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Fake Microsoft Teams updates lead to Cobalt Strike deployment

APT_trends_report_Q3_2020_Securelist

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT_trends_report_Q3_2020_Securelist

APT trends report Q3 2020

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT trends report Q3 2020

APT trends report Q3 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q3 2020

A look into APT36's (Transparent Tribe) tradecraft

date in the CCS '25 data Cyberstanc fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor A look into APT36's (Transparent Tribe) tradecraft

Transparent Tribe_ Evolution analysis, part 2 _ Securelist

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Transparent Tribe_ Evolution analysis, part 2 _ Securelist

Operation SideCopy!

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation SideCopy!

Operation SideCopy

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation SideCopy

Operation SideCopy!

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Operation SideCopy!

Seqrite-WhitePaper-Operation-SideCopy

date in the CCS '25 data Quick Heal fromCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Detailsfor Seqrite-WhitePaper-Operation-SideCopy

Cybercriminals Distribute Backdoor With VPN Installer

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cybercriminals Distribute Backdoor With VPN Installer

Epic Manchego – atypical maldoc delivery brings flurry of infostealers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Epic Manchego – atypical maldoc delivery brings flurry of infostealers

Transparent Tribe: Evolution analysis, part 2

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Transparent Tribe: Evolution analysis, part 2

Transparent Tribe- Evolution analysis, part 2

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Transparent Tribe- Evolution analysis, part 2

Transparent Tribe: Evolution analysis, part 2

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Transparent Tribe: Evolution analysis, part 2

南亚APT组织“透明部落”在移动端上与对手的较量

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 南亚APT组织“透明部落”在移动端上与对手的较量

Transparent Tribe: Evolution analysis, part 1

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Transparent Tribe: Evolution analysis, part 1

Transparent Tribe- Evolution analysis, part 1

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Transparent Tribe- Evolution analysis, part 1

Transparent Tribe: Evolution analysis, part 1

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Transparent Tribe: Evolution analysis, part 1

국내 유명 웹하드를 통해 유포되는 njRAT 악성코드

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 국내 유명 웹하드를 통해 유포되는 njRAT 악성코드

2020-q2-spamhaus-botnet-threat-report.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor 2020-q2-spamhaus-botnet-threat-report.pdf

ESET_Threat_Report_Q22020.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET_Threat_Report_Q22020.pdf

APT trends report Q2 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q2 2020

Operation ‘Honey Trap’- APT36 Targets Defense Organizations in India

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Operation ‘Honey Trap’- APT36 Targets Defense Organizations in India

Operation ‘Honey Trap’: APT36 Targets Defence Organizations in India

Malpedia library date Seqrite fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Operation ‘Honey Trap’: APT36 Targets Defence Organizations in India

Operation ‘Honey Trap’_ APT36 Targets Defense Organizations in India

date in the CCS '25 data Seqrite fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation ‘Honey Trap’_ APT36 Targets Defense Organizations in India

0628-2020APT上半年报告-画册

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 0628-2020APT上半年报告-画册

njRAT Malware Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor njRAT Malware Analysis

APT trends report Q1 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q1 2020

How Cyber Adversaries are Adapting to Exploit the Global Pandemic

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor How Cyber Adversaries are Adapting to Exploit the Global Pandemic

200407-MWB-COVID-White-Paper_Final

date in the CCS '25 data Malwarebytes fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 200407-MWB-COVID-White-Paper_Final

奇安信威胁情报中心

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 奇安信威胁情报中心

Has The Sun Set On The Necurs Botnet?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Has The Sun Set On The Necurs Botnet?

