APT Explorer

All actors

APT20

Also reported as TH3Bug, Crawling Taurus, VIOLIN PANDA, RIDGE CASTLE, APT 20 and 2 other names. Linked to China by three sources.

Reports
181
Last reported
Known CVEs
144
Origin
China
ID
apt20
Sources
MISPETDAMalpedia
Merge evidence
9 alias matches

Reports per quarter

Dated reports, 2013 Q1 to 2026 Q2.

Techniques seen in the last two years

Show all 38 techniques Show fewer

Counts come from technique IDs in the actor's report text.

CVEs named in reports

Show all 144 CVEs Show fewer

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

  1. Threat Group Cards: A Threat Actor Encyclopedia

    date ORKL added it ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  2. Threat Group Cards: A Threat Actor Encyclopedia

    date ORKL added it ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  3. China-based APT Mustang Panda might still have continued their attack activities against organizations in

    date ORKL added it ORKL

    Archived copy on ORKL Details

  4. Living off the Land - Threat Group Cards: A Threat Actor Encyclopedia

    date ORKL added it ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  5. Poison Ivy (Malware Family)

    date ORKL added it ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  6. Accenture | Let there be change

    date ORKL added it ORKL

    Archived copy on ORKL Details

  7. Axiom, Group 72 - Threat Group Cards: A Threat Actor Encyclopedia

    date ORKL added it ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  8. Accenture | Let there be change

    date ORKL added it ORKL

    Archived copy on ORKL Details

  9. Recent Watering Hole Attacks Attributed to APT Group “th3bug” Using Poison Ivy

    date ORKL added it ORKL

    Archived copy on ORKL Details

  10. PlugX : Mustang Panda APT

    Malpedia library date ORKL

    Archived copy on ORKL Details

Show all 181 reports Show fewer

  1. PlugX Meeting Invitation via MSBuild and GDATA

    Malpedia library date ORKL

    Archived copy on ORKL Details

  2. The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor

    Malpedia library date ORKL

    Archived copy on ORKL Details

  3. UNC6384 Weaponizes ZDI-CAN-25373 Vulnerability to Deploy PlugX Against Hungarian and Belgian Diplomatic Entities - Arctic Wolf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  4. PRC-Nexus Espionage Campaign Hijacks Web Traffic to Target Diplomats

    Malpedia library date ORKL

    Archived copy on ORKL Details

  5. Updated Shadowpad Malware Leads to Ransomware Deployment

    Malpedia library date ORKL

    Archived copy on ORKL Details

  6. Meet NailaoLocker: a ransomware distributed in Europe by ShadowPad and PlugX backdoors

    Malpedia library date ORKL

    Archived copy on ORKL Details

  7. Updated Shadowpad Malware Leads to Ransomware Deployment

    Malpedia library date ORKL

    Archived copy on ORKL Details

  8. China-linked Espionage Tools Used in Ransomware Attacks

    Malpedia library date ORKL

    Archived copy on ORKL Details

  9. CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia

    Malpedia library date ORKL

    Archived copy on ORKL Details

  10. Justice Department and FBI Conduct International Operation to Delete Malware Used by China-Backed Hackers

    Malpedia library date ORKL

    Archived copy on ORKL Details

  11. Chinese State-Sponsored RedDelta Targeted Taiwan, Mongolia, and Southeast Asia with Adapted PlugX Infection Chain

    Malpedia library date ORKL

    Archived copy on ORKL Details

  12. Unmasking Adversary Infrastructure: How Certificates and Redirects Exposed Earth Baxia and PlugX Activity

    Malpedia library date ORKL

    Archived copy on ORKL Details

  13. Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  14. DragonRank, a Chinese-speaking SEO manipulator service provider

    Malpedia library date ORKL

    Archived copy on ORKL Details

  15. Sailing_the_Seven_SEAs_Deep_Dive_into_Polaris_Arsenal_and_Intelligence_Insights.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  16. China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence

