Earth Baxia

PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups

GOGITTER, GITSHELLPAD, and GOSHELL Analysis | ThreatLabz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GOGITTER, GITSHELLPAD, and GOSHELL Analysis | ThreatLabz

From a New Year's surprise to a bag of coal - Analysis of mystery PowerShell

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From a New Year's surprise to a bag of coal - Analysis of mystery PowerShell

Multiple Threat Actors Leveraging CVE-2025-55182 (React2Shell)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Multiple Threat Actors Leveraging CVE-2025-55182 (React2Shell)

APT24's Pivot to Multi-Vector Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT24's Pivot to Multi-Vector Attacks

The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns

UAT-8099: Chinese-speaking cybercrime group targets high-value IIS for SEO fraud

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UAT-8099: Chinese-speaking cybercrime group targets high-value IIS for SEO fraud

From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion

Chinese Hackers RedNovember Target Global Governments Using Pantegana and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese Hackers RedNovember Target Global Governments Using Pantegana and Cobalt Strike

TAOTH Campaign Exploits End-of-Support Software to Target Traditional Chinese Users and Dissidents

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TAOTH Campaign Exploits End-of-Support Software to Target Traditional Chinese Users and Dissidents

ShadowSilk: A Cross-Border Binary Union for Data Exfiltration | Group-IB Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ShadowSilk: A Cross-Border Binary Union for Data Exfiltration | Group-IB Blog

The SOC files: Rumble in the jungle or APT41’s new target in Africa

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The SOC files: Rumble in the jungle or APT41’s new target in Africa

Dissecting the ClickFix User-Execution Attack and Its Sophisticated Persistence via ADS

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dissecting the ClickFix User-Execution Attack and Its Sophisticated Persistence via ADS

Phish and Chips: China-Aligned Espionage Actors Ramp Up Taiwan Semiconductor Industry Targeting | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Phish and Chips: China-Aligned Espionage Actors Ramp Up Taiwan Semiconductor Industry Targeting | Proofpoint US

Cyber%20Threat%20Intelligence%20Report%202025.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber%20Threat%20Intelligence%20Report%202025.pdf

Threat Hunting Introduction: Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Hunting Introduction: Cobalt Strike

Cobalt Strike Operators Leverage PowerShell Loaders Across Chinese, Russian, and Global Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Operators Leverage PowerShell Loaders Across Chinese, Russian, and Global Infrastructure

Team46 and TaxOff: two sides of the same coin

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Team46 and TaxOff: two sides of the same coin

Earth Lamia Develops Custom Arsenal to Target Multiple Industries

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Lamia Develops Custom Arsenal to Target Multiple Industries

Nitrogen Dropping Cobalt Strike – A Combination of “Chemical Elements”

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Nitrogen Dropping Cobalt Strike – A Combination of “Chemical Elements”

m-trends-2025-en.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor m-trends-2025-en.pdf

Operation HollowQuill: Malware delivered into Russian R&D Networks via Research Decoy PDFs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation HollowQuill: Malware delivered into Russian R&D Networks via Research Decoy PDFs

The Espionage Toolkit of Earth Alux A Closer Look at its Advanced Techniques

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Espionage Toolkit of Earth Alux A Closer Look at its Advanced Techniques

CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia

JSAC2025_1_5_leon-chang_theo-chen_en.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor JSAC2025_1_5_leon-chang_theo-chen_en.pdf

Jul-Dec%202024%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Jul-Dec%202024%20Botnet%20Threat%20Update.pdf

Golang Beacons and VS Code Tunnels: Tracking a Cobalt Strike Server Leveraging Trusted Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Golang Beacons and VS Code Tunnels: Tracking a Cobalt Strike Server Leveraging Trusted Infrastructure

Black Basta Ransomware Campaign Drops Zbot, DarkGate, and Custom Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Black Basta Ransomware Campaign Drops Zbot, DarkGate, and Custom Malware

Rare Watermark Links Cobalt Strike 4.10 Team Servers to Ongoing Suspicious Activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rare Watermark Links Cobalt Strike 4.10 Team Servers to Ongoing Suspicious Activity

The Curious Case of an Egg-Cellent Resume

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor The Curious Case of an Egg-Cellent Resume

Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella

China-Nexus TAG-112 Compromises Tibetan Websites to Distribute Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-Nexus TAG-112 Compromises Tibetan Websites to Distribute Cobalt Strike

China-Nexus TAG-112 Compromises Tibetan Websites to Distribute Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China-Nexus TAG-112 Compromises Tibetan Websites to Distribute Cobalt Strike

Tricks, Treats, and Threats: Cobalt Strike & the Goblin Lurking in Plain Sight

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tricks, Treats, and Threats: Cobalt Strike & the Goblin Lurking in Plain Sight

Operation Cobalt Whisper: Threat Actor Targets Multiple Industries Across Hong Kong and Pakistan.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Cobalt Whisper: Threat Actor Targets Multiple Industries Across Hong Kong and Pakistan.

Threat Spotlight: WarmCookie/BadSpace

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Spotlight: WarmCookie/BadSpace

Highlighting TA866/Asylum Ambuscade Activity Since 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Highlighting TA866/Asylum Ambuscade Activity Since 2021

Unmasking Adversary Infrastructure: How Certificates and Redirects Exposed Earth Baxia and PlugX Activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unmasking Adversary Infrastructure: How Certificates and Redirects Exposed Earth Baxia and PlugX Activity

Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdf

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/earth-baxia-uses-spear-phishing-and-geoserver-exploit-to-target-apac/IOCs%20-%20Earth%20Baxia%20Uses%20Spear-Phishing%20and%20GeoServer%20Exploit%20to%20Target%20APAC.txt

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/earth-baxia-uses-spear-phishing-and-geoserver-exploit-to-target-apac/IOCs%20-%20Earth%20Baxia%20Uses%20Spear-Phishing%20and%20GeoServer%20Exploit%20to%20Target%20APAC.txt

Earth Baxia Uses Spear-Phishing and GeoServer Exploit to Target APAC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Baxia Uses Spear-Phishing and GeoServer Exploit to Target APAC

From Cobalt Strike to Mimikatz: A Deep Dive into the SLOW#TEMPEST Campaign Targeting Chinese Users

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From Cobalt Strike to Mimikatz: A Deep Dive into the SLOW#TEMPEST Campaign Targeting Chinese Users

BlackSuit Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor BlackSuit Ransomware

