Andariel

Andariel Group Exploiting Korean Asset Management Solutions (MeshAgent)

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Andariel Group Exploiting Korean Asset Management Solutions (MeshAgent)

Treasury Sanctions North Korean State-Sponsored Malicious Cyber Groups

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Treasury Sanctions North Korean State-Sponsored Malicious Cyber Groups

Assessed Cyber Structure and Alignments of North Korea in 2023 | Mandiant

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Assessed Cyber Structure and Alignments of North Korea in 2023 | Mandiant

Five Threat Groups Target Industrial Systems: Dragos

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Five Threat Groups Target Industrial Systems: Dragos

North Korean hackers stole anti-aircraft system data from South Korean firm

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor North Korean hackers stole anti-aircraft system data from South Korean firm

CrowdCasts Monthly: You Have an Adversary Problem

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor CrowdCasts Monthly: You Have an Adversary Problem

Analysis of Attack Cases Against Korean Solutions by the Andariel Group (SmallTiger) - ASEC

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Analysis of Attack Cases Against Korean Solutions by the Andariel Group (SmallTiger) - ASEC

Circumstances of an Attack Exploiting an Asset Management Program (Andariel Group)

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Circumstances of an Attack Exploiting an Asset Management Program (Andariel Group)

Lazarus APT conceals malicious code within BMP image to drop its RAT

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Lazarus APT conceals malicious code within BMP image to drop its RAT

Subgroup: Bluenoroff, APT 38, Stardust Chollima

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Subgroup: Bluenoroff, APT 38, Stardust Chollima

North Korean hackers breached major hospital in Seoul to steal data

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor North Korean hackers breached major hospital in Seoul to steal data

TDrop2 Attacks Suggest Dark Seoul Attackers Return

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor TDrop2 Attacks Suggest Dark Seoul Attackers Return

STARDUST CHOLLIMA | Threat Actor Profile | CrowdStrike

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor STARDUST CHOLLIMA | Threat Actor Profile | CrowdStrike

Stonefly: Extortion Attacks Continue Against U.S. Targets

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Stonefly: Extortion Attacks Continue Against U.S. Targets

Sanctions Imposed on DPRK IT Workers Generating Revenue for the Kim Regime

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Sanctions Imposed on DPRK IT Workers Generating Revenue for the Kim Regime

Analysis of APT Attack Cases Using Dora RAT Against Korean Companies (Andariel Group)

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Analysis of APT Attack Cases Using Dora RAT Against Korean Companies (Andariel Group)

APT trends report Q2 2021

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor APT trends report Q2 2021

Subgroup: Andariel, Silent Chollima - Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Subgroup: Andariel, Silent Chollima - Threat Group Cards: A Threat Actor Encyclopedia

APT and financial attacks on industrial organizations in H1 2023 | Kaspersky ICS CERT EN

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor APT and financial attacks on industrial organizations in H1 2023 | Kaspersky ICS CERT EN

North Korean cryptocurrency hackers expand target list

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor North Korean cryptocurrency hackers expand target list

North Korea's Top APT Swindled $1B From Crypto Investors in 2022

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor North Korea's Top APT Swindled $1B From Crypto Investors in 2022

Free Automated Malware Analysis Service - powered by Falcon Sandbox

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Free Automated Malware Analysis Service - powered by Falcon Sandbox

New Andariel Reconnaissance Tactics Uncovered

date ORKL added it fromORKL

The original link failed its last check. Original publisher Detailsfor New Andariel Reconnaissance Tactics Uncovered

Computer giant Acer hit by $50 million ransomware attack

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Computer giant Acer hit by $50 million ransomware attack

Microsoft: North Korean hackers join Qilin ransomware gang

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Microsoft: North Korean hackers join Qilin ransomware gang

Account Credential-Stealing Malware Detected by AhnLab MDS (Web Browsers, Email, FTP) - ASEC

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Account Credential-Stealing Malware Detected by AhnLab MDS (Web Browsers, Email, FTP) - ASEC

Threat Assessment: North Korean Threat Groups

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Threat Assessment: North Korean Threat Groups

The Blockbuster Sequel

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor The Blockbuster Sequel

DPRK hacking groups breach South Korean defense contractors

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor DPRK hacking groups breach South Korean defense contractors

Dtrack: In-depth analysis of APT on a nuclear power plant

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Dtrack: In-depth analysis of APT on a nuclear power plant

Securonix Threat Labs Monthly Intelligence Insights – June 2023

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Securonix Threat Labs Monthly Intelligence Insights – June 2023

Circumstances of the Andariel Group Exploiting an Apache ActiveMQ Vulnerability (CVE-2023-46604) - ASEC

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Circumstances of the Andariel Group Exploiting an Apache ActiveMQ Vulnerability (CVE-2023-46604) - ASEC

SmallTiger Malware Used in Attacks Against South Korean Businesses (Kimsuky and Andariel) - ASEC

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor SmallTiger Malware Used in Attacks Against South Korean Businesses (Kimsuky and Andariel) - ASEC

