DAGGER PANDA

новый модульный бэкдор в госсекторе — Анализ Solar 4RAYS

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor новый модульный бэкдор в госсекторе — Анализ Solar 4RAYS

UAT-7290 targets high value telecommunications infrastructure in South Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UAT-7290 targets high value telecommunications infrastructure in South Asia

The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns

Follow the Smoke | China-nexus Threat Actors Hammer At the Doors of Top Tier Targets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Follow the Smoke | China-nexus Threat Actors Hammer At the Doors of Top Tier Targets

Hunt.io Insights: Gamaredon’s Flux-Like Infrastructure and a Look at Recent ShadowPad Activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hunt.io Insights: Gamaredon’s Flux-Like Infrastructure and a Look at Recent ShadowPad Activity

Operation FishMedley targeting governments, NGOs, and think tanks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation FishMedley targeting governments, NGOs, and think tanks

Updated Shadowpad Malware Leads to Ransomware Deployment

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Updated Shadowpad Malware Leads to Ransomware Deployment

Meet NailaoLocker: a ransomware distributed in Europe by ShadowPad and PlugX backdoors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Meet NailaoLocker: a ransomware distributed in Europe by ShadowPad and PlugX backdoors

Updated Shadowpad Malware Leads to Ransomware Deployment

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Updated Shadowpad Malware Leads to Ransomware Deployment

ScatterBrain: Unmasking the Shadow of PoisonPlug's Obfuscator

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ScatterBrain: Unmasking the Shadow of PoisonPlug's Obfuscator

JSAC2025_1_5_leon-chang_theo-chen_en.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor JSAC2025_1_5_leon-chang_theo-chen_en.pdf

A PAINFUL QUICKHEAL – Securite360

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A PAINFUL QUICKHEAL – Securite360

APT41 likely compromised Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT41 likely compromised Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike

Malware Transmutation! - Unveiling the Hidden Traces of BloodAlchemy

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Transmutation! - Unveiling the Hidden Traces of BloodAlchemy

Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks

Anxun and Chinese APT Activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Anxun and Chinese APT Activity

Inside The Lab - HarfangLab

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Inside The Lab - HarfangLab

Tracking ShadowPad Infrastructure Via Non-Standard Certificates

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tracking ShadowPad Infrastructure Via Non-Standard Certificates

2023 Adversary Infrastructure Report

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023 Adversary Infrastructure Report

Possible supply chain attack targeting South Asian government delivers Shadowpad

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Possible supply chain attack targeting South Asian government delivers Shadowpad

Slides-Possible-supply-chain-attack-targeting-South-Asian-government-delivers-Shadowpad.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Slides-Possible-supply-chain-attack-targeting-South-Asian-government-delivers-Shadowpad.pdf

Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda

Redfly: Espionage Actors Continue to Target Critical Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Redfly: Espionage Actors Continue to Target Critical Infrastructure

RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale

Possible Supply Chain Attack Targeting Pakistani Government Delivers Shadowpad

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Possible Supply Chain Attack Targeting Pakistani Government Delivers Shadowpad

Lancefly: Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lancefly: Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors

“PortDoor” Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor “PortDoor” Malware

The Approach of TA413 for Tibetan Targets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Approach of TA413 for Tibetan Targets

Update to the REF2924 intrusion set and related campaigns

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Update to the REF2924 intrusion set and related campaigns

Threat Analysis: Active C2 Discovery Using Protocol Emulation Part3 (ShadowPad)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Analysis: Active C2 Discovery Using Protocol Emulation Part3 (ShadowPad)

VB2022-Tracking-the-entire-iceberg.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor VB2022-Tracking-the-entire-iceberg.pdf

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research

Chinese State-Sponsored Group TA413 Adopts New Capabilities in Pursuit of Tibetan Targets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese State-Sponsored Group TA413 Adopts New Capabilities in Pursuit of Tibetan Targets

Tracking the entire iceberg – long‑term APT malware C2 protocol emulation and scanning

Malpedia library date Virus Bulletin fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Tracking the entire iceberg – long‑term APT malware C2 protocol emulation and scanning

New Wave of Espionage Activity Targets Asian Governments

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Wave of Espionage Activity Targets Asian Governments

Worok: The big picture

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Worok: The big picture

Targets of Interest | Russian Organizations Increasingly Under Attack By Chinese APTs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Targets of Interest | Russian Organizations Increasingly Under Attack By Chinese APTs