    Malpedia library date ORKL

    Archived copy on ORKL Details

  17. Operation Diplomatic Specter: An Active Chinese Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia

    Malpedia library date ORKL

    Archived copy on ORKL Details

  18. Finding Malware: Detecting SOGU with Google Security Operations.

    Malpedia library date ORKL

    Archived copy on ORKL Details

  19. Wirtschaftsspionage gegen Volkwagen: VW-Konzern wurde jahrelang ausge…

    Malpedia library date ORKL

    The title opens archive.today, not the publisher’s page. Archived copy on ORKL Details

  20. Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks

    Malpedia library date ORKL

    Archived copy on ORKL Details

  21. The Secret Life of RATs: connecting the dots by dissecting multiple backdoors

    Malpedia library date ORKL

    Archived copy on ORKL Details

  22. PowerPoint 簡報

    Malpedia library date TeamT5 ORKL

    Archived copy on ORKL Details

  23. A Look into PlugX Kernel driver

    Malpedia library date ORKL

    Archived copy on ORKL Details

  24. Dark Pink APT unleashes malware for deeper and more sinister intrusions in the Asia-Pacific and Europe _ Group-IB Blog

    file creation date ORKL

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  25. 2023 Adversary Infrastructure Report

    Malpedia library date ORKL

    Archived copy on ORKL Details

  26. Unmasking the Enigma: A Historical Dive into the World of PlugX Malware | Splunk

    Malpedia library date ORKL

    Archived copy on ORKL Details

  27. Carderbee Targets Hong Kong in Supply Chain Attack

    Malpedia library date ORKL

    Archived copy on ORKL Details

  28. My Tea’s not cold. An overview of China’s cyber threat

    Malpedia library date ORKL

    Archived copy on ORKL Details

  29. Carderbee: APT Group use Legit Software in Supply Chain Attack Targeting Orgs in Hong Kong

    Malpedia library date ORKL

    Archived copy on ORKL Details

  30. RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale

    Malpedia library date ORKL

    Archived copy on ORKL Details

  31. The Spies Who Loved You: Infected USB Drives to Steal Secrets | Mandiant

    Malpedia library date ORKL

    Archived copy on ORKL Details

  32. Chinese Threat Actors Targeting Europe in SmugX Campaign

    Malpedia library date ORKL

    Archived copy on ORKL Details

  33. Lancefly: Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors

    Malpedia library date ORKL

    Archived copy on ORKL Details

  34. New Mustang Panda’s campaing against Australia

    Malpedia library date ORKL

    Archived copy on ORKL Details

  35. Botconf2022-19-FaouCoteCyr.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  36. With KEYPLUG, China’s RedGolf Spies On, Steals From Wide Field of Targets