Treasury Sanctions Individuals Laundering Cryptocurrency for Lazarus Group

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Treasury Sanctions Individuals Laundering Cryptocurrency for Lazarus Group

North Korean hackers spoof venture capital firms in Japan, Vietnam and US

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor North Korean hackers spoof venture capital firms in Japan, Vietnam and US

North Korea Cyber Group Conducts Global Espionage Campaign to Advance Regime’s Military and Nuclear Programs | CISA

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor North Korea Cyber Group Conducts Global Espionage Campaign to Advance Regime’s Military and Nuclear Programs | CISA

Subgroup: BeagleBoyz - Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Subgroup: BeagleBoyz - Threat Group Cards: A Threat Actor Encyclopedia

Lazarus Group, Hidden Cobra, Labyrinth Chollima

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Lazarus Group, Hidden Cobra, Labyrinth Chollima

North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain Attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain Attack

North Korean Lazarus Group Now Working With Medusa Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor North Korean Lazarus Group Now Working With Medusa Ransomware

Threats to the Defense Industrial Base

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threats to the Defense Industrial Base

UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled Social Engineering

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled Social Engineering

WithSecure_Andariel_2025.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor WithSecure_Andariel_2025.pdf

GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools

advances-in-threat-actor-usage-of-ai-tools-en.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor advances-in-threat-actor-usage-of-ai-tools-en.pdf

TLP-CLEAR-31072025-ShadowSyndicate-infrastructure-illumination-EN.pdf

Malpedia library date Julien DUGAY fromORKL

Archived copy on ORKL Detailsfor TLP-CLEAR-31072025-ShadowSyndicate-infrastructure-illumination-EN.pdf

Inside the BlueNoroff Web3 macOS Intrusion Analysis | Huntress

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Inside the BlueNoroff Web3 macOS Intrusion Analysis | Huntress

DTEX-Exposing+DPRK+Cyber+Syndicate+and+Hidden+IT+Workforce.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DTEX-Exposing+DPRK+Cyber+Syndicate+and+Hidden+IT+Workforce.pdf

ESET APT Activity Report Q4 2024-Q1 2025

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET APT Activity Report Q4 2024-Q1 2025

m-trends-2025-en.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor m-trends-2025-en.pdf

How to Remove Lilith RAT: Complete Removal Guide | Trojan Killer

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How to Remove Lilith RAT: Complete Removal Guide | Trojan Killer

Tempted to Classifying APT Actors: Practical Challenges of Attribution in the Case of Lazarus’s Subgroup - JPCERT/CC Eyes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tempted to Classifying APT Actors: Practical Challenges of Attribution in the Case of Lazarus’s Subgroup - JPCERT/CC Eyes

RID Hijacking Technique Utilized by Andariel Attack Group

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RID Hijacking Technique Utilized by Andariel Attack Group

Jumpy Pisces Engages in Play Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Jumpy Pisces Engages in Play Ransomware

Analysis of the North Korea-backed puNK-003’s Lilith RAT ported to AutoIt Script

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis of the North Korea-backed puNK-003’s Lilith RAT ported to AutoIt Script

APT45: North Korea’s Digital Military Machine

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT45: North Korea’s Digital Military Machine

Threat Actor Groups Tracked by Palo Alto Networks Unit 42 (Updated Aug. 1, 2025)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Actor Groups Tracked by Palo Alto Networks Unit 42 (Updated Aug. 1, 2025)

100DaysofYARA - SpectralBlur | A Clever Blog Name by Greg Lesnewich

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 100DaysofYARA - SpectralBlur | A Clever Blog Name by Greg Lesnewich

Objective-See's Blog

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Objective-See's Blog

LilacSquid: The stealthy trilogy of PurpleInk, InkBox and InkLoader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor LilacSquid: The stealthy trilogy of PurpleInk, InkBox and InkLoader

Moonstone Sleet emerges as new North Korean threat actor with new bag of tricks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Moonstone Sleet emerges as new North Korean threat actor with new bag of tricks

ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilities

file creation date fromORKL

Archived copy on ORKL Detailsfor ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilities

APT and financial attacks on industrial organizations in H2 2023 | Kaspersky ICS CERT EN

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT and financial attacks on industrial organizations in H2 2023 | Kaspersky ICS CERT EN

Microsoft Security Compliance and Identity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Security Compliance and Identity

To Russia With Love: Assessing a KONNI-Backdoored Suspected Russian Consular Software Installer

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor To Russia With Love: Assessing a KONNI-Backdoored Suspected Russian Consular Software Installer

2023 Adversary Infrastructure Report

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023 Adversary Infrastructure Report

Lazarus supply-chain attack in South Korea

file creation date ESET fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Lazarus supply-chain attack in South Korea

Operation Blacksmith: Lazarus targets organizations worldwide using novel Telegram-based malware written in DLang

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Blacksmith: Lazarus targets organizations worldwide using novel Telegram-based malware written in DLang

자산 관리 프로그램을 악용한 공격 정황 포착 (Andariel 그룹) - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 자산 관리 프로그램을 악용한 공격 정황 포착 (Andariel 그룹) - ASEC