Sailing_the_Seven_SEAs_Deep_Dive_into_Polaris_Arsenal_and_Intelligence_Insights.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sailing_the_Seven_SEAs_Deep_Dive_into_Polaris_Arsenal_and_Intelligence_Insights.pdf

Pirates_of_The_Nang_Hai_Follow_the_Artifacts_of_Tropic_Trooper,_No_One_Knows.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Pirates_of_The_Nang_Hai_Follow_the_Artifacts_of_Tropic_Trooper,_No_One_Knows.pdf

AppDomainManager Injectionを悪用したマルウェアによる攻撃について

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AppDomainManager Injectionを悪用したマルウェアによる攻撃について

Chinese APT abuses MSC files with GrimResource vulnerability

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese APT abuses MSC files with GrimResource vulnerability

Ongoing Social Engineering Campaign Refreshes Payloads

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ongoing Social Engineering Campaign Refreshes Payloads

Decoding a Cobalt Strike Downloader Script With CyberChef

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Decoding a Cobalt Strike Downloader Script With CyberChef

APT41 likely compromised Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT41 likely compromised Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike

UAC-0057 Attack Detection: A Surge in Adversary Activity Distributing PICASSOLOADER and Cobalt Strike Beacon

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UAC-0057 Attack Detection: A Surge in Adversary Activity Distributing PICASSOLOADER and Cobalt Strike Beacon

A Beginner's Guide to Hunting Malicious Open Directories - Censys

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Beginner's Guide to Hunting Malicious Open Directories - Censys

APT41 Has Arisen From the DUST

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT41 Has Arisen From the DUST

TAG-100 Uses Open-Source Tools in Suspected Global Espionage Campaign, Compromising Two Asia-Pacific Intergovernmental Bodies

Malpedia library date Insikt Group® by Recorded Future® fromORKL

Archived copy on ORKL Detailsfor TAG-100 Uses Open-Source Tools in Suspected Global Espionage Campaign, Compromising Two Asia-Pacific Intergovernmental Bodies

DodgeBox | ThreatLabz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DodgeBox | ThreatLabz

Jan-Jun%202024%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Jan-Jun%202024%20Botnet%20Threat%20Update.pdf

Exposing FakeBat loader: distribution methods and adversary infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Exposing FakeBat loader: distribution methods and adversary infrastructure

GrimResource - Microsoft Management Console for initial access and evasion

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GrimResource - Microsoft Management Console for initial access and evasion

IcedID Brings ScreenConnect and CSharp Streamer to ALPHV Ransomware Deployment

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor IcedID Brings ScreenConnect and CSharp Streamer to ALPHV Ransomware Deployment

Sharp Dragon Expands Towards Africa and The Caribbean - Check Point Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Sharp Dragon Expands Towards Africa and The Caribbean - Check Point Research

Chinese Espionage Campaign Expands to Target Africa and The Caribbean

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese Espionage Campaign Expands to Target Africa and The Caribbean

Threat actors misusing Quick Assist in social engineering attacks leading to ransomware | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat actors misusing Quick Assist in social engineering attacks leading to ransomware | Microsoft Security Blog

QakBot attacks with Windows zero-day (CVE-2024-30051)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor QakBot attacks with Windows zero-day (CVE-2024-30051)

Ongoing Social Engineering Campaign Linked to Black Basta Ransomware Operators

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ongoing Social Engineering Campaign Linked to Black Basta Ransomware Operators

Securonix Threat Research Security Advisory: Analysis of Ongoing FROZEN#SHADOW Attack Campaign Leveraging SSLoad Malware and RMM Software for Domain Takeover

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Securonix Threat Research Security Advisory: Analysis of Ongoing FROZEN#SHADOW Attack Campaign Leveraging SSLoad Malware and RMM Software for Domain Takeover

From OneNote to RansomNote: An Ice Cold Intrusion

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor From OneNote to RansomNote: An Ice Cold Intrusion

Rewterz Threat Alert – China-Linked Earth Krahang APT Breached 70 Organizations in 23 Nations – Active IOCs - Rewterz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rewterz Threat Alert – China-Linked Earth Krahang APT Breached 70 Organizations in 23 Nations – Active IOCs - Rewterz

Malware Analysis — Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Analysis — Cobalt Strike

A Beginner's Guide to Tracking Malware Infrastructure - Censys

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Beginner's Guide to Tracking Malware Infrastructure - Censys

JSAC2024_2_7_hara_shoji_higashi_vickie-su_nick-dai_en.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor JSAC2024_2_7_hara_shoji_higashi_vickie-su_nick-dai_en.pdf

Q4%202023%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Q4%202023%20Botnet%20Threat%20Update.pdf

2023 Adversary Infrastructure Report

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023 Adversary Infrastructure Report

How to Use Ghidra to Analyse Shellcode and Extract Cobalt Strike Command & Control Servers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How to Use Ghidra to Analyse Shellcode and Extract Cobalt Strike Command & Control Servers

SQL Brute Force Leads to BlueSky Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor SQL Brute Force Leads to BlueSky Ransomware

Combining Pivot Points to Identify Malware Infrastructure - Redline, Smokeloader and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Combining Pivot Points to Identify Malware Infrastructure - Redline, Smokeloader and Cobalt Strike

HostingHunter Series: CHANG WAY TECHNOLOGIES CO. LIMITED

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor HostingHunter Series: CHANG WAY TECHNOLOGIES CO. LIMITED

The New APT Group DarkCasino and the Global Surge in WinRAR 0-Day Exploits - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.

Malpedia library date NSFOCUS fromORKLCCS '25 data

Archived copy on ORKL Detailsfor The New APT Group DarkCasino and the Global Surge in WinRAR 0-Day Exploits - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.