Attacks on industrial control systems using ShadowPad | Kaspersky ICS CERT EN

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attacks on industrial control systems using ShadowPad | Kaspersky ICS CERT EN

THALES%20THREAT%20HANDBOOK%202022%20Light%20Version_1.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor THALES%20THREAT%20HANDBOOK%202022%20Light%20Version_1.pdf

Space Pirates analyzing the tools and connections of a new hacker group

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Space Pirates analyzing the tools and connections of a new hacker group

Space Pirates: analyzing the tools and connections of a new hacker group

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Space Pirates: analyzing the tools and connections of a new hacker group

AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf

Chinese Naikon Group Back with New Espionage Attack

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Chinese Naikon Group Back with New Espionage Attack

Moshen Dragon’s Triad-and-Error Approach - Abusing Security Software to Sideload PlugX and ShadowPad

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Moshen Dragon’s Triad-and-Error Approach - Abusing Security Software to Sideload PlugX and ShadowPad

Moshen Dragon’s Triad-and-Error Approach | Abusing Security Software to Sideload PlugX and ShadowPad

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Moshen Dragon’s Triad-and-Error Approach | Abusing Security Software to Sideload PlugX and ShadowPad

China accused of cyberattacks on Indian power grid

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China accused of cyberattacks on Indian power grid

Continued Targeting of Indian Power Grid Assets by Chinese State-Sponsored Activity Group

Malpedia library date recordedfuture fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Continued Targeting of Indian Power Grid Assets by Chinese State-Sponsored Activity Group

PlugX- A Talisman to Behold

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor PlugX- A Talisman to Behold

2021%20ICS%20OT%20Cybersecurity%20Year%20In%20Review%20-%20Dragos%202021.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2021%20ICS%20OT%20Cybersecurity%20Year%20In%20Review%20-%20Dragos%202021.pdf

Researchers Link ShadowPad Malware Attacks to Chinese Ministry and PLA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Researchers Link ShadowPad Malware Attacks to Chinese Ministry and PLA

ShadowPad Malware Analysis

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor ShadowPad Malware Analysis

ShadowPad Malware Analysis _ Secureworks

date in the CCS '25 data SecureWorks fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ShadowPad Malware Analysis _ Secureworks

Microsoft Word - FLASH TLP WHITE CVE Zoho Desktop Servers v1.4 Updated template

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Microsoft Word - FLASH TLP WHITE CVE Zoho Desktop Servers v1.4 Updated template

Winnti is Coming - Evolution after Prosecution@HITCON2021

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Winnti is Coming - Evolution after Prosecution@HITCON2021

Winnti is Coming - Evolution after Prosecution

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Winnti is Coming - Evolution after Prosecution

Chinese State-Sponsored Cyber Espionage Activity Supports Expansion of Regional Power and Influence in Southeast Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese State-Sponsored Cyber Espionage Activity Supports Expansion of Regional Power and Influence in Southeast Asia

Chasing Shadows: A deep dive into the latest obfuscation methods being used by ShadowPad

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chasing Shadows: A deep dive into the latest obfuscation methods being used by ShadowPad

It’s a BEE! It’s a… no, it’s ShadowPad.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor It’s a BEE! It’s a… no, it’s ShadowPad.

Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf

Malpedia library date Kaspersky fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf

APT trends report Q3 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q3 2021

PowerPoint 簡報

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PowerPoint 簡報

4 Chinese APT Groups Identified Targeting Mail Server of Afghan Telecommunications Firm Roshan

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor 4 Chinese APT Groups Identified Targeting Mail Server of Afghan Telecommunications Firm Roshan

China-Linked Group TAG-28 Targets India’s “The Times Group” and UIDAI (Aadhaar) Government Agency With Winnti Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-Linked Group TAG-28 Targets India’s “The Times Group” and UIDAI (Aadhaar) Government Agency With Winnti Malware

Quarians, Turians and…QuickHeal

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Quarians, Turians and…QuickHeal

D1T1%20-%20%20ShadowPad%20-%20A%20Masterpiece%20of%20Privately%20Sold%20Malware%20in%20Chinese%20Espionage%20-%20Yi-Jhen%20Hsieh%20&%20Joey%20Chen.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor D1T1%20-%20%20ShadowPad%20-%20A%20Masterpiece%20of%20Privately%20Sold%20Malware%20in%20Chinese%20Espionage%20-%20Yi-Jhen%20Hsieh%20&%20Joey%20Chen.pdf