Modern Asia APT groups TTPs

file creation date Kaspersky fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Modern Asia APT groups TTPs

ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilities

Malpedia library date ESET fromORKLCCS '25 data

Archived copy on ORKL Detailsfor ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilities

Multiple North Korean threat actors exploiting the TeamCity CVE-2023-42793 vulnerability | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Multiple North Korean threat actors exploiting the TeamCity CVE-2023-42793 vulnerability | Microsoft Security Blog

Assessed Cyber Structure and Alignments of North Korea in 2023 | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Assessed Cyber Structure and Alignments of North Korea in 2023 | Mandiant

Analysis of Andariel’s New Attack Activities - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis of Andariel’s New Attack Activities - ASEC

IT threat evolution in Q2 2023

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor IT threat evolution in Q2 2023

Lazarus Group's infrastructure reuse leads to discovery of new malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lazarus Group's infrastructure reuse leads to discovery of new malware

Lazarus Group exploits ManageEngine vulnerability to deploy QuiteRAT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lazarus Group exploits ManageEngine vulnerability to deploy QuiteRAT

Andariel 그룹의 새로운 공격 활동 분석 - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Andariel 그룹의 새로운 공격 활동 분석 - ASEC

Andariel’s silly mistakes and a new malware family

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Andariel’s silly mistakes and a new malware family

Bluenoroff’s RustBucket campaign

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Bluenoroff’s RustBucket campaign

Bluenoroff’s RustBucket campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bluenoroff’s RustBucket campaign

Andariel’s “Jupiter” malware and the case of the curious C2

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Andariel’s “Jupiter” malware and the case of the curious C2

Andariel’s “Jupiter” malware and the case of the curious C2

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Andariel’s “Jupiter” malware and the case of the curious C2

m_trends_2023_report.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor m_trends_2023_report.pdf

apt43-report-en.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor apt43-report-en.pdf

APT attacks on industrial organizations in H2 2022 | Kaspersky ICS CERT EN

Malpedia library date Kaspersky fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT attacks on industrial organizations in H2 2022 | Kaspersky ICS CERT EN

Move, Patch, Get Out the Way- 2022 Zero-Day Exploitation Continues at an Elevated Pace

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Move, Patch, Get Out the Way- 2022 Zero-Day Exploitation Continues at an Elevated Pace

PwC Cyber Threats 2022: A Year in Retrospect.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor PwC Cyber Threats 2022: A Year in Retrospect.pdf

Stealing the LIGHTSHOW (Part One) - North Korea's UNC2970

file creation date Mandiant fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Stealing the LIGHTSHOW (Part One) - North Korea's UNC2970

Stealing the LIGHTSHOW (Part One) — North Korea's UNC2970 | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Stealing the LIGHTSHOW (Part One) — North Korea's UNC2970 | Mandiant

Stealing the LIGHTSHOW (Part One) — North Korea's UNC2970

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Stealing the LIGHTSHOW (Part One) — North Korea's UNC2970

Clasiopa: New Group Targets Materials Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Clasiopa: New Group Targets Materials Research

Technical Advisory: Various Threat Actors Targeting ManageEngine Exploit CVE-2022-47966

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Technical Advisory: Various Threat Actors Targeting ManageEngine Exploit CVE-2022-47966

Earth Kitsune Delivers New WhiskerSpy Backdoor via Watering Hole Attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Kitsune Delivers New WhiskerSpy Backdoor via Watering Hole Attack

취약한 Innorix 악용한 악성코드 유포 - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 취약한 Innorix 악용한 악성코드 유포 - ASEC

#StopRansomware: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor #StopRansomware: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities | CISA

CSA_RANSOMWARE_ATTACKS_ON_CI_FUND_DPRK_ACTIVITIES.PDF

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CSA_RANSOMWARE_ATTACKS_ON_CI_FUND_DPRK_ACTIVITIES.PDF

WithSecure-Lazarus-No-Pineapple-Threat-Intelligence-Report-2023.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor WithSecure-Lazarus-No-Pineapple-Threat-Intelligence-Report-2023.pdf

eset_apt_activity_report_t32022.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eset_apt_activity_report_t32022.pdf

TA444- The APT Startup Aimed at Acquisition (of Your Funds)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor TA444- The APT Startup Aimed at Acquisition (of Your Funds)

TA444: APT Startup Aimed at Acquisition (of Your Funds) | Proofpoint US

Malpedia library date Proofpoint fromORKLCCS '25 data

Archived copy on ORKL Detailsfor TA444: APT Startup Aimed at Acquisition (of Your Funds) | Proofpoint US

Emulating the Highly Sophisticated North Korean Adversary Lazarus Group

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Emulating the Highly Sophisticated North Korean Adversary Lazarus Group

Emulating the Highly Sophisticated North Korean Adversary Lazarus Group – Part 1

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emulating the Highly Sophisticated North Korean Adversary Lazarus Group – Part 1

The DPRK delicate sound of cyber

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The DPRK delicate sound of cyber

The DPRK delicate sound of cyber

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The DPRK delicate sound of cyber