New Gootloader Variant “GootBot” Changes the Game in Malware Tactics

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Gootloader Variant “GootBot” Changes the Game in Malware Tactics

Malware Unpacking With Hardware Breakpoints - Cobalt Strike Shellcode Loader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Unpacking With Hardware Breakpoints - Cobalt Strike Shellcode Loader

Popping Blisters for research: An overview of past payloads and exploring recent developments

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Popping Blisters for research: An overview of past payloads and exploring recent developments

Cobalt Strike .VBS Loader - Decoding with Advanced CyberChef and Emulation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike .VBS Loader - Decoding with Advanced CyberChef and Emulation

Cobalt Strike Malware Analysis With CyberChef and Emulation - .HTA Loader Example

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Malware Analysis With CyberChef and Emulation - .HTA Loader Example

Ghidra Tutorial - Using Entropy To Locate Cobalt Strike Decryption Functions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ghidra Tutorial - Using Entropy To Locate Cobalt Strike Decryption Functions

Forensic Timeline of an IcedID Infection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Forensic Timeline of an IcedID Infection

2023%20Q3%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023%20Q3%20Botnet%20Threat%20Update.pdf

Grayling: Previously Unseen Threat Actor Targets Multiple Organizations in Taiwan

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Grayling: Previously Unseen Threat Actor Targets Multiple Organizations in Taiwan

Backchannel Diplomacy: APT29's Rapidly Evolving Diplomatic Phishing Operations | Mandiant

Malpedia library date Mandiant fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Backchannel Diplomacy: APT29's Rapidly Evolving Diplomatic Phishing Operations | Mandiant

Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda

CERTFR-2023-CTI-007.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERTFR-2023-CTI-007.pdf

Earth Estries Targets Government, Tech for Cyberespionage

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Estries Targets Government, Tech for Cyberespionage

HTML Smuggling Leads to Domain Wide Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor HTML Smuggling Leads to Domain Wide Ransomware

Understanding Syscalls: Direct, Indirect, and Cobalt Strike Implementation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Understanding Syscalls: Direct, Indirect, and Cobalt Strike Implementation

Unmasking CamoFei An In-depth Analysis of an Emerging APT Group Focused on Healthcare Sectors in East Asia

date in the CCS '25 data Team T5 fromCCS '25 data

Detailsfor Unmasking CamoFei An In-depth Analysis of an Emerging APT Group Focused on Healthcare Sectors in East Asia

Chinese Entanglement | DLL Hijacking in the Asian Gambling Sector

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese Entanglement | DLL Hijacking in the Asian Gambling Sector

Unmasking CamoFei

file creation date fromORKL

Archived copy on ORKL Detailsfor Unmasking CamoFei

RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale

gcat_threathorizons_full_jul2023.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor gcat_threathorizons_full_jul2023.pdf

2023%20Q2%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023%20Q2%20Botnet%20Threat%20Update.pdf

Beyond appearances: unknown actor using APT29’s TTP against Chinese users

Malpedia library date Lab52 fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Beyond appearances: unknown actor using APT29’s TTP against Chinese users

Cobalt Strike’s Deployment with Hardware Breakpoint for AMSI Bypass

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike’s Deployment with Hardware Breakpoint for AMSI Bypass

PicassoLoader and Cobalt Strike Beacon Detection: UAC-0057 aka GhostWriter Hacking Group Attacks the Ukrainian Leading Military Educational Institution

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PicassoLoader and Cobalt Strike Beacon Detection: UAC-0057 aka GhostWriter Hacking Group Attacks the Ukrainian Leading Military Educational Institution

eSentire Threat Intelligence Malware Analysis: Resident Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eSentire Threat Intelligence Malware Analysis: Resident Campaign

Threat Intelligence Query Examples - Real World Queries for Identifying Malware Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Intelligence Query Examples - Real World Queries for Identifying Malware Infrastructure

Malware development trick - part 28: Dump lsass.exe. Simple C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development trick - part 28: Dump lsass.exe. Simple C++ example.

Malware-Analysis/Cobalt Strike/Indirect Syscalls.md at main · dodo-sec/Malware-Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware-Analysis/Cobalt Strike/Indirect Syscalls.md at main · dodo-sec/Malware-Analysis

2023%20Q1%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023%20Q1%20Botnet%20Threat%20Update.pdf

Malicious ISO File Leads to Domain Wide Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Malicious ISO File Leads to Domain Wide Ransomware

1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf

With KEYPLUG, China’s RedGolf Spies On, Steals From Wide Field of Targets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor With KEYPLUG, China’s RedGolf Spies On, Steals From Wide Field of Targets

eSentire Threat Intelligence Malware Analysis: BatLoader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eSentire Threat Intelligence Malware Analysis: BatLoader

Mélofée: a new alien malware in the Panda's toolset targeting Linux hosts

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mélofée: a new alien malware in the Panda's toolset targeting Linux hosts

From Royal with Love

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From Royal with Love

OneNote | ThreatLabz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OneNote | ThreatLabz

Technical Advisory: Various Threat Actors Targeting ManageEngine Exploit CVE-2022-47966

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Technical Advisory: Various Threat Actors Targeting ManageEngine Exploit CVE-2022-47966

Hydrochasma: Previously Unknown Group Targets Medical and Shipping Organizations in Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hydrochasma: Previously Unknown Group Targets Medical and Shipping Organizations in Asia

Royal Ransomware Deep Dive

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Royal Ransomware Deep Dive

Dalbit (m00nlight): Chinese Hacker Group's APT Attack Campaign - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dalbit (m00nlight): Chinese Hacker Group's APT Attack Campaign - ASEC

Earth Zhulong Familiar Patterns Target Southeast Asian Firms

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Zhulong Familiar Patterns Target Southeast Asian Firms

Hive Ransomware Technical Analysis and Initial Access Discovery

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hive Ransomware Technical Analysis and Initial Access Discovery

Following the Scent of TrickGate: 6-Year-Old Packer Used to Deploy the Most Wanted Malware - Check Point Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Following the Scent of TrickGate: 6-Year-Old Packer Used to Deploy the Most Wanted Malware - Check Point Research

The Year of the Wiper | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Year of the Wiper | FortiGuard Labs

Black Basta - Technical Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Black Basta - Technical Analysis

Bluebottle: Campaign Hits Banks in French-speaking Countries in Africa

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bluebottle: Campaign Hits Banks in French-speaking Countries in Africa

Trojanized Windows 10 Operating System Installers Targeted Ukrainian Government | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trojanized Windows 10 Operating System Installers Targeted Ukrainian Government | Mandiant

Breaking the silence - Recent Truebot activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Breaking the silence - Recent Truebot activity

Eu_Repo_C_APT_profile_Conti_Wizard_Spider_dc2a733e18.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Eu_Repo_C_APT_profile_Conti_Wizard_Spider_dc2a733e18.pdf

Blowing Cobalt Strike Out of the Water With Memory Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Blowing Cobalt Strike Out of the Water With Memory Analysis

Somnia Malware Detection: UAC-0118 aka FRwL Launches Cyber Attacks Against Organizations in Ukraine Using Enhanced Malware Strains

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Somnia Malware Detection: UAC-0118 aka FRwL Launches Cyber Attacks Against Organizations in Ukraine Using Enhanced Malware Strains