APT36 jumps on the coronavirus bandwagon, delivers Crimson RAT _ Malwarebytes Labs

date in the CCS '25 data Malwarebytes fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT36 jumps on the coronavirus bandwagon, delivers Crimson RAT _ Malwarebytes Labs

COVID19 Infographic Mar2020

file creation date fromORKL

Archived copy on ORKL Detailsfor COVID19 Infographic Mar2020

Cyber Threats 2019: A Year in Retrospect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Threats 2019: A Year in Retrospect

The North Korean Kimsuky APT keeps threatening South Korea evolving its TTPs

date in the CCS '25 data Yoroi fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The North Korean Kimsuky APT keeps threatening South Korea evolving its TTPs

Transparent Tribe- Four Years Later

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Transparent Tribe- Four Years Later

RL Blog | ReversingLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RL Blog | ReversingLabs

Dark Matter: Uncovering the DarkComet RAT Ecosystem

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dark Matter: Uncovering the DarkComet RAT Ecosystem

Microsoft Word - Threat Intelligence and the Limits of Malware Analysis_smc1.docx

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Word - Threat Intelligence and the Limits of Malware Analysis_smc1.docx

New WhiteShadow downloader uses Microsoft SQL to retrieve malware | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New WhiteShadow downloader uses Microsoft SQL to retrieve malware | Proofpoint US

APT trends report Q2 2019

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q2 2019

APT_trends_report_Q1_2019_Securelist

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT_trends_report_Q1_2019_Securelist

Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.

Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.

腾讯iOA官网(腾讯自研自用的一体化办公安全平台）-免费使用

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 腾讯iOA官网(腾讯自研自用的一体化办公安全平台）-免费使用

Targeted Attack on Indian Ministry of External Affairs using Crimson RAT

date in the CCS '25 data Volon fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Targeted Attack on Indian Ministry of External Affairs using Crimson RAT

The Gorgon Group: Slithering Between Nation State and Cybercrime

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Gorgon Group: Slithering Between Nation State and Cybercrime

NCIIPC_Newsletter_July18.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor NCIIPC_Newsletter_July18.pdf

‘LuminosityLink RAT’ Author Pleads Guilty

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ‘LuminosityLink RAT’ Author Pleads Guilty

Stealth Mango and Tangelo | Surveillanceware Stealing Data

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Stealth Mango and Tangelo | Surveillanceware Stealing Data

Meet CrowdStrike’s Adversary of the Month for May- MYTHIC LEOPARD

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Meet CrowdStrike’s Adversary of the Month for May- MYTHIC LEOPARD

Stealth Mango and Tangelo | Surveillanceware Stealing Data

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Stealth Mango and Tangelo | Surveillanceware Stealing Data

lookout-stealth-mango-srr-us.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor lookout-stealth-mango-srr-us.pdf

M-Trends Overview

Malpedia library date Marco Rottigni fromORKL

Archived copy on ORKL Detailsfor M-Trends Overview

Report2018GlobalThreatReport.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor Report2018GlobalThreatReport.pdf

A review of the evolution of Andromeda over the years before we say goodbye

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A review of the evolution of Andromeda over the years before we say goodbye

RAT Trapped? LuminosityLink Falls Foul of Vermin Eradication Efforts

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RAT Trapped? LuminosityLink Falls Foul of Vermin Eradication Efforts

Update on Pawn Storm: New Targets and Politically Motivated Campaigns - TrendLabs Security Intelligence Blog

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Update on Pawn Storm: New Targets and Politically Motivated Campaigns - TrendLabs Security Intelligence Blog

Update on Pawn Storm: New Targets and Politically Motivated Campaigns

date in the CCS '25 data Trend Micro fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Update on Pawn Storm: New Targets and Politically Motivated Campaigns

Andromeda botnet dismantled in international cyber operation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Andromeda botnet dismantled in international cyber operation

Microsoft Defender for Cloud Apps Archives | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Defender for Cloud Apps Archives | Microsoft Security Blog

Tracking Subaat Targeted Phishing Attack Leads to Threat Actors Repository

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Tracking Subaat Targeted Phishing Attack Leads to Threat Actors Repository

Tracking Subaat- Targeted Phishing Attack Leads to Threat Actor’s Repository

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Tracking Subaat- Targeted Phishing Attack Leads to Threat Actor’s Repository

Tracking Subaat: Targeted Phishing Attack Leads to Threat Actor's Repository

date in the CCS '25 data Palo Alto Networks fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Tracking Subaat: Targeted Phishing Attack Leads to Threat Actor's Repository

Tracking Subaat: Targeted Phishing Attack Leads to Threat Actor's Repository

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tracking Subaat: Targeted Phishing Attack Leads to Threat Actor's Repository