ShadowPad | A Masterpiece of Privately Sold Malware in Chinese Espionage - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ShadowPad | A Masterpiece of Privately Sold Malware in Chinese Espionage - SentinelLabs

China's Digital Colonialism: Espionage and Repression Along the Digital Silk Road

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China's Digital Colonialism: Espionage and Repression Along the Digital Silk Road

Wiper Malware Riding the 2021 Tokyo Olympic Games

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Wiper Malware Riding the 2021 Tokyo Olympic Games

Wiper Malware Riding the 2021 Tokyo Olympic Games | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Wiper Malware Riding the 2021 Tokyo Olympic Games | FortiGuard Labs

Презентация PowerPoint

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Презентация PowerPoint

Threat Activity Group RedFoxtrot Linked to China’s PLA Unit 69010; Targets Bordering Asian Countries

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Activity Group RedFoxtrot Linked to China’s PLA Unit 69010; Targets Bordering Asian Countries

the-operations-of-winnti-group.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor the-operations-of-winnti-group.pdf

RedEcho group parks domains after public exposure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RedEcho group parks domains after public exposure

China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions

Cyber Threats 2020: A Year in Retrospect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Threats 2020: A Year in Retrospect

Report2021GTR.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Report2021GTR.pdf

Higaisa or Winnti? APT41 backdoors, old and new

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Higaisa or Winnti? APT41 backdoors, old and new

Microsoft Word - Global Perspective of the SideWinder APT (pre-release final).docx

Malpedia library date AlienVault fromORKLCCS '25 data

The original link failed its last check. Original publisher Detailsfor Microsoft Word - Global Perspective of the SideWinder APT (pre-release final).docx

nao-sec.org-Royal Road ReDive

date in the CCS '25 data nao_sec fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor nao-sec.org-Royal Road ReDive

Royal Road! Re-Dive

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Royal Road! Re-Dive

nao-sec.org

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor nao-sec.org

Operation StealthyTrident: corporate software under attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation StealthyTrident: corporate software under attack

APT trends report Q3 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q3 2020

winnti-2020-rus.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor winnti-2020-rus.pdf

APT41: Indictments Put Chinese Espionage Group in the Spotlight

Malpedia library date Symantec fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT41: Indictments Put Chinese Espionage Group in the Spotlight

APT trends report Q2 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q2 2020

The Manufacturing Threat Landscape in 2020 | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Manufacturing Threat Landscape in 2020 | CrowdStrike

BackDoor.ShadowPad.1 — Dr.Web Malware description library

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BackDoor.ShadowPad.1 — Dr.Web Malware description library

Cycldek: Bridging the (air) gap

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cycldek: Bridging the (air) gap

On the Royal Road

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor On the Royal Road

New version of chinoxy backdoor using COVID19 alerts document lure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New version of chinoxy backdoor using COVID19 alerts document lure

Vicious Panda: The COVID Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Vicious Panda: The COVID Campaign

using RTF object dimensions to track APT phishing weaponizers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor using RTF object dimensions to track APT phishing weaponizers

Attribution is in the object- using RTF object dimensions to track APT phishing weaponizers

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Attribution is in the object- using RTF object dimensions to track APT phishing weaponizers

Cyber Threats 2019: A Year in Retrospect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Threats 2019: A Year in Retrospect

Winnti Group targeting universities in Hong Kong

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Winnti Group targeting universities in Hong Kong

nao-sec.org

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor nao-sec.org

An Overhead View of the Royal Road

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor An Overhead View of the Royal Road

An Overhead View of the Royal Road

file creation date fromORKL

Archived copy on ORKL Detailsfor An Overhead View of the Royal Road

Cyber-Reports-2020-01-A-one-sided-Affair.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber-Reports-2020-01-A-one-sided-Affair.pdf

Cyber Threat Landscape in Japan – Revealing Threat in the Shadow

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Cyber Threat Landscape in Japan – Revealing Threat in the Shadow

[CB19] Cyber Threat Landscape in Japan – Revealing Threat in the Shadow by Chi En Shen (Ashley) Oleg Bondarenko

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor [CB19] Cyber Threat Landscape in Japan – Revealing Threat in the Shadow by Chi En Shen (Ashley) Oleg Bondarenko