Hack the Real Box: APT41’s New Subgroup Earth Longzhi

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hack the Real Box: APT41’s New Subgroup Earth Longzhi

Cobalt Strike Analysis and Tutorial: Identifying Beacon Team Servers in the Wild

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Analysis and Tutorial: Identifying Beacon Team Servers in the Wild

French-speaking gang OPERA1ER APT in Africa | Group-IB Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor French-speaking gang OPERA1ER APT in Africa | Group-IB Blog

Orion Threat Alert: Qakbot TTPs Arsenal and the Black Basta Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Orion Threat Alert: Qakbot TTPs Arsenal and the Black Basta Ransomware

2022%20Q3%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2022%20Q3%20Botnet%20Threat%20Update.pdf

Microsoft Security Response Center Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Security Response Center Blog

Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike

Bumblebee: increasing its capacity and evolving its TTPs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bumblebee: increasing its capacity and evolving its TTPs

Water Labbu Abuses Malicious DApps to Steal Cryptocurrency

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Water Labbu Abuses Malicious DApps to Steal Cryptocurrency

BumbleBee: Round Two

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor BumbleBee: Round Two

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense

Dead or Alive? An Emotet Story

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Dead or Alive? An Emotet Story

Cyble - Bumblebee Returns With New Infection Technique

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyble - Bumblebee Returns With New Infection Technique

Initial access broker repurposing techniques in targeted attacks against Ukraine

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Initial access broker repurposing techniques in targeted attacks against Ukraine

Estudio del análisis de Nobelium

file creation date fromORKL

Archived copy on ORKL Detailsfor Estudio del análisis de Nobelium

incibe-cert_estudio_analisis_nobelium_2022_v1.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor incibe-cert_estudio_analisis_nobelium_2022_v1.pdf

Malware development tricks: parent PID spoofing. Simple C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development tricks: parent PID spoofing. Simple C++ example.

#StopRansomware: Vice Society | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor #StopRansomware: Vice Society | CISA

Ransomware Spotlight: Black Basta

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware Spotlight: Black Basta

Hacker Infrastructure Used in Cisco Breach Discovered Attacking a Top Workforce Management Corporation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hacker Infrastructure Used in Cisco Breach Discovered Attacking a Top Workforce Management Corporation

BlueSky Ransomware | AD Lateral Movement, Evasion and Fast Encryption Put Threat on the Radar

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BlueSky Ransomware | AD Lateral Movement, Evasion and Fast Encryption Put Threat on the Radar

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research

新APT组织穆伦鲨(MurenShark) 调查报告：袭向土耳其海军的鱼雷 – 绿盟科技技术博客

Malpedia library date NSFOCUS fromORKLCCS '25 data

Archived copy on ORKL Detailsfor 新APT组织穆伦鲨(MurenShark) 调查报告：袭向土耳其海军的鱼雷 – 绿盟科技技术博客

APT41 World Tour 2021 on a tight schedule

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT41 World Tour 2021 on a tight schedule

Overview of the Cyber Weapons Used in the Ukraine - Russia War | Trustwave

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Overview of the Cyber Weapons Used in the Ukraine - Russia War | Trustwave

THREAT ANALYSIS REPORT: Bumblebee Loader – The High Road to Enterprise Domain Control

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor THREAT ANALYSIS REPORT: Bumblebee Loader – The High Road to Enterprise Domain Control

Monster Libra (TA551/Shathak) pushes IcedID (Bokbot) with Dark VNC and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Monster Libra (TA551/Shathak) pushes IcedID (Bokbot) with Dark VNC and Cobalt Strike

The Increase in Ransomware Attacks on Local Governments - SecurityScorecard

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Increase in Ransomware Attacks on Local Governments - SecurityScorecard

LNK forensic and config extraction of a cobalt strike beacon

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor LNK forensic and config extraction of a cobalt strike beacon

BumbleBee Roasts Its Way to Domain Admin

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor BumbleBee Roasts Its Way to Domain Admin

Flight of the Bumblebee: Email Lures and File Sharing Services Lead to Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Flight of the Bumblebee: Email Lures and File Sharing Services Lead to Malware

Manjusaka: A Chinese sibling of Sliver and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Manjusaka: A Chinese sibling of Sliver and Cobalt Strike

Malware AV evasion - part 8. Encode payload via Z85 algorithm. C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware AV evasion - part 8. Encode payload via Z85 algorithm. C++ example.

Living Off Windows Defender | LockBit Ransomware Sideloads Cobalt Strike Through Microsoft Security Tool

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Living Off Windows Defender | LockBit Ransomware Sideloads Cobalt Strike Through Microsoft Security Tool

Cyble - Targeted Attacks Being Carried Out Via DLL SideLoading

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyble - Targeted Attacks Being Carried Out Via DLL SideLoading

RL Blog | ReversingLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RL Blog | ReversingLabs

Gootkit Loader’s Updated Tactics and Fileless Delivery of Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Gootkit Loader’s Updated Tactics and Fileless Delivery of Cobalt Strike

Binary Ninja - Reverse Engineering a Cobalt Strike Dropper With Binary Ninja

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Binary Ninja - Reverse Engineering a Cobalt Strike Dropper With Binary Ninja

Analysis of a trojanized jQuery script: GootLoader unleashed

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysis of a trojanized jQuery script: GootLoader unleashed

Evacuation and Humanitarian Documents used to Spear Phish Ukrainian Entities | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Evacuation and Humanitarian Documents used to Spear Phish Ukrainian Entities | Mandiant

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense

Russian APT29 Hackers Use Online Storage Services, DropBox and Google Drive

Malpedia library date Palo Alto fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Russian APT29 Hackers Use Online Storage Services, DropBox and Google Drive

Russian Ransomware C2 Network Discovered in Censys Data

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Russian Ransomware C2 Network Discovered in Censys Data

Cobalt Strikes again: UAC-0056 continues to target Ukraine in its latest campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strikes again: UAC-0056 continues to target Ukraine in its latest campaign

Cobalt Strike Analysis and Tutorial: CS Metadata Encryption and Decryption

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Analysis and Tutorial: CS Metadata Encryption and Decryption

CERT-UA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERT-UA

Emotet infection with Cobalt Strike - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet infection with Cobalt Strike - SANS ISC

CERT-UA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERT-UA

Black Basta Ransomware Operators Expand Their Attack Arsenal With QakBot Trojan and PrintNightmare Exploit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Black Basta Ransomware Operators Expand Their Attack Arsenal With QakBot Trojan and PrintNightmare Exploit

