CeranaKeeper

Reports per quarter

Techniques seen in the last two years

• T1005 1 report
• T1036.005 1 report
• T1039 1 report
• T1071.001 1 report
• T1072 1 report
• T1074.001 1 report
• T1090.001 1 report
• T1102.002 1 report
• T1132.002 1 report
• T1140 1 report

Counts come from technique IDs in the actor's report text.

CVEs named in reports

• CVE-2023-5631 KEV
• CVE-2024-21413 KEV

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

1. 4 October 2024

   it didn't turn into a truck, but a widely spread Android botnet

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor it didn't turn into a truck, but a widely spread Android botnet

2. 4 October 2024

   Virus Bulletin :: TA577 walked just past you: indirect syscalls in Pikabot

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Virus Bulletin :: TA577 walked just past you: indirect syscalls in Pikabot

3. 2 October 2024

   Separating the bee from the panda: CeranaKeeper making a beeline for Thailand

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Separating the bee from the panda: CeranaKeeper making a beeline for Thailand

4. 13 May 2024

   ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilities

   file creation date fromORKL

   Archived copy on ORKL Detailsfor ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilities

5. 2 March 2023

   MQsTTang: Mustang Panda’s latest backdoor treads new ground with Qt and MQTT

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor MQsTTang: Mustang Panda’s latest backdoor treads new ground with Qt and MQTT

Newest first. Details opens the report in Explore.