GOBLIN PANDA

Threat Activity Group RedFoxtrot Linked to China’s PLA Unit 69010; Targets Bordering Asian Countries

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Activity Group RedFoxtrot Linked to China’s PLA Unit 69010; Targets Bordering Asian Countries

Chinese Cyberspies Target Military Organizations in Asia With New Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chinese Cyberspies Target Military Organizations in Asia With New Malware

Chinese Cyberspies Target Military Organizations in Asia With New Malware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Chinese Cyberspies Target Military Organizations in Asia With New Malware

APT_trends_report_Q1_2021_Securelist

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT_trends_report_Q1_2021_Securelist

APT trends report Q1 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q1 2021

APT trends report Q1 2021

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT trends report Q1 2021

The leap of a Cycldek-related threat actor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The leap of a Cycldek-related threat actor

The leap of a Cycldek-related threat actor

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The leap of a Cycldek-related threat actor

COVID-19 Phishing With a Side of Cobalt Strike

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor COVID-19 Phishing With a Side of Cobalt Strike

COVID-19 Phishing With a Side of Cobalt Strike - DomainTools | Start Here. Know Now.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor COVID-19 Phishing With a Side of Cobalt Strike - DomainTools | Start Here. Know Now.

Microsoft Word - Global Perspective of the SideWinder APT (pre-release final).docx

Malpedia library date AlienVault fromORKLCCS '25 data

The original link failed its last check. Original publisher Detailsfor Microsoft Word - Global Perspective of the SideWinder APT (pre-release final).docx

nao-sec.org-Royal Road ReDive

date in the CCS '25 data nao_sec fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor nao-sec.org-Royal Road ReDive

Royal Road! Re-Dive

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Royal Road! Re-Dive

nao-sec.org

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor nao-sec.org

Group-IB_Hi-Tech_Crime_Trends_2020-2021_en

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Group-IB_Hi-Tech_Crime_Trends_2020-2021_en

Cycldek aka Goblin Panda- Chronicles of the Goblin

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Cycldek aka Goblin Panda- Chronicles of the Goblin

IT threat evolution Q2 2020

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor IT threat evolution Q2 2020

IT threat evolution Q2 2020

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor IT threat evolution Q2 2020

Cycldek: Bridging the (air) gap

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cycldek: Bridging the (air) gap

Cycldek- Bridging the (air) gap

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Cycldek- Bridging the (air) gap

Cycldek_ Bridging the (air) gap _ Securelist

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Cycldek_ Bridging the (air) gap _ Securelist

using RTF object dimensions to track APT phishing weaponizers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor using RTF object dimensions to track APT phishing weaponizers

Attribution is in the object- using RTF object dimensions to track APT phishing weaponizers

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Attribution is in the object- using RTF object dimensions to track APT phishing weaponizers

02/12/2020 - Goblin Panda APT: Recent infrastructure and RAT analysis

Malpedia library date MeltX0R Security fromORKLCCS '25 data

Archived copy on ORKL Detailsfor 02/12/2020 - Goblin Panda APT: Recent infrastructure and RAT analysis

Goblin Panda APT- Recent infrastructure and RAT analysis

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Goblin Panda APT- Recent infrastructure and RAT analysis

nao-sec.org

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor nao-sec.org

An Overhead View of the Royal Road

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor An Overhead View of the Royal Road

An Overhead View of the Royal Road

file creation date fromORKL

Archived copy on ORKL Detailsfor An Overhead View of the Royal Road

Cyber Threat Landscape in Japan – Revealing Threat in the Shadow

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Cyber Threat Landscape in Japan – Revealing Threat in the Shadow

[CB19] Cyber Threat Landscape in Japan – Revealing Threat in the Shadow by Chi En Shen (Ashley) Oleg Bondarenko

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor [CB19] Cyber Threat Landscape in Japan – Revealing Threat in the Shadow by Chi En Shen (Ashley) Oleg Bondarenko

Rancor- The Year of The Phish

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Rancor- The Year of The Phish

Rancor: The Year of The Phish

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rancor: The Year of The Phish

Multiple Chinese Threat Groups Exploiting CVE-2018-0798 Equation Editor Vulnerability Since Late 2018

date in the CCS '25 data Anomali fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Multiple Chinese Threat Groups Exploiting CVE-2018-0798 Equation Editor Vulnerability Since Late 2018

Into the Fog - The Return of ICEFOG APT

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Into the Fog - The Return of ICEFOG APT

Into the Fog - The Return of ICEFOG APT

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Into the Fog - The Return of ICEFOG APT

Reaver- Mapping Connections Between Disparate Chinese APT Groups

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Reaver- Mapping Connections Between Disparate Chinese APT Groups

Chineses Actor APT target Ministry of Justice Vietnamese

date in the CCS '25 data Medium fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Chineses Actor APT target Ministry of Justice Vietnamese

Goblin Panda continues to target Vietnam

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Goblin Panda continues to target Vietnam

Goblin Panda continues to target Vietnam

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Goblin Panda continues to target Vietnam

Analyzing Digital Quartermasters in Asia – Do Chinese and Indian APTs Have a Shared Supply Chain?