Attacks on industrial control systems using ShadowPad | Kaspersky ICS CERT EN

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attacks on industrial control systems using ShadowPad | Kaspersky ICS CERT EN

Overview of Russian GRU and SVR Cyberespionage Campaigns 1H 2022

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Overview of Russian GRU and SVR Cyberespionage Campaigns 1H 2022

Matanbuchus Loader Resurfaces - Cyble

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Matanbuchus Loader Resurfaces - Cyble

Avos ransomware group expands with new attack arsenal

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Avos ransomware group expands with new attack arsenal

Malspam pushes Matanbuchus malware, leads to Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malspam pushes Matanbuchus malware, leads to Cobalt Strike

Cyble - Bumblebee Loader On The Rise

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyble - Bumblebee Loader On The Rise

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense

[QuickNote] CobaltStrike SMB Beacon Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor [QuickNote] CobaltStrike SMB Beacon Analysis

Attack Graph Response to US CERT AA22-152A: Karakurt Data Extortion Group

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attack Graph Response to US CERT AA22-152A: Karakurt Data Extortion Group

To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions | Mandiant

CUBA Ransomware Campaign Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CUBA Ransomware Campaign Analysis

SocGholish Campaigns and Initial Access Kit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SocGholish Campaigns and Initial Access Kit

Emotet Botnet Rises Again | Bitsight

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet Botnet Rises Again | Bitsight

Malware Analysis: Trickbot

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Analysis: Trickbot

Why Remediation Alone Is Not Enough When Infected by Malware - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Why Remediation Alone Is Not Enough When Infected by Malware - ASEC

Malicious 'pymafka' Package Drops Cobalt Strike | Sonatype

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malicious 'pymafka' Package Drops Cobalt Strike | Sonatype

Malware Targets InfoSec: Fake PoC Delivers Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Targets InfoSec: Fake PoC Delivers Cobalt Strike

Bumblebee Malware from TransferXL URLs - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bumblebee Malware from TransferXL URLs - SANS ISC

Bumblebee Malware from TransferXL URLs - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bumblebee Malware from TransferXL URLs - SANS ISC

WizardSpider

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor WizardSpider

Ransomware Spotlight: RansomEXX

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware Spotlight: RansomEXX

What malware to look for if you want to prevent a ransomware attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What malware to look for if you want to prevent a ransomware attack

AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf

Gootloader.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Gootloader.pdf

The Goot cause: Detecting Gootloader and its follow-on activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Goot cause: Detecting Gootloader and its follow-on activity

Operation RestyLink: 日本企業を狙った標的型攻撃キャンペーン

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation RestyLink: 日本企業を狙った標的型攻撃キャンペーン

TA578 using thread-hijacked emails to push ISO files for Bumblebee malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TA578 using thread-hijacked emails to push ISO files for Bumblebee malware

Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself | Microsoft Security Blog

Malware development: persistence - part 4. Windows services. Simple C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development: persistence - part 4. Windows services. Simple C++ example.

Hiding in Plain Sight: Obscuring C2s by Abusing CDN Services

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hiding in Plain Sight: Obscuring C2s by Abusing CDN Services

SEO Poisoning - A Gootloader Story

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor SEO Poisoning - A Gootloader Story

Cobalt Strike Analysis and Tutorial: CS Metadata Encoding and Decoding

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Analysis and Tutorial: CS Metadata Encoding and Decoding

This New Fileless Malware Hides Shellcode in Windows Event Logs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor This New Fileless Malware Hides Shellcode in Windows Event Logs

Mustang Panda deploys a new wave of malware targeting Europe

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mustang Panda deploys a new wave of malware targeting Europe

A new secret stash for “fileless” malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A new secret stash for “fileless” malware

SOLARDEFLECTION C2 Infrastructure Used by NOBELIUM in Company Brand Misuse

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SOLARDEFLECTION C2 Infrastructure Used by NOBELIUM in Company Brand Misuse

ショートカットとISOファイルを悪用する攻撃キャンペーン | セキュリティ研究センターブログ

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ショートカットとISOファイルを悪用する攻撃キャンペーン | セキュリティ研究センターブログ

yir-cyber-threats-annex-download.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor yir-cyber-threats-annex-download.pdf

Tracking APT29 Phishing Campaigns | Atlassian Trello

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tracking APT29 Phishing Campaigns | Atlassian Trello

LockBit Ransomware Side-loads Cobalt Strike Beacon with Legitimate VMware Utility

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor LockBit Ransomware Side-loads Cobalt Strike Beacon with Legitimate VMware Utility

20220427_NP_TLPWHITE_ANSSI_FIN7.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 20220427_NP_TLPWHITE_ANSSI_FIN7.pdf

Botconf2022-40-LunghiHorejsi.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Botconf2022-40-LunghiHorejsi.pdf

https://documents.trendmicro.com/assets/txt/earth-berberoka-windows-iocs-2.txt

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor https://documents.trendmicro.com/assets/txt/earth-berberoka-windows-iocs-2.txt

UNC2452 Merged into APT29 | Russia-Based Espionage Group

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UNC2452 Merged into APT29 | Russia-Based Espionage Group

How Cybercriminals Abuse Cloud Tunneling Services

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How Cybercriminals Abuse Cloud Tunneling Services

Conti and Emotet: A constantly destructive duo

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti and Emotet: A constantly destructive duo

New Core Impact Backdoor Delivered Via VMWare Vulnerability

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Core Impact Backdoor Delivered Via VMWare Vulnerability

Quantum Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Quantum Ransomware

Understanding Cobalt Strike Profiles - Updated for Cobalt Strike 4.6

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Understanding Cobalt Strike Profiles - Updated for Cobalt Strike 4.6

Hive Ransomware Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hive Ransomware Analysis

A blueprint for evading industry leading endpoint protection in 2022

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A blueprint for evading industry leading endpoint protection in 2022

PYSA Ransomware: Technical Overview and Protection Strategies

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PYSA Ransomware: Technical Overview and Protection Strategies

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense

Orion Threat Alert: Flight of the BumbleBee

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Orion Threat Alert: Flight of the BumbleBee

Dismantling ZLoader: How malicious ads led to disabled security tools and ransomware | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Dismantling ZLoader: How malicious ads led to disabled security tools and ransomware | Microsoft Security Blog