    Malpedia library date ORKL

    Archived copy on ORKL Details

  37. PlugX Malware Being Distributed via Vulnerability Exploitation

    Malpedia library date ORKL

    Archived copy on ORKL Details

  38. Investigating the PlugX Trojan Disguised as a Legitimate Windows Debugger Tool

    Malpedia library date ORKL

    Archived copy on ORKL Details

  39. Mustang Panda APT Group Uses European Commission-Themed Lure to Deliver PlugX Malware

    Malpedia library date ORKL

    Archived copy on ORKL Details

  40. Chinese PlugX Malware Hidden in Your USB Devices?

    Malpedia library date ORKL

    Archived copy on ORKL Details

  41. JSAC2023_2_LT4.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  42. [QuickNote] Another nice PlugX sample

    Malpedia library date ORKL

    Archived copy on ORKL Details

  43. Diving into a PlugX sample of Mustang Panda group

    Malpedia library date ORKL

    Archived copy on ORKL Details

  44. RedDelta Targets European Government Organizations and Continues to Iterate Custom PlugX Variant

    Malpedia library date ORKL

    Archived copy on ORKL Details

  45. Secure Communications Blog

    Malpedia library date ORKL

    Archived copy on ORKL Details

  46. Hitching a ride with Mustang Panda

    Malpedia library date ORKL

    Archived copy on ORKL Details

  47. PlugXローダーの進化

    Malpedia library date ORKL

    Archived copy on ORKL Details

  48. Secure Communications Blog

    Malpedia library date ORKL

    Archived copy on ORKL Details

  49. Witchetty: Group Uses Updated Toolset in Attacks on Governments in Middle East

    Malpedia library date ORKL

    Archived copy on ORKL Details

  50. Hunting for Unsigned DLLs to Find APTs

    Malpedia library date ORKL

    Archived copy on ORKL Details

  51. Dissecting PlugX to Extract Its Crown Jewels

    Malpedia library date Ido Naor ORKL

    Archived copy on ORKL Details

  52. New Wave of Espionage Activity Targets Asian Governments

    Malpedia library date ORKL

    Archived copy on ORKL Details

  53. MustangPanda%20-%20Enemy%20at%20the%20gate_final.pdf

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  54. THREAT ANALYSIS REPORT: PlugX RAT Loader Evolution

    Malpedia library date ORKL

    Archived copy on ORKL Details

  55. Advanced Persistent Threats (APTs)

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  56. Attacks on industrial control systems using ShadowPad | Kaspersky ICS CERT EN

    Malpedia library date ORKL

    Archived copy on ORKL Details

  57. Operation Earth Berberoka: An Analysis of a Multivector and Multiplatform APT Campaign Targeting Online Gambling Sites

    Malpedia library date ORKL

    Archived copy on ORKL Details

  58. China-based APT Mustang Panda might still have continued their attack activities against organizations in

    Malpedia library date VinCSS ORKLCCS '25 data

    Archived copy on ORKL Details

  59. Space Pirates: analyzing the tools and connections of a new hacker group

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  60. HUI Loaderの分析 - JPCERT/CC Eyes

    Malpedia library date ORKL

    Archived copy on ORKL Details

  61. AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  62. Mustang Panda deploys a new wave of malware targeting Europe

    Malpedia library date ORKL

    Archived copy on ORKL Details

  63. Moshen Dragon’s Triad-and-Error Approach | Abusing Security Software to Sideload PlugX and ShadowPad

    Malpedia library date ORKL

    Archived copy on ORKL Details

  64. Chinese APT Bronze President Mounts Spy Campaign on Russian Military

    Malpedia library date ORKL

    Archived copy on ORKL Details

  65. yir-cyber-threats-annex-download.pdf

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  66. Botconf2022-40-LunghiHorejsi.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  67. https://documents.trendmicro.com/assets/txt/earth-berberoka-windows-iocs-2.txt

    Malpedia library date ORKL

    Archived copy on ORKL Details

  68. New APT Group Earth Berberoka Targets Gambling Websites With Old and New Malware

    Malpedia library date ORKL

    Archived copy on ORKL Details

  69. Hacking activity of SectorB Group in 2021 – Red Alert

    Malpedia library date ORKL

    Archived copy on ORKL Details

  70. Ghidra script to handle stack strings – Max Kersten

    Malpedia library date ORKL

    Archived copy on ORKL Details

  71. Mustang Panda's Hodur : Vieux trucs, nouvelle variante de Korplug

    Malpedia library date ORKL

    Archived copy on ORKL Details

  72. Chinese APT Combines Fresh Hodur RAT with Complex Anti-Detection

    Malpedia library date ORKL

    Archived copy on ORKL Details

  73. New Mustang Panda hacking campaign targets diplomats, ISPs

    Malpedia library date ORKL

    Archived copy on ORKL Details

  74. Mustang Panda’s Hodur: Old tricks, new Korplug variant

    Malpedia library date ORKL

    Archived copy on ORKL Details

  75. TA416: Activity, Techniques, & Targeting Explained | Proofpoint US

    Malpedia library date ORKL

    Archived copy on ORKL Details

  76. rt-apt41-dual-operation.pdf

    file creation date ORKL

    Archived copy on ORKL Details

  77. Adam Kozy Testimony

    Malpedia library date Adam Kozy ORKL

    Archived copy on ORKL Details

  78. A “GULP” of PlugX

    Malpedia library date ORKL

    Archived copy on ORKL Details

  79. Threat Spotlight: BlackMatter, LockBit, and THOR - Cisco Umbrella

    Malpedia library date ORKL

    Archived copy on ORKL Details

  80. Microsoft Word - exorcist whitepaper.docx

    Malpedia library date ORKL

    Archived copy on ORKL Details

  81. 4 Chinese APT Groups Identified Targeting Mail Server of Afghan Telecommunications Firm Roshan