DTrack activity targeting Europe and Latin America

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DTrack activity targeting Europe and Latin America

Operation-Blockbuster-Report

date ORKL added it fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation-Blockbuster-Report

Analysis of LilithBot Malware and Eternity Threat Group | Zscaler

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis of LilithBot Malware and Eternity Threat Group | Zscaler

Hunting for Unsigned DLLs to Find APTs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hunting for Unsigned DLLs to Find APTs

Hunting for Unsigned DLLs to Find APTs

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Hunting for Unsigned DLLs to Find APTs

Lazarus and the tale of three RATs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lazarus and the tale of three RATs

MagicRAT: Lazarus’ latest gateway into victim networks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MagicRAT: Lazarus’ latest gateway into victim networks

Lazarus APT Group (APT38) - Brandefense

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lazarus APT Group (APT38) - Brandefense

Andariel deploys DTrack and Maui ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Andariel deploys DTrack and Maui ransomware

Andariel deploys DTrack and Maui ransomware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Andariel deploys DTrack and Maui ransomware

North Korean H0lyGh0st Ransomware Has Ties to Global Geopolitics

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor North Korean H0lyGh0st Ransomware Has Ties to Global Geopolitics

H0lyGh0st - North Korean Threat Group Strikes Back With New Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor H0lyGh0st - North Korean Threat Group Strikes Back With New Ransomware

LofyLife- malicious npm packages steal Discord tokens and bank card data

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor LofyLife- malicious npm packages steal Discord tokens and bank card data

Anatomy of Attack- Truth Behind the Costa Rica Government Ransomware 5-Day Intrusion

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Anatomy of Attack- Truth Behind the Costa Rica Government Ransomware 5-Day Intrusion

North Korean threat actor (H0lyGh0st -DEV-0530) targets small and midsize businesses with H0lyGh0st ransomware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor North Korean threat actor (H0lyGh0st -DEV-0530) targets small and midsize businesses with H0lyGh0st ransomware

North Korean threat actor targets small and midsize businesses with H0lyGh0st ransomware | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor North Korean threat actor targets small and midsize businesses with H0lyGh0st ransomware | Microsoft Security Blog

New Ransomware Groups on the Rise: Key Trends and Threats

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Ransomware Groups on the Rise: Key Trends and Threats

YamaBot Malware Used by Lazarus - JPCERT/CC Eyes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor YamaBot Malware Used by Lazarus - JPCERT/CC Eyes

Report: Maui ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Report: Maui ransomware

North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector | CISA

aa22-187a-north-korean%20state-sponsored-cyber-actors-use-maui-ransomware-to-target-the-hph-sector.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor aa22-187a-north-korean%20state-sponsored-cyber-actors-use-maui-ransomware-to-target-the-hph-sector.pdf

VSingle malware that obtains C2 server information from GitHub - JPCERT/CC Eyes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor VSingle malware that obtains C2 server information from GitHub - JPCERT/CC Eyes

Hydra with Three Heads- BlackByte & The Future of Ransomware Subsidiary Groups

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Hydra with Three Heads- BlackByte & The Future of Ransomware Subsidiary Groups

An Overview of the Increasing Wiper Malware Threat | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor An Overview of the Increasing Wiper Malware Threat | FortiGuard Labs

yir-cyber-threats-annex-download.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor yir-cyber-threats-annex-download.pdf

An Overview of the Increasing Wiper Malware Threat

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor An Overview of the Increasing Wiper Malware Threat

yir-cyber-threats-report-download.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor yir-cyber-threats-report-download.pdf

Stonefly- North Korea-linked Spying Operation Continues to Hit High-value Targets

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Stonefly- North Korea-linked Spying Operation Continues to Hit High-value Targets

Stonefly: North Korea-linked Spying Operation Continues to Hit High-value Targets

date in the CCS '25 data Symantec fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Stonefly: North Korea-linked Spying Operation Continues to Hit High-value Targets

Stonefly: North Korea-linked Spying Operation Continues to Hit High-value Targets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Stonefly: North Korea-linked Spying Operation Continues to Hit High-value Targets

Enter KaraKurt- Data Extortion Arm of Prolific Ransomware Group

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Enter KaraKurt- Data Extortion Arm of Prolific Ransomware Group

North Korea- Intelligence Assessment 2022

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor North Korea- Intelligence Assessment 2022

Countering threats from North Korea

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Countering threats from North Korea

Countering threats from North Korea

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Countering threats from North Korea

Not So Lazarus- Mapping DPRK Cyber Threat Groups to Government Organizations

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Not So Lazarus- Mapping DPRK Cyber Threat Groups to Government Organizations

Establishing the TigerRAT and TigerDownloader malware families

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor Establishing the TigerRAT and TigerDownloader malware families

Establishing the TigerRAT and TigerDownloader malware families | Threatray

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Establishing the TigerRAT and TigerDownloader malware families | Threatray

Tropic Trooper Targets Transportation and Government Organizations

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tropic Trooper Targets Transportation and Government Organizations