ESET takes part in global operation to disrupt Zloader botnets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ESET takes part in global operation to disrupt Zloader botnets

You Bet Your Lsass: Hunting LSASS Access | Splunk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor You Bet Your Lsass: Hunting LSASS Access | Splunk

Advanced Network Detection & Response - MetaDefender NDR - OPSWAT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Advanced Network Detection & Response - MetaDefender NDR - OPSWAT

GitHub - infinitumitlabs/Karakurt-Hacking-Team-CTI: IOC Data Obtained From Karakurt Hacking Team's Internal Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GitHub - infinitumitlabs/Karakurt-Hacking-Team-CTI: IOC Data Obtained From Karakurt Hacking Team's Internal Infrastructure

FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7 | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7 | Mandiant

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research

Phishing campaign targets Russian govt dissidents with Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Phishing campaign targets Russian govt dissidents with Cobalt Strike

From the Front Lines | Hive Ransomware Deploys Novel IPfuscation Technique To Avoid Detection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From the Front Lines | Hive Ransomware Deploys Novel IPfuscation Technique To Avoid Detection

New spear phishing campaign targets Russian dissidents

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New spear phishing campaign targets Russian dissidents

CobaltStrike UUID stager

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CobaltStrike UUID stager

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research

Cobalt Strike: Overview – Part 7

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike: Overview – Part 7

2022_ThreatDetectionReport_RedCanary.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2022_ThreatDetectionReport_RedCanary.pdf

Conti Ransomware V. 3, Including Decryptor, Leaked

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti Ransomware V. 3, Including Decryptor, Leaked

Conti Affiliate Exposed: New Domain Names, IP Addresses and Email Addresses Uncovered by eSentire

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti Affiliate Exposed: New Domain Names, IP Addresses and Email Addresses Uncovered by eSentire

Exposing initial access broker with ties to Conti

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Exposing initial access broker with ties to Conti

Cobalt Strike Analysis and Tutorial: How Malleable C2 Profiles Make Cobalt Strike Difficult to Detect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Analysis and Tutorial: How Malleable C2 Profiles Make Cobalt Strike Difficult to Detect

Qakbot infection with Cobalt Strike and VNC activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Qakbot infection with Cobalt Strike and VNC activity

Qakbot infection with Cobalt Strike and VNC activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Qakbot infection with Cobalt Strike and VNC activity

Threat Actor UAC-0056 Targeting Ukraine with Fake Translation Software

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Actor UAC-0056 Targeting Ukraine with Fake Translation Software

Fake antivirus updates used to deploy Cobalt Strike in Ukraine

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Fake antivirus updates used to deploy Cobalt Strike in Ukraine

Analyzing Malware with Hooks, Stomps, and Return-addresses

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing Malware with Hooks, Stomps, and Return-addresses

CERT-UA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERT-UA

CISA updates Conti ransomware alert with nearly 100 domain names

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CISA updates Conti ransomware alert with nearly 100 domain names

APT41 Targeting U.S. State Government Networks | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT41 Targeting U.S. State Government Networks | Mandiant

2021 Year In Review

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor 2021 Year In Review

Legitimate Sites used as Cobalt Strike C2s against Indian Government

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Legitimate Sites used as Cobalt Strike C2s against Indian Government

Cyberattacks are Prominent in the Russia-Ukraine Conflict

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyberattacks are Prominent in the Russia-Ukraine Conflict

2021trends.pdf

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor 2021trends.pdf

Nobelium Returns to the Political World Stage | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Nobelium Returns to the Political World Stage | FortiGuard Labs

New Wave of Emotet - When Project X Turns Into Y

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Wave of Emotet - When Project X Turns Into Y

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense

What the Pack(er)? | cyber.wtf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What the Pack(er)? | cyber.wtf

Vulnerable Microsoft SQL Servers targeted with Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Vulnerable Microsoft SQL Servers targeted with Cobalt Strike

IcedID to Cobalt Strike In Under 20 Minutes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor IcedID to Cobalt Strike In Under 20 Minutes

Cobalt Strike Being Distributed to Unsecured MS-SQL Servers - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Being Distributed to Unsecured MS-SQL Servers - ASEC

Qbot and Zerologon Lead To Full Domain Compromise

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Qbot and Zerologon Lead To Full Domain Compromise

Detecting Cobalt Strike Beacons

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detecting Cobalt Strike Beacons

Hackers No Hashing | Huntress

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hackers No Hashing | Huntress

Quick Malware Analysis: Emotet Epoch 5 and Cobalt Strike pcap from 2022-02-08

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Quick Malware Analysis: Emotet Epoch 5 and Cobalt Strike pcap from 2022-02-08

Increase in Emotet Activity and Cobalt Strike Deployment

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Increase in Emotet Activity and Cobalt Strike Deployment

THREAT ANALYSIS: Cobalt Strike - IcedID, Emotet and QBot

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor THREAT ANALYSIS: Cobalt Strike - IcedID, Emotet and QBot

VMware Exposing Malware In Linux Based Multi Cloud Environments

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor VMware Exposing Malware In Linux Based Multi Cloud Environments

Analyzing Malware with Hooks, Stomps and Return-addresses

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing Malware with Hooks, Stomps and Return-addresses

Log4j Exploit Hits Again: Vulnerable Unifi Network Application (Ubiquiti) at Risk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Log4j Exploit Hits Again: Vulnerable Unifi Network Application (Ubiquiti) at Risk

What We Can Do against the Chaotic A41APT Campaign（公開版）

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What We Can Do against the Chaotic A41APT Campaign（公開版）

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog

Threats Looming Over the Horizon

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threats Looming Over the Horizon

Cobalt Strike, a Defender’s Guide - Part 2

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Cobalt Strike, a Defender’s Guide - Part 2

Log4j Exploit Hits Again: Vulnerable VMWare Horizon Servers at Risk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Log4j Exploit Hits Again: Vulnerable VMWare Horizon Servers at Risk

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog

2021 Adversary Infrastructure Report

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2021 Adversary Infrastructure Report

Analyzing a CACTUSTORCH HTA Leading to Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing a CACTUSTORCH HTA Leading to Cobalt Strike

VMware Horizon Servers Actively Being Hit With Cobalt Strike | Huntress

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor VMware Horizon Servers Actively Being Hit With Cobalt Strike | Huntress

Threat Analysis Report: DatopLoader Exploits ProxyShell to Deliver QBOT and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Analysis Report: DatopLoader Exploits ProxyShell to Deliver QBOT and Cobalt Strike

