HenBox

Reports per quarter

Techniques seen in the last two years

• T1003.001 1 report
• T1008 1 report
• T1016 1 report
• T1021.002 1 report
• T1027.001 1 report
• T1027.002 1 report
• T1033 1 report
• T1036.004 1 report
• T1036.005 1 report
• T1040 1 report

Counts come from technique IDs in the actor's report text.

CVEs named in reports

• CVE-2012-0158 KEV ransomware
• CVE-2017-0213 KEV ransomware

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

1. 6 April 2026

   Space Pirates: исследуем инструменты и связи новой хакерской группировки

   date ORKL added it fromORKL

   The original link failed its last check. Original publisher Detailsfor Space Pirates: исследуем инструменты и связи новой хакерской группировки

2. 17 May 2022

   Space Pirates analyzing the tools and connections of a new hacker group

   date in the title fromORKL

   The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Space Pirates analyzing the tools and connections of a new hacker group

3. 17 May 2022

   Space Pirates: analyzing the tools and connections of a new hacker group

   Malpedia library date fromORKL

   The original link failed its last check. Original publisher Detailsfor Space Pirates: analyzing the tools and connections of a new hacker group

4. 18 October 2021

   Microsoft Word - exorcist whitepaper.docx

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Microsoft Word - exorcist whitepaper.docx

5. 1 July 2020

   Multiyear Surveillance Campaigns Discovered Targeting Uyghurs

   date in the title fromORKL

   The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Multiyear Surveillance Campaigns Discovered Targeting Uyghurs

6. 1 June 2020

   lookout-uyghur-malware-tr-us

   Malpedia library date fromORKL

   The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor lookout-uyghur-malware-tr-us

7. 2 March 2020

   Pulling the PKPLUG- the adversary playbook for the long-standing espionage activity of a Chinese nation-state adversary

   date in the title fromORKL

   The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Pulling the PKPLUG- the adversary playbook for the long-standing espionage activity of a Chinese nation-state adversary

8. 2 March 2020

   the adversary playbook for the long-standing espionage activity of a Chinese nation-state adversary

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor the adversary playbook for the long-standing espionage activity of a Chinese nation-state adversary

9. 3 October 2019

   PKPLUG_ Chinese Cyber Espionage Group Attacking Asia

   date in the CCS '25 data Palo Alto fromORKLCCS '25 data

   The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor PKPLUG_ Chinese Cyber Espionage Group Attacking Asia

10. 3 October 2019

    PKPLUG- Chinese Cyber Espionage Group Attacking Asia

    date in the title fromORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor PKPLUG- Chinese Cyber Espionage Group Attacking Asia

Newest first. Details opens the report in Explore.