TigerRAT – Advanced Adversaries on the Prowl

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TigerRAT – Advanced Adversaries on the Prowl

Nowhere to Hide- Detecting SILENT CHOLLIMA’s Custom Tooling

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Nowhere to Hide- Detecting SILENT CHOLLIMA’s Custom Tooling

Lazarus-%EA%B7%B8%EB%A3%B9%EC%9D%98-NukeSped-%EC%95%85%EC%84%B1%EC%BD%94%EB%93%9C-%EB%B6%84%EC%84%9D-%EB%B3%B4%EA%B3%A0%EC%84%9C.pdf

Malpedia library date AhnLab, Inc. fromORKL

Archived copy on ORKL Detailsfor Lazarus-%EA%B7%B8%EB%A3%B9%EC%9D%98-NukeSped-%EC%95%85%EC%84%B1%EC%BD%94%EB%93%9C-%EB%B6%84%EC%84%9D-%EB%B3%B4%EA%B3%A0%EC%84%9C.pdf

Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf

Malpedia library date Kaspersky fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf

APT trends report Q3 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q3 2021

APT trends report Q3 2021

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT trends report Q3 2021

VB2021 paper: Multi-universe of adversary: multiple campaigns of Lazarus group and its connection

Malpedia library date Seongsu Park fromORKL

Archived copy on ORKL Detailsfor VB2021 paper: Multi-universe of adversary: multiple campaigns of Lazarus group and its connection

APT_trends_report_Q2_2021_Securelist

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT_trends_report_Q2_2021_Securelist

Report2021ThreatHunting

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Report2021ThreatHunting

filedownload.do?attach_file_seq=3277&attach_file_id=EpF3277.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor filedownload.do?attach_file_seq=3277&attach_file_id=EpF3277.pdf

North Korean Cyberattacks A Dangerous and Evolving Threat 2

date in the CCS '25 data Heritage.org fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor North Korean Cyberattacks A Dangerous and Evolving Threat 2

The Incredible Rise of DPRK’s Cyber Warfare

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Incredible Rise of DPRK’s Cyber Warfare

Secret -Backdoor- Behind Conti Ransomware Operation- Introducing Atera Agent

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Secret -Backdoor- Behind Conti Ransomware Operation- Introducing Atera Agent

InSideCopy: How this APT continues to evolve its arsenal

Malpedia library date Talos fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor InSideCopy: How this APT continues to evolve its arsenal

Ransomware-&-CVE- Industry Insights Into Exclusive High-Value Target Adversarial Datasets

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Ransomware-&-CVE- Industry Insights Into Exclusive High-Value Target Adversarial Datasets

Andariel evolves to target South Korea with ransomware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Andariel evolves to target South Korea with ransomware

Andariel evolves to target South Korea with ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Andariel evolves to target South Korea with ransomware

From QBot...with REvil Ransomware- Initial Attack Exposure of JBS

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor From QBot...with REvil Ransomware- Initial Attack Exposure of JBS

Rising warning- APT organizes Lazarus Group to launch an attack on China

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Rising warning- APT organizes Lazarus Group to launch an attack on China

From Dawn to -Silent Night-- -DarkSide Ransomware- Initial Attack Vector Evolution

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor From Dawn to -Silent Night-- -DarkSide Ransomware- Initial Attack Vector Evolution

奇安信威胁情报中心

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 奇安信威胁情报中心

CryptoCore-Lazarus-Clearsky

Malpedia library date Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor CryptoCore-Lazarus-Clearsky

Lazarus APT conceals malicious code within BMP image to drop its RAT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lazarus APT conceals malicious code within BMP image to drop its RAT

Adversary Dossier- Ryuk Ransomware Anatomy of an Attack in 2021

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Adversary Dossier- Ryuk Ransomware Anatomy of an Attack in 2021

Lazarus BTC Changer Back in action with JS sniffers redesigned to steal crypto

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Lazarus BTC Changer Back in action with JS sniffers redesigned to steal crypto

mtrends-2021

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor mtrends-2021

Lazarus Attack Activities Targeting Japan (VSingle/ValeforBeta) - JPCERT/CC Eyes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lazarus Attack Activities Targeting Japan (VSingle/ValeforBeta) - JPCERT/CC Eyes

Kaspersky-ICS-CERT-Lazarus-targets-defense-industry-with-Threatneedle-En.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor Kaspersky-ICS-CERT-Lazarus-targets-defense-industry-with-Threatneedle-En.pdf

Cyber Threats 2020: A Year in Retrospect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Threats 2020: A Year in Retrospect

Lazarus targets defense industry with ThreatNeedle

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lazarus targets defense industry with ThreatNeedle

kaspersky-ics-cert-lazarus-targets-defense-industry-with-threatneedle-en-20210225

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor kaspersky-ics-cert-lazarus-targets-defense-industry-with-threatneedle-en-20210225

Lazarus targets defense industry with ThreatNeedle

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Lazarus targets defense industry with ThreatNeedle

eu-20-Rivera-From-Zero-To-Sixty-The-Story-Of-North-Koreas-Rapid-Ascent-To-Becoming-A-Global-Cyber-Superpower.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eu-20-Rivera-From-Zero-To-Sixty-The-Story-Of-North-Koreas-Rapid-Ascent-To-Becoming-A-Global-Cyber-Superpower.pdf