Signed DLL campaigns as a service

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Signed DLL campaigns as a service

Inspecting a PowerShell Cobalt Strike Beacon

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Inspecting a PowerShell Cobalt Strike Beacon

NOBELIUM’s EnvyScout infection chain goes in the registry, targeting embassies

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor NOBELIUM’s EnvyScout infection chain goes in the registry, targeting embassies

AQUATIC PANDA in Possession of Log4Shell Exploit Tools | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AQUATIC PANDA in Possession of Log4Shell Exploit Tools | CrowdStrike

Winnti is Coming - Evolution after Prosecution@HITCON2021

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Winnti is Coming - Evolution after Prosecution@HITCON2021

Intelligence Insights: December 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Intelligence Insights: December 2021

What We Think | Business & Technology Insights

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What We Think | Business & Technology Insights

Emotet now drops Cobalt Strike, fast forwards ransomware attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet now drops Cobalt Strike, fast forwards ransomware attacks

Suspected Russian Activity Targeting Government and Business Entities Around the Globe | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Suspected Russian Activity Targeting Government and Business Entities Around the Globe | Mandiant

CERTFR-2021-CTI-011.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERTFR-2021-CTI-011.pdf

Yanluowang: Further Insights on New Ransomware Threat

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Yanluowang: Further Insights on New Ransomware Threat

CONTInuing the Bazar Ransomware Story

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor CONTInuing the Bazar Ransomware Story

Kitten.gif: Meet the Sabbath Ransomware Affiliate Program, Again

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Kitten.gif: Meet the Sabbath Ransomware Affiliate Program, Again

Squirrelwaffle Exploits ProxyShell and ProxyLogon to Hijack Email Chains

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Squirrelwaffle Exploits ProxyShell and ProxyLogon to Hijack Email Chains

DNS Over HTTPS for Cobalt Strike - Black Hills Information Security, Inc.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DNS Over HTTPS for Cobalt Strike - Black Hills Information Security, Inc.

Cobalt Strike: Decrypting Obfuscated Traffic – Part 4

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike: Decrypting Obfuscated Traffic – Part 4

Analyzing ProxyShell-related Incidents via Trend Micro Managed XDR

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing ProxyShell-related Incidents via Trend Micro Managed XDR

Attackers use domain fronting technique to target Myanmar with Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Attackers use domain fronting technique to target Myanmar with Cobalt Strike

ProxyShell, QBot, and Conti ransomware combined in a series of cyber attacks - Truesec

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ProxyShell, QBot, and Conti ransomware combined in a series of cyber attacks - Truesec

Threat Spotlight - Domain Fronting

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Spotlight - Domain Fronting

A multi-stage PowerShell based attack targets Kazakhstan

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A multi-stage PowerShell based attack targets Kazakhstan

Quakbot Strikes with QuakNightmare Exploitation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Quakbot Strikes with QuakNightmare Exploitation

Walking on APT31 infrastructure footprints

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Walking on APT31 infrastructure footprints

THREAT ANALYSIS REPORT: From Shathak Emails to the Conti Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor THREAT ANALYSIS REPORT: From Shathak Emails to the Conti Ransomware

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog

Cobalt Strike: Using Process Memory To Decrypt Traffic – Part 3

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike: Using Process Memory To Decrypt Traffic – Part 3

Detecting CONTI CobaltStrike Lateral Movement Techniques - Part 2 | Cyb3rSn0rlax

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Detecting CONTI CobaltStrike Lateral Movement Techniques - Part 2 | Cyb3rSn0rlax

Cybercrime underground flush with shipping companies’ credentials

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cybercrime underground flush with shipping companies’ credentials

Accenture | Security Solutions

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Accenture | Security Solutions

From Zero to Domain Admin

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor From Zero to Domain Admin

12 targeted for involvement in ransomware attacks against critical infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 12 targeted for involvement in ransomware attacks against critical infrastructure

Національна поліція України

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Національна поліція України

Cobalt Strike: Using Known Private Keys To Decrypt Traffic – Part 2

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike: Using Known Private Keys To Decrypt Traffic – Part 2

SQUIRRELWAFFLE Leverages malspam to deliver Qakbot, Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SQUIRRELWAFFLE Leverages malspam to deliver Qakbot, Cobalt Strike

Detecting CONTI CobaltStrike Lateral Movement Techniques - Part 1 | Cyb3rSn0rlax

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Detecting CONTI CobaltStrike Lateral Movement Techniques - Part 1 | Cyb3rSn0rlax

Stopping GRACEFUL SPIDER: Falcon Complete’s Fast Response to Recent SolarWinds Serv-U Exploit Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Stopping GRACEFUL SPIDER: Falcon Complete’s Fast Response to Recent SolarWinds Serv-U Exploit Campaign

Cobalt Strike: Using Known Private Keys To Decrypt Traffic – Part 1

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike: Using Known Private Keys To Decrypt Traffic – Part 1

Harvester: Nation-State-Backed Group Uses New Toolset to Target Victims in South Asia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Harvester: Nation-State-Backed Group Uses New Toolset to Target Victims in South Asia

Case Study: From BazarLoader to Network Reconnaissance

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Case Study: From BazarLoader to Network Reconnaissance

IcedID to XingLocker Ransomware in 24 hours

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor IcedID to XingLocker Ransomware in 24 hours

Investigation into the state of NIM malware Part 2

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Investigation into the state of NIM malware Part 2

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog

Cobalt Strike | Defining Cobalt Strike Components & BEACON

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike | Defining Cobalt Strike Components & BEACON

Secure AI Build Resilience & Accelerate Value with Accenture

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure AI Build Resilience & Accelerate Value with Accenture

SQUIRRELWAFFLE – Analysing The Main Loader | 0ffset

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SQUIRRELWAFFLE – Analysing The Main Loader | 0ffset

SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot

sneak-peek-ch1-2-finding-beacons-in-the-dark.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor sneak-peek-ch1-2-finding-beacons-in-the-dark.pdf

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog

BazarLoader and the Conti Leaks

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor BazarLoader and the Conti Leaks

PowerPoint-Präsentation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PowerPoint-Präsentation

SQUIRRELWAFFLE – Analysing the Custom Packer | 0ffset

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SQUIRRELWAFFLE – Analysing the Custom Packer | 0ffset

Masters of Mimicry: new APT group ChamelGang and its arsenal

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Masters of Mimicry: new APT group ChamelGang and its arsenal

How CrowdStrike Threat Hunters Identified a Confluence Exploit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How CrowdStrike Threat Hunters Identified a Confluence Exploit

Masters of Mimicry: new APT group ChamelGang and its arsenal

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Masters of Mimicry: new APT group ChamelGang and its arsenal

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense

The Squirrelwaffle: New Loader Delivers Cobalt Strikes |Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Squirrelwaffle: New Loader Delivers Cobalt Strikes |Blog

A Virtual Baffle to Battle SquirrelWaffle

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Virtual Baffle to Battle SquirrelWaffle

Insights into Ransomware Spread Using Exchange 1-Day Vulnerabilities 1-2 - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Insights into Ransomware Spread Using Exchange 1-Day Vulnerabilities 1-2 - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.