    date in the CCS '25 data Recorded Future CCS '25 data

    The original link failed its last check. Details

  82. Indonesian intelligence agency compromised in suspected Chinese hack

    Malpedia library date ORKL

    Archived copy on ORKL Details

  83. Advanced Persistent Threats (APTs)

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  84. D1T1%20-%20%20ShadowPad%20-%20A%20Masterpiece%20of%20Privately%20Sold%20Malware%20in%20Chinese%20Espionage%20-%20Yi-Jhen%20Hsieh%20&%20Joey%20Chen.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  85. THOR: Previously Unseen PlugX Variant Deployed During Microsoft Exchange Server Attacks by PKPLUG Group

    Malpedia library date ORKL

    Archived copy on ORKL Details

  86. LuminousMoth – PlugX, File Exfiltration and Persistence Revisited

    Malpedia library date ORKL

    Archived copy on ORKL Details

  87. Threat Activity Group RedFoxtrot Linked to China’s PLA Unit 69010; Targets Bordering Asian Countries

    Malpedia library date ORKL

    Archived copy on ORKL Details

  88. RedDelta PlugX Undergoing Changes and Overlapping Again with Mustang Panda PlugX Infrastructure

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  89. Mustang Panda PlugX - 45.251.240.55 Pivot

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  90. PowerPoint 簡報

    Malpedia library date ORKL

    Archived copy on ORKL Details

  91. RedEcho group parks domains after public exposure

    Malpedia library date ORKL

    Archived copy on ORKL Details

  92. Exchange servers under siege from at least 10 APT groups

    Malpedia library date ORKL

    Archived copy on ORKL Details

  93. Malpedia Page for family Sidewinder

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  94. China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions

    Malpedia library date ORKL

    Archived copy on ORKL Details

  95. Cyber Threats 2020: A Year in Retrospect

    Malpedia library date ORKL

    Archived copy on ORKL Details

  96. Report2021GTR.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  97. Investigation into PlugX Uncovers Unique APT Technique

    Malpedia library date ORKL

    Archived copy on ORKL Details

  98. CRACKING A SOFT CELL IS HARDER THAN YOU THINK

    Malpedia library date ORKL

    Archived copy on ORKL Details

  99. Higaisa or Winnti? APT41 backdoors, old and new

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  100. China's APT hackers move to ransomware attacks

    Malpedia library date ORKL

    Archived copy on ORKL Details

  101. Operation StealthyTrident: corporate software under attack

    Malpedia library date ORKL

    Archived copy on ORKL Details

  102. APT group targeting governmental agencies in East Asia

    Malpedia library date ORKL

    Archived copy on ORKL Details

  103. Group-IB_Hi-Tech_Crime_Trends_2020-2021_en

    file creation date ORKL

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  104. TA416's Golang PlugX Malware Loader | Proofpoint US