APT annual review: What the world’s threat actors got up to in 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT annual review: What the world’s threat actors got up to in 2020

钱包黑洞：Lazarus 组织近期在加密货币方面的隐蔽攻击活动

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor 钱包黑洞：Lazarus 组织近期在加密货币方面的隐蔽攻击活动

Hacking Farm to Table- Threat Hunters Uncover Rise in Attacks Against Agriculture

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Hacking Farm to Table- Threat Hunters Uncover Rise in Attacks Against Agriculture

Lazarus supply‑chain attack in South Korea

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Lazarus supply‑chain attack in South Korea

Lazarus supply-chain attack in South Korea

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lazarus supply-chain attack in South Korea

APT trends report Q3 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q3 2020

The many personalities of Lazarus

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The many personalities of Lazarus

VB2020-46.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor VB2020-46.pdf

The BLINDINGCAN RAT and Malicious North Korean Activity

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The BLINDINGCAN RAT and Malicious North Korean Activity

The BLINDINGCAN RAT and Malicious North Korean Activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The BLINDINGCAN RAT and Malicious North Korean Activity

VB2020-18.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor VB2020-18.pdf

Breaking-trust-Shades-of-crisis-across-an-insecure-software-supply-chain.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Breaking-trust-Shades-of-crisis-across-an-insecure-software-supply-chain.pdf

APT trends report Q2 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q2 2020

CryptoCore – Cryptocurrency Exchanges Under Attack

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor CryptoCore – Cryptocurrency Exchanges Under Attack

CryptoCore

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CryptoCore

CryptoCore Group – ClearSky Cyber Security

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CryptoCore Group – ClearSky Cyber Security

APT trends report Q1 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q1 2020

ASEC_REPORT_vol.98_ENG

date in the CCS '25 data AhnLab fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ASEC_REPORT_vol.98_ENG

Cyber Threats 2019: A Year in Retrospect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Threats 2019: A Year in Retrospect

Lexfo-WhitePaper-The_Lazarus_Constellation

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Lexfo-WhitePaper-The_Lazarus_Constellation

DPRK Hidden Cobra Update: North Korean Malicious Cyber Activity - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DPRK Hidden Cobra Update: North Korean Malicious Cyber Activity - SentinelLabs

DPRK Hidden Cobra Update- North Korean Malicious Cyber Activity

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor DPRK Hidden Cobra Update- North Korean Malicious Cyber Activity

The ICS Threat Landscape and Activity Groups

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor The ICS Threat Landscape and Activity Groups

Lexfo-WhitePaper-The_Lazarus_Constellation.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lexfo-WhitePaper-The_Lazarus_Constellation.pdf

MAR-10265965-1.v1 – North Korean Trojan: BISTROMATH | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MAR-10265965-1.v1 – North Korean Trojan: BISTROMATH | CISA

Operation AppleJeus Sequel

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Operation AppleJeus Sequel

Operation AppleJeus Sequel

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation AppleJeus Sequel

Operation AppleJeus Sequel

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation AppleJeus Sequel

North American Electric Cyber Threat Perspective

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor North American Electric Cyber Threat Perspective

Microsoft Word - Threat Intelligence and the Limits of Malware Analysis_smc1.docx

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Word - Threat Intelligence and the Limits of Malware Analysis_smc1.docx

[CB19] Cyber Threat Landscape in Japan – Revealing Threat in the Shadow by Chi En Shen (Ashley) Oleg Bondarenko

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor [CB19] Cyber Threat Landscape in Japan – Revealing Threat in the Shadow by Chi En Shen (Ashley) Oleg Bondarenko

Lazarus Group Goes 'Fileless'

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Lazarus Group Goes 'Fileless'

Operation ENDTRADE: Multi-Stage Backdoors that TICK

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Operation ENDTRADE: Multi-Stage Backdoors that TICK

Dtrack: In-depth analysis of APT on a nuclear power plant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dtrack: In-depth analysis of APT on a nuclear power plant

Wikipedia Entry on Equation Group

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Wikipedia Entry on Equation Group

Is LazarusAPT38 Targeting Critical Infrastructures

date in the CCS '25 data Marco Ramilli's Blog fromCCS '25 data

Detailsfor Is LazarusAPT38 Targeting Critical Infrastructures

Let's Learn- Dissecting Lazarus Windows x86 Loader Involved in Crypto Trading App Distribution- -snowman- & ADVObfuscator

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Let's Learn- Dissecting Lazarus Windows x86 Loader Involved in Crypto Trading App Distribution- -snowman- & ADVObfuscator

Pass the AppleJeus

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Pass the AppleJeus

20191004_Kimsuky Group - Track the King of the Spear-Phishing_PUB

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 20191004_Kimsuky Group - Track the King of the Spear-Phishing_PUB

Hello! My name is Dtrack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hello! My name is Dtrack