APT review: what the world’s threat actors got up to in 2019

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT review: what the world’s threat actors got up to in 2019

Rancor: The Year of The Phish

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rancor: The Year of The Phish

Chinese APT Uses Poison Ivy Malware to Target Government | Proofpoint US

Malpedia library date Proofpoint fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Chinese APT Uses Poison Ivy Malware to Target Government | Proofpoint US

Threat Group Cards: A Threat Actor Encyclopedia

file creation date ThaiCERT fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Threat Group Cards: A Threat Actor Encyclopedia

Threat Group Cards: A Threat Actor Encyclopedia

file creation date Martijn van der Heide fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia

Into the Fog - The Return of ICEFOG APT

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Into the Fog - The Return of ICEFOG APT

Into the Fog - The Return of ICEFOG APT

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Into the Fog - The Return of ICEFOG APT

Operation ShadowHammer: a high-profile supply chain attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation ShadowHammer: a high-profile supply chain attack

C/C++ Runtime Library Code Tampering in Supply Chain

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor C/C++ Runtime Library Code Tampering in Supply Chain

Accenture Strategy Templates

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Accenture Strategy Templates

Analyzing Digital Quartermasters in Asia – Do Chinese and Indian APTs Have a Shared Supply Chain?

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Analyzing Digital Quartermasters in Asia – Do Chinese and Indian APTs Have a Shared Supply Chain?

Another malicious document with CVE-2017–11882

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Another malicious document with CVE-2017–11882

Goblin Panda changes the dropper and reuses the old infrastructure

date in the CCS '25 data Symantec fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Goblin Panda changes the dropper and reuses the old infrastructure

Là 1937CN hay OceanLotus hay Lazarus …

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Là 1937CN hay OceanLotus hay Lazarus …

Malicious document targets Vietnamese officials

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malicious document targets Vietnamese officials

Malicious document targets Vietnamese officials

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malicious document targets Vietnamese officials

RedAlpha: New Campaigns Discovered Targeting the Tibetan Community

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RedAlpha: New Campaigns Discovered Targeting the Tibetan Community

icefog.pdf

Malpedia library date Kaspersky fromORKLCCS '25 data

Archived copy on ORKL Detailsfor icefog.pdf

ShadowPad in corporate networks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ShadowPad in corporate networks

%5bAnalysis%5dDefense_Industry_Threats.pdf

file creation date fromORKL

The original link failed its last check. Original publisher Detailsfor %5bAnalysis%5dDefense_Industry_Threats.pdf

洋葱狗行动（Operation OnionDog）

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 洋葱狗行动（Operation OnionDog）

Operation OnionDog

date in the CCS '25 data Novetta fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation OnionDog

Forced to Adapt: XSLCmd Backdoor Now on OS X | FireEye Blog

date in the CCS '25 data FireEye fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Forced to Adapt: XSLCmd Backdoor Now on OS X | FireEye Blog

Unveiling Careto - The Masked Apt

Malpedia library date Kaspersky fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Unveiling Careto - The Masked Apt

securelist.com-The Icefog APT Hits US Targets With Java Backdoor

date in the CCS '25 data CrowdStrike fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor securelist.com-The Icefog APT Hits US Targets With Java Backdoor

The Icefog APT Hits US Targets With Java Backdoor

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Icefog APT Hits US Targets With Java Backdoor

The Icefog APT Hits US Targets With Java Backdoor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Icefog APT Hits US Targets With Java Backdoor

CrowdCasts Monthly: You Have an Adversary Problem

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor CrowdCasts Monthly: You Have an Adversary Problem

The Icefog Apt: A Tale Of Cloak And Three Daggers

file creation date Kaspersky fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The Icefog Apt: A Tale Of Cloak And Three Daggers

The IceFog Advanced Persistent Threat (APT) - Virus Threat | Kaspersky Lab

file creation date Kaspersky Lab fromORKL

Archived copy on ORKL Detailsfor The IceFog Advanced Persistent Threat (APT) - Virus Threat | Kaspersky Lab

The Icefog APT- A Tale of Cloak and Three Daggers

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Icefog APT- A Tale of Cloak and Three Daggers

The Icefog APT: A Tale of Cloak and Three Daggers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Icefog APT: A Tale of Cloak and Three Daggers