    Malpedia library date ORKL

    Archived copy on ORKL Details

  105. PowerPoint Presentation

    file creation date Ganesan, Brittany (OS/ASA) (CTR) ORKL

    Archived copy on ORKL Details

  106. Weaponizing Open Source Software for Targeted Attacks

    Malpedia library date ORKL

    Archived copy on ORKL Details

  107. APT trends report Q3 2020

    Malpedia library date ORKL

    Archived copy on ORKL Details

  108. APT41: Indictments Put Chinese Espionage Group in the Spotlight

    Malpedia library date Symantec ORKLCCS '25 data

    Archived copy on ORKL Details

  109. Back Despite Disruption: RedDelta Resumes Operations

    Malpedia library date Insikt Group® ORKL

    Archived copy on ORKL Details

  110. Research Roundup: Activity on Previously Identified APT33 Domains | ThreatConnect

    Malpedia library date ThreatConnect ORKLCCS '25 data

    Archived copy on ORKL Details

  111. ESET_Threat_Report_Q22020.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  112. APT trends report Q2 2020

    Malpedia library date ORKL

    Archived copy on ORKL Details

  113. What even is Winnti? - Risky Business Media

    Malpedia library date ORKL

    Archived copy on ORKL Details

  114. Chinese state hackers target Hong Kong Catholic Church

    Malpedia library date ORKL

    Archived copy on ORKL Details

  115. Accenture | Let there be change

    Malpedia library date ORKL

    Archived copy on ORKL Details

  116. Cycldek: Bridging the (air) gap

    Malpedia library date ORKL

    Archived copy on ORKL Details

  117. Mustang Panda Recent Activity: Dll-Sideloading trojans with temporal C2 servers

    Malpedia library date ORKL

    Archived copy on ORKL Details

  118. The energy reserves in the Eastern Mediterranean Sea and a malicious campaign of APT10 against Turkey

    Malpedia library date Lab52 ORKLCCS '25 data

    Archived copy on ORKL Details

  119. COVID-19 Themes Are Being Utilized by Threat Actors of Varying Sophistication

    Malpedia library date ORKL

    Archived copy on ORKL Details

  120. Phân tích mã độc lợi dụng dịch Covid-19 để phát tán giả mạo “Chỉ thị của thủ tướng Nguyễn Xuân Phúc” - Phần

    Malpedia library date ORKL

    Archived copy on ORKL Details

  121. Is APT 27 Abusing COVID-19 To Attack People !

    date in the CCS '25 data Yoroi CCS '25 data

    The original link failed its last check. Details

  122. Phân tích mã độc lợi dụng dịch Covid-19 để phát tán giả mạo “Chỉ thị của thủ tướng Nguyễn Xuân Phúc” - Phần 1 - VinCSS Blog

    Malpedia library date ORKL

    Archived copy on ORKL Details

  123. the adversary playbook for the long-standing espionage activity of a Chinese nation-state adversary

    Malpedia library date ORKL

    Archived copy on ORKL Details

  124. Operation DRBControl: Uncovering a Cyberespionage Campaign Targeting Gambling Companies in Southeast Asia

    Malpedia library date ORKL

    Archived copy on ORKL Details

  125. CLAMBLING - A New Backdoor Base On Dropbox (EN)

    Malpedia library date ORKL

    Archived copy on ORKL Details

  126. 2020.02.22_APT_threat_report_2019_CN_version

    Malpedia library date ORKL

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  127. Reviving MuddyC3 Used by MuddyWater (IRAN) APT

    date in the CCS '25 data Shells.Systems ORKLCCS '25 data

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  128. Microsoft Word - Threat Intelligence and the Limits of Malware Analysis_smc1.docx

    Malpedia library date ORKL

    Archived copy on ORKL Details

  129. 201912_Report_Operation_Wacao

    date in the CCS '25 data Fox-IT ORKLCCS '25 data

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  130. Fresh PlugX October 2019

    Malpedia library date ORKL

    Archived copy on ORKL Details

  131. APT cases exploiting vulnerabilities in region‑specific software

    Malpedia library date ORKL

    Archived copy on ORKL Details

  132. Analytics

    Malpedia library date Positive Technologies ORKLCCS '25 data

    The original link failed its last check. Original publisher Details

  133. Shikata Ga Nai Encoder Still Going Strong

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  134. Shikata Ga Nai Encoder Still Going Strong | Mandiant

    Malpedia library date ORKL

    Archived copy on ORKL Details

  135. New threat group behind Airbus cyber attacks, claim researchers

    Malpedia library date ORKL

    Archived copy on ORKL Details

  136. PKPLUG: Chinese Cyber Espionage Group Attacking Southeast Asia

    Malpedia library date ORKL

    Archived copy on ORKL Details

  137. APT41: A Dual Espionage and Cyber Crime Operation

    file creation date FireEye ORKL

    The link to Mirror on Box failed its last check. Mirror on Box Details

  138. APT-41.pdf

    file creation date ORKL

    Archived copy on ORKL Details

  139. report_APT41

    file creation date ORKL

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  140. Into the Fog - The Return of ICEFOG APT