Examining the Cring Ransomware Techniques

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Examining the Cring Ransomware Techniques

Ransomware Hackers Attack a Top Safety Testing Org. Using Tactics and Techniques Borrowed from Chinese Espionage Groups

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware Hackers Attack a Top Safety Testing Org. Using Tactics and Techniques Borrowed from Chinese Espionage Groups

The Squirrel Strikes Back: Analysis of the newly emerged cobalt-strike loader “SquirrelWaffle”

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Squirrel Strikes Back: Analysis of the newly emerged cobalt-strike loader “SquirrelWaffle”

A Ransomware Near Miss: ProxyShell, a RAT, and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Ransomware Near Miss: ProxyShell, a RAT, and Cobalt Strike

Scanning VirusTotal's firehose | Sky Blueteam

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Scanning VirusTotal's firehose | Sky Blueteam

4 Popular Defensive Evasion Techniques in 2021 | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 4 Popular Defensive Evasion Techniques in 2021 | CrowdStrike

The default: 63 6f 62 61 6c 74 strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The default: 63 6f 62 61 6c 74 strike

Pointer: Hunting Cobalt Strike globally

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Pointer: Hunting Cobalt Strike globally

Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability | Microsoft Security Blog

Full-Spectrum Cobalt Strike Detection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Full-Spectrum Cobalt Strike Detection

BazarLoader to Conti Ransomware in 32 Hours

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor BazarLoader to Conti Ransomware in 32 Hours

Rendering Threats: A Network Perspective

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rendering Threats: A Network Perspective

Remote Code Execution Zero-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Remote Code Execution Zero-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs

Hook Heaps and Live Free

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hook Heaps and Live Free

Quick analysis CobaltStrike loader and shellcode

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Quick analysis CobaltStrike loader and shellcode

The State of SSL/TLS Certificate Usage in Malware C&C Communications

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The State of SSL/TLS Certificate Usage in Malware C&C Communications

Cobalt Strike and Ransomware – Tracking An Effective Ransomware Campaign - BreakPoint Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike and Ransomware – Tracking An Effective Ransomware Campaign - BreakPoint Labs

奇安信威胁情报中心

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 奇安信威胁情报中心

Cobalt Strike, a Defender's Guide

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Cobalt Strike, a Defender's Guide

Blog Archive

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Blog Archive

https://www.aon.com/cyber-solutions/aon_cyber_labs/cobalt-strike-configuration-extractor-and-parser/

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor https://www.aon.com/cyber-solutions/aon_cyber_labs/cobalt-strike-configuration-extractor-and-parser/

The SideWalk may be as dangerous as the CROSSWALK

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The SideWalk may be as dangerous as the CROSSWALK

Earth Baku Returns: Uncovering the Upgraded Toolset Behind the APT Group’s New Cyberespionage Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Earth Baku Returns: Uncovering the Upgraded Toolset Behind the APT Group’s New Cyberespionage Campaign

210823.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 210823.pdf

An insider insights into Conti operations – Part Two

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor An insider insights into Conti operations – Part Two

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog

How to Detect Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How to Detect Cobalt Strike

An insider insights into Conti operations – Part One

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor An insider insights into Conti operations – Part One

The Ransomware Threat (White Paper)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Ransomware Threat (White Paper)

APT Cobalt Strike Campaign targeting Slovakia (DEF CON talk)

Malpedia library date IstroSec fromORKLCCS '25 data

Archived copy on ORKL Detailsfor APT Cobalt Strike Campaign targeting Slovakia (DEF CON talk)

Red Canary Intel: When Dridex and Cobalt Strike give you Grief

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Red Canary Intel: When Dridex and Cobalt Strike give you Grief

Detecting Cobalt Strike Government-Sponsored Threat Groups (APT32)

date in the CCS '25 data SecureWorks fromCCS '25 data

Detailsfor Detecting Cobalt Strike Government-Sponsored Threat Groups (APT32)

How PROPHET SPIDER Exploits Oracle WebLogic | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How PROPHET SPIDER Exploits Oracle WebLogic | CrowdStrike

Hotcobalt - New Cobalt Strike DoS Vulnerability That Lets You Halt Operations - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hotcobalt - New Cobalt Strike DoS Vulnerability That Lets You Halt Operations - SentinelLabs

DeadRinger: Exposing Chinese Threat Actors Targeting Major Telcos

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DeadRinger: Exposing Chinese Threat Actors Targeting Major Telcos

BazarCall to Conti Ransomware via Trickbot and Cobalt Strike

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor BazarCall to Conti Ransomware via Trickbot and Cobalt Strike

BazaCall: Phony call centers lead to exfiltration and ransomware | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BazaCall: Phony call centers lead to exfiltration and ransomware | Microsoft Security Blog

report-old-dogs-new-tricks.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor report-old-dogs-new-tricks.pdf

Guide to Named Pipes and Hunting for Cobalt Strike Pipes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Guide to Named Pipes and Hunting for Cobalt Strike Pipes

Cobalt Strike Hunting — simple PCAP and Beacon Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cobalt Strike Hunting — simple PCAP and Beacon Analysis

IcedID and Cobalt Strike vs Antivirus

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor IcedID and Cobalt Strike vs Antivirus

LuminousMoth APT: Sweeping attacks for the chosen few

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor LuminousMoth APT: Sweeping attacks for the chosen few

Investigating a Suspicious Service - MDSec

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Investigating a Suspicious Service - MDSec

How we protect users from 0-day attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How we protect users from 0-day attacks

Hancitor tries XLL as initial malware file - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hancitor tries XLL as initial malware file - SANS ISC

Decoding Cobalt Strike: Understanding payloads

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Decoding Cobalt Strike: Understanding payloads