Andromeda’s Five Star Custom Packer – Hackers’ Tactics Analyzed

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Andromeda’s Five Star Custom Packer – Hackers’ Tactics Analyzed

Bladabindi Remains A Constant Threat By Using Dynamic DNS Services

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bladabindi Remains A Constant Threat By Using Dynamic DNS Services

Vectra AI Cybersecurity Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Vectra AI Cybersecurity Blog

Luminosity RAT - Re-purposed

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Luminosity RAT - Re-purposed

Investigating the LuminosityLink Remote Access Trojan Configuration

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Investigating the LuminosityLink Remote Access Trojan Configuration

APT Group Sends Spear Phishing Emails to Indian Government Officials

file creation date FireEye fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor APT Group Sends Spear Phishing Emails to Indian Government Officials

TrendLabs Security Intelligence BlogFastPOS_ Quick and Easy Credit Card Theft - TrendLabs Security Intelligence Blog

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor TrendLabs Security Intelligence BlogFastPOS_ Quick and Easy Credit Card Theft - TrendLabs Security Intelligence Blog

Apt Group Sends Spear Phishing Emails To Indian Government Officials

date in the CCS '25 data FireEye fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Apt Group Sends Spear Phishing Emails To Indian Government Officials

TrendLabs Security Intelligence BlogIXESHE Derivative IHEATE Targets Users in America - TrendLabs Security Intelligence Blog

date in the CCS '25 data Trend Micro fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor TrendLabs Security Intelligence BlogIXESHE Derivative IHEATE Targets Users in America - TrendLabs Security Intelligence Blog

Operation C-Major Actors Also Used Android BlackBerry Mobile Spyware Against Targets

file creation date Trend Micro fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Operation C-Major Actors Also Used Android BlackBerry Mobile Spyware Against Targets

Andromeda under the microscope

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Andromeda under the microscope

ProjectM: Link Found Between Pakistani Actor and Operation Transparent Tribe

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor ProjectM: Link Found Between Pakistani Actor and Operation Transparent Tribe

ProjectM- Link Found Between Pakistani Actor and Operation Transparent Tribe

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor ProjectM- Link Found Between Pakistani Actor and Operation Transparent Tribe

ProjectM: Link Found Between Pakistani Actor and Operation Transparent Tribe - Palo Alto Networks BlogPalo Alto Networks Blog

date in the CCS '25 data Palo Alto fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ProjectM: Link Found Between Pakistani Actor and Operation Transparent Tribe - Palo Alto Networks BlogPalo Alto Networks Blog

Indian-military-personnel-targeted-by-information-theft-campaign-cmajor

Malpedia library date Trend Micro fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Indian-military-personnel-targeted-by-information-theft-campaign-cmajor

Operation Transparent Title

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation Transparent Title

Operation Transparent Tribe

date in the CCS '25 data Proofpoint fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Operation Transparent Tribe

Sundown EK Spreads LuminosityLink RAT | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sundown EK Spreads LuminosityLink RAT | Proofpoint US

Andromeda/Gamarue bot loves JSON too (new versions details)

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Andromeda/Gamarue bot loves JSON too (new versions details)

Knowledge Fragment: Bruteforcing Andromeda Configuration Buffers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Knowledge Fragment: Bruteforcing Andromeda Configuration Buffers

AutoIt-Compiled Worm Sends Fileless BLADABINDI/njRAT

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor AutoIt-Compiled Worm Sends Fileless BLADABINDI/njRAT

Yet another Andromeda / Gamarue analysis

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Yet another Andromeda / Gamarue analysis

Virus Bulletin :: Andromeda 2.7 features

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Virus Bulletin :: Andromeda 2.7 features

The path to infection - Eye glance at the first line of "Russian Underground" - focused on Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The path to infection - Eye glance at the first line of "Russian Underground" - focused on Ransomware

Dark Comet 2: Electric Boogaloo | Malwarebytes Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dark Comet 2: Electric Boogaloo | Malwarebytes Labs

You dirty RAT! Part 1: DarkComet | Malwarebytes Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor You dirty RAT! Part 1: DarkComet | Malwarebytes Labs