GitHub - werkamsus/Lilith: Lilith - Foundational reverse engineering resource for cybersecurity entrepreneurs in C++

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GitHub - werkamsus/Lilith: Lilith - Foundational reverse engineering resource for cybersecurity entrepreneurs in C++

[Analysis]Andariel_Group.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor [Analysis]Andariel_Group.pdf

Dragos - Global Oil and Gas Cyber Threat Perspctive

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Dragos - Global Oil and Gas Cyber Threat Perspctive

ClearSky-2019-H1-Cyber-Events-Summary-Report.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ClearSky-2019-H1-Cyber-Events-Summary-Report.pdf

Threat Group Cards: A Threat Actor Encyclopedia

file creation date ThaiCERT fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Threat Group Cards: A Threat Actor Encyclopedia

Threat Group Cards: A Threat Actor Encyclopedia

file creation date Martijn van der Heide fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia

Cryptocurrency businesses still being targeted by Lazarus

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cryptocurrency businesses still being targeted by Lazarus

Cryptocurrency businesses still being targeted by Lazarus

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Cryptocurrency businesses still being targeted by Lazarus

Daily Ruleset Update Summary 2019-03-14

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Daily Ruleset Update Summary 2019-03-14

Report2019GlobalThreatReport

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Report2019GlobalThreatReport

The Advanced Persistent Threat files: Lazarus Group | Malwarebytes Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Advanced Persistent Threat files: Lazarus Group | Malwarebytes Labs

The Advanced Persistent Threat files- Lazarus Group

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Advanced Persistent Threat files- Lazarus Group

CrowdStrike_GTR_2019.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor CrowdStrike_GTR_2019.pdf

CrowdStrike_GTR_2019_.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor CrowdStrike_GTR_2019_.pdf

yir-ics-activity-groups-threat-landscape-2018.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor yir-ics-activity-groups-threat-landscape-2018.pdf

Since the hacking of Sony Pictures

file creation date fromORKL

Archived copy on ORKL Detailsfor Since the hacking of Sony Pictures

rpt-apt38-2018-web_v5-1.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor rpt-apt38-2018-web_v5-1.pdf

rpt-apt38-2018-web_v4

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor rpt-apt38-2018-web_v4

VB2018-Kalnai-Poslusny-branded-REFS-AT-END-updatedref29.indd

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor VB2018-Kalnai-Poslusny-branded-REFS-AT-END-updatedref29.indd

Operation_AppleJeus

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation_AppleJeus

Lazarus Group Deploys Its First Mac Malware in Cryptocurrency Exchange Hack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lazarus Group Deploys Its First Mac Malware in Cryptocurrency Exchange Hack

Operation AppleJeus- Lazarus hits cryptocurrency exchange with fake installer and macOS malware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Operation AppleJeus- Lazarus hits cryptocurrency exchange with fake installer and macOS malware

Lazarus Group Deploys Its First Mac Malware in Cryptocurrency Exchange Hack

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Lazarus Group Deploys Its First Mac Malware in Cryptocurrency Exchange Hack

Operation AppleJeus: Lazarus hits cryptocurrency exchange with fake installer and macOS malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation AppleJeus: Lazarus hits cryptocurrency exchange with fake installer and macOS malware

Examining Code Reuse Reveals Undiscovered Links Among North Korea’s Malware Families | McAfee Blogs

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Examining Code Reuse Reveals Undiscovered Links Among North Korea’s Malware Families | McAfee Blogs

New Andariel Reconnaissance Tactics Hint At Next Targets - TrendLabs Security Intelligence Blog

date in the CCS '25 data IssueMakersLab fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor New Andariel Reconnaissance Tactics Hint At Next Targets - TrendLabs Security Intelligence Blog

New Andariel Reconnaissance Tactics Uncovered

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Andariel Reconnaissance Tactics Uncovered

Full Discloser of Andariel, A Subgroup of Lazarus Threat Group

Malpedia library date AhnLab fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Full Discloser of Andariel, A Subgroup of Lazarus Threat Group

Dissecting Operation Troy: Cyberespionage in South Korea White Paper

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Dissecting Operation Troy: Cyberespionage in South Korea White Paper

North Korean Hackers Are up to No Good Again

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor North Korean Hackers Are up to No Good Again

North Korean Hackers Are up to No Good Again

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor North Korean Hackers Are up to No Good Again

Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide

Analyzing Operation GhostSecret- Attack Seeks to Steal Data Worldwide

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Analyzing Operation GhostSecret- Attack Seeks to Steal Data Worldwide

MAR-10135536.11.WHITE.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MAR-10135536.11.WHITE.pdf

Lazarus Under The Hood

Malpedia library date Kaspersky fromORKL

Archived copy on ORKL Detailsfor Lazarus Under The Hood

Industrial Control System Threats

Malpedia library date Dragos fromORKL

The original link failed its last check. Original publisher Detailsfor Industrial Control System Threats

LazarusUnderTheHood_PDF_final_for_securelist.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor LazarusUnderTheHood_PDF_final_for_securelist.pdf