    Malpedia library date ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  141. Uncovering New Activity By APT10 | FortiGuard Labs

    Malpedia library date ORKL

    Archived copy on ORKL Details

  142. “Filesnfer” Tool (C#, Python) – One Night in Norfolk

    Malpedia library date ORKL

    Archived copy on ORKL Details

  143. rpt-mtrends-2019.pdf

    file creation date ORKL

    The original link failed its last check. Original publisher Details

  144. SectorM04 Targeting Singapore – An Analysis – Red Alert

    Malpedia library date ORKL

    Archived copy on ORKL Details

  145. rpt-mtrends-2019

    file creation date ORKL

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  146. Operation Red Signature Targets South Korean Companies

    Malpedia library date ORKL

    Archived copy on ORKL Details

  147. Malicious document targets Vietnamese officials

    Malpedia library date ORKL

    Archived copy on ORKL Details

  148. Malware Analysis – PlugX – Part 2

    Malpedia library date ORKL

    Archived copy on ORKL Details

  149. Time of death? A therapeutic postmortem of connected medicine

    Malpedia library date ORKL

    Archived copy on ORKL Details

  150. Malware Analysis – PlugX

    Malpedia library date ORKL

    Archived copy on ORKL Details

  151. PlugXと攻撃者グループ "DragonOK"の関連性 | LAC WATCH

    Malpedia library date ORKL

    Archived copy on ORKL Details

  152. Advanced Persistent Threat Groups

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  153. Paranoid PlugX

    Malpedia library date ORKL

    Archived copy on ORKL Details

  154. Intrusions Affecting Multiple Victims Across Multiple Sectors | CISA

    Malpedia library date ORKL

    Archived copy on ORKL Details

  155. RedLeaves - Malware Based on Open Source RAT - JPCERT/CC Eyes

    Malpedia library date ORKL

    Archived copy on ORKL Details

  156. Unpacking the spyware disguised as antivirus | Malwarebytes Labs

    Malpedia library date ORKL

    Archived copy on ORKL Details

  157. security_report_20160613.pdf

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  158. Ever Present Persistence - Established Footholds Seen in the Wild

    Malpedia library date ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  159. Targeted Attack Distributes PlugX in Russia | Proofpoint US

    Malpedia library date ORKL

    Archived copy on ORKL Details

  160. HTExploitTelemetry

    Malpedia library date FireEye ORKLCCS '25 data

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  161. Uncovering the Seven Pointed Dagger

    Malpedia library date Arbor Networks ORKLCCS '25 data

    The link to Mirror on Box failed its last check. Mirror on Box Details

  162. Microsoft Word - 2015-02-XX -Scanbox II - TLPWHITE.docx

    date in the CCS '25 data PWC ORKLCCS '25 data

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  163. Recent Watering Hole Attacks Attributed to APT Group “th3bug” Using Poison Ivy

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  164. Recent Watering Hole Attacks Attributed to APT Group “th3bug” Using Poison Ivy - Palo Alto Networks BlogPalo Alto Networks Blog

    date in the CCS '25 data Palo Alto ORKLCCS '25 data

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  165. Recent Watering Hole Attacks Attributed to APT Group “th3bug” Using Poison Ivy

    Malpedia library date ORKL

    Archived copy on ORKL Details

  166. Poison Ivy Malware Analysis | FireEye

    file creation date ORKL

    Archived copy on ORKL Details

  167. Poison Ivy Malware Analysis | FireEye

    file creation date ORKL

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  168. Poison Ivy: Assessing Damage And Extracting Intelligence

    file creation date FireEye ORKL

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  169. CrowdCasts Monthly: You Have an Adversary Problem

    Malpedia library date ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  170. PIVY-Appendix

    file creation date ORKL

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  171. BKDR_RARSTONE: New RAT to Watch Out For - TrendLabs Security Intelligence Blog

    Malpedia library date ORKL

    The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Details

Newest first. Details opens the report in Explore.