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Analyzing Digital Quartermasters in Asia – Do Chinese and Indian APTs Have a Shared Supply Chain?

Another malicious document with CVE-2017–11882

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Another malicious document with CVE-2017–11882

Goblin Panda changes the dropper and reuses the old infrastructure

date in the CCS '25 data Symantec fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Goblin Panda changes the dropper and reuses the old infrastructure

Là 1937CN hay OceanLotus hay Lazarus …

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Là 1937CN hay OceanLotus hay Lazarus …

Là 1937CN hay OceanLotus hay Lazarus …

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Là 1937CN hay OceanLotus hay Lazarus …

CTA Adversary Playbook: Goblin Panda

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CTA Adversary Playbook: Goblin Panda

CTA Adversary Playbook- Goblin Panda

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor CTA Adversary Playbook- Goblin Panda

Malicious document targets Vietnamese officials

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Malicious document targets Vietnamese officials

Goblin Panda targets Cambodia sharing capacities with another Chinese group hackers Temp Periscope

date in the CCS '25 data FireEye fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Goblin Panda targets Cambodia sharing capacities with another Chinese group hackers Temp Periscope

Goblin Panda Adversary | Threat Actor Profile | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Goblin Panda Adversary | Threat Actor Profile | CrowdStrike

Meet CrowdStrike’s Adversary of the Month for August- GOBLIN PANDA

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Meet CrowdStrike’s Adversary of the Month for August- GOBLIN PANDA

Goblin_Panda_against_Bears

date in the CCS '25 data CrowdStrike fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Goblin_Panda_against_Bears

Goblin Panda against the Bears

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Goblin Panda against the Bears

Goblin Panda against the Bears

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Goblin Panda against the Bears

Malicious document targets Vietnamese officials – Sebdraven – Medium

date in the CCS '25 data Symantec fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Malicious document targets Vietnamese officials – Sebdraven – Medium

Malicious document targets Vietnamese officials

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Malicious document targets Vietnamese officials

Malicious document targets Vietnamese officials

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malicious document targets Vietnamese officials

Malicious document targets Vietnamese officials

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malicious document targets Vietnamese officials

A Deep Dive into Defacement: How Geopolitical Events Trigger Web Attacks

file creation date fromORKL

Archived copy on ORKL Detailsfor A Deep Dive into Defacement: How Geopolitical Events Trigger Web Attacks

Rehashed RAT Used in APT Campaign Against Vietnamese Organizations

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rehashed RAT Used in APT Campaign Against Vietnamese Organizations

Rehashed RAT Used in APT Campaign Against Vietnamese Organizations

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Rehashed RAT Used in APT Campaign Against Vietnamese Organizations

China 1937CN Team hackers attack airports in Vietnam

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor China 1937CN Team hackers attack airports in Vietnam

15GlobalThreatReport.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor 15GlobalThreatReport.pdf

Rhetoric Foreshadows Cyber Activity in the South China Sea

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Rhetoric Foreshadows Cyber Activity in the South China Sea

Rhetoric Foreshadows Cyber Activity in the South China Sea - crowdstrike.com

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rhetoric Foreshadows Cyber Activity in the South China Sea - crowdstrike.com

The Msnmm Campaigns: The Earliest Naikon APT Campaigns

Malpedia library date Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The Msnmm Campaigns: The Earliest Naikon APT Campaigns

2015-05-29 -The MsnMM Campaigns - The Earliest Naikon APT Campaigns

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 2015-05-29 -The MsnMM Campaigns - The Earliest Naikon APT Campaigns

The Chronicles of the Hellsing APT: the Empire Strikes Back

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Chronicles of the Hellsing APT: the Empire Strikes Back

The Chronicles Of The Hellsing APT: The Empire Strikes Back

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The Chronicles Of The Hellsing APT: The Empire Strikes Back

The Chronicles of the Hellsing APT- the Empire Strikes Back

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Chronicles of the Hellsing APT- the Empire Strikes Back

The Chronicles of the Hellsing APT_the Empire Strikes Back

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Chronicles of the Hellsing APT_the Empire Strikes Back

Elite cyber crime group strikes back after attack by rival APT gang

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Elite cyber crime group strikes back after attack by rival APT gang

Global Threat Intel Report

Malpedia library date Crowdstrike fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Global Threat Intel Report

CrowdCasts Monthly- You Have an Adversary Problem

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor CrowdCasts Monthly- You Have an Adversary Problem

CrowdCasts Monthly: You Have an Adversary Problem

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor CrowdCasts Monthly: You Have an Adversary Problem

Samurai Panda | Threat Actor Profile | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Samurai Panda | Threat Actor Profile | CrowdStrike

Anchor Panda | Threat Actor Profile | CrowdStrike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Anchor Panda | Threat Actor Profile | CrowdStrike