Attacks Leveraging Adobe Zero-Day (CVE-2018-4878) – Threat Attribution, Attack Scenario and Recommendations

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Attacks Leveraging Adobe Zero-Day (CVE-2018-4878) – Threat Attribution, Attack Scenario and Recommendations

North Korea Is Not Crazy

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor North Korea Is Not Crazy

2017 HITB A Deep Dive_release

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor 2017 HITB A Deep Dive_release

North Korea Is Not Crazy

date in the CCS '25 data Recorded Future fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor North Korea Is Not Crazy

Group-IB_Lazarus

Malpedia library date Group-IB fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Group-IB_Lazarus

IssueMakersLab - Cyber Warfare Research Team

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor IssueMakersLab - Cyber Warfare Research Team

The Blockbuster Sequel

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Blockbuster Sequel

The Blockbuster Sequel

date in the CCS '25 data Palo Alto Networks fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor The Blockbuster Sequel

The Blockbuster Sequel

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Blockbuster Sequel

[HackCon] Silent Rifle Response Against Advanced Threat

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor [HackCon] Silent Rifle Response Against Advanced Threat

OurMine

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor OurMine

Bartholomew-GuerreroSaade-VB2016.indd

Malpedia library date Kaspersky fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Bartholomew-GuerreroSaade-VB2016.indd

The Shadow Brokers

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Shadow Brokers

PowerPoint Presentation

date in the CCS '25 data CrowdStrike fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor PowerPoint Presentation

Tracing the Lineage of DarkSeoul

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Tracing the Lineage of DarkSeoul

Operation Blockbuster Coalition Ties Destructive Attacks to Lazarus Group

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Blockbuster Coalition Ties Destructive Attacks to Lazarus Group

Operation Blockbuster

date in the CCS '25 data Novetta fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Operation Blockbuster

Russian Police Prevented Massive Banking Sector Cyber Attack

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Russian Police Prevented Massive Banking Sector Cyber Attack

15GlobalThreatReport.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor 15GlobalThreatReport.pdf

FROM SEOUL TO SONY: THE HISTORY OF THE DARKSEOUL GROUP AND THE SONY INTRUSION MALWARE DESTOVER

Malpedia library date Bluecoat fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor FROM SEOUL TO SONY: THE HISTORY OF THE DARKSEOUL GROUP AND THE SONY INTRUSION MALWARE DESTOVER

Know Your Enemies 2.0: A Primer on Advanced Persistent Threat Groups

file creation date ICIT fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Know Your Enemies 2.0: A Primer on Advanced Persistent Threat Groups

TDrop2 Attacks Suggest Dark Seoul Attackers Return - Palo Alto Networks BlogPalo Alto Networks Blog

date in the CCS '25 data Palo Alto fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor TDrop2 Attacks Suggest Dark Seoul Attackers Return - Palo Alto Networks BlogPalo Alto Networks Blog

WORLD WAR C : Understanding Nation-State Motives Behind Today’s Advanced Cyber Attacks

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor WORLD WAR C : Understanding Nation-State Motives Behind Today’s Advanced Cyber Attacks

Profiling An Enigma: The Mystery Of North Korea's Cyber Threat Landscape

date in the CCS '25 data HP fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Profiling An Enigma: The Mystery Of North Korea's Cyber Threat Landscape

Hacking Team

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Hacking Team

Cisco - Annual Security Report - 2014.pdf

file creation date fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Cisco - Annual Security Report - 2014.pdf

World War C: Understanding Nation-State Motives Behind Today's Advanced Cyber Attacks

file creation date FireEye fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor World War C: Understanding Nation-State Motives Behind Today's Advanced Cyber Attacks

CrowdCasts Monthly- You Have an Adversary Problem

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor CrowdCasts Monthly- You Have an Adversary Problem

CrowdCasts Monthly: You Have an Adversary Problem

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor CrowdCasts Monthly: You Have an Adversary Problem

Dissecting Operation Troy: Cyberespionage In South Korea

file creation date McAfee fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Dissecting Operation Troy: Cyberespionage In South Korea

Dark Seoul Cyber Attack: Could It Be Worse?

file creation date Dongseo University fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Dark Seoul Cyber Attack: Could It Be Worse?

Dark_Seoul_Cyberattack

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Dark_Seoul_Cyberattack

Four Years of DarkSeoul Cyberattacks Against South Korea Continue on Anniversary of Korean War

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Four Years of DarkSeoul Cyberattacks Against South Korea Continue on Anniversary of Korean War

Four Years of DarkSeoul Cyberattacks Against South Korea Continue on Anniversary of Korean War

Malpedia library date fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor Four Years of DarkSeoul Cyberattacks Against South Korea Continue on Anniversary of Korean War

Fidelis Threat Advisory 1008 - Darkseoul-Jokra Analysis and Recovery

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Fidelis Threat Advisory 1008 - Darkseoul-Jokra Analysis and Recovery

PLA Unit 61398

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor PLA Unit 61398

“Red October” – Part Two, the Modules

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor “Red October” – Part Two, the Modules

Syrian Electronic Army

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Syrian Electronic Army