APT Explorer

All actors

Hive0137

Reports
35
Last reported
Known CVEs
2
ID
hive0137
Sources
MISPMalpedia
Merge evidence
1 alias match

Reports per quarter

Dated reports, 2022 Q3 to 2026 Q2.

Techniques seen in the last two years

Show all 36 techniques Show fewer

Counts come from technique IDs in the actor's report text.

CVEs named in reports

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

  1. Emerging Ransomware BQTLock & GREENBLOOD Disrupt Businesses in Minutes

    date ORKL added it ORKL

    Archived copy on ORKL Details

  2. LATAM Businesses Hit by XWorm via Fake Financial Receipts: Full Campaign Analysis

    Malpedia library date ORKL

    Archived copy on ORKL Details

  3. Can’t stop, won’t stop: TA584 innovates initial access | Proofpoint US

    Malpedia library date ORKL

    Archived copy on ORKL Details

  4. Stealth in Layers: Unmasking the Loader used in Targeted Email Campaigns

    Malpedia library date ORKL

    Archived copy on ORKL Details

  5. XWorm Malware Analysis: SOC & IR Perspective on Persistence, C2, and Anti-Analysis Tactics

    Malpedia library date ORKL

    Archived copy on ORKL Details

  6. XWORM Returns to Haunt Systems with Ghost Crypt

    Malpedia library date ORKL

    Archived copy on ORKL Details

  7. XWorm-Malware-Analysis/Reports/XWorm_v3.1_Report_EN.md at main · Yavuzhanzgen/XWorm-Malware-Analysis

    Malpedia library date ORKL

    Archived copy on ORKL Details

  8. XWorm Part 2 - From Downloader to Config Extraction

    Malpedia library date ORKL

    Archived copy on ORKL Details

  9. XWorm Part 1 - Unraveling a Steganography-Based Downloader

    Malpedia library date ORKL

    Archived copy on ORKL Details

  10. Paste.ee Abuse Uncovered: XWorm & AsyncRAT Infrastructure

    Malpedia library date ORKL

    Archived copy on ORKL Details

Show all 35 reports Show fewer

  1. Proton66 Part 2: Compromised WordPress Pages and Malware Campaigns

    Malpedia library date ORKL

    Archived copy on ORKL Details

  2. XWorm Attack Chain: Leveraging Steganography from Phishing Email to Keylogging via C2 Communication

    Malpedia library date ORKL

    Archived copy on ORKL Details

  3. Unpacking Pyarmor v8+ scripts | cyber.wtf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  4. Defying tunneling: A Wicked approach to detecting malicious network traffic

    Malpedia library date ORKL

    Archived copy on ORKL Details

  5. MalwareAnalysisReports/XWormShellcode/Packer Shellcode Delivering XWorm.md at main · VenzoV/MalwareAnalysisReports

    Malpedia library date ORKL

    Archived copy on ORKL Details

  6. Uncovering Threat Actor Tactics: How Open Directories Provide Insight into XWorm Delivery Strategies

    Malpedia library date ORKL

    Archived copy on ORKL Details

  7. ClickFix Malware & Social Engineering Threat Grows | Proofpoint US

    Malpedia library date ORKL

    Archived copy on ORKL Details

  8. [QuickNote] The Xworm malware is being spread through a phishing email

    Malpedia library date ORKL

    Archived copy on ORKL Details

  9. Hive0137 on AI journey

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  10. NullBulge | Threat Actor Masquerades as Hacktivist Group Rebelling Against AI

    Malpedia library date ORKL

    Archived copy on ORKL Details

  11. Foxit PDF “Flawed Design” Exploitation - Check Point Research

    Malpedia library date ORKL

    Archived copy on ORKL Details

  12. SteganoAmor campaign: TA558 mass-attacking companies and public institutions all around the world

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  13. Introduction To Malware Infrastructure Analysis With Passive DNS

    Malpedia library date ORKL

    Archived copy on ORKL Details

  14. Spam trends campaigns senior superlatives 2023

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  15. Malware Analysis — Xworm

    Malpedia library date ORKL

    Archived copy on ORKL Details

  16. The Accidental Malware Repository: Hunting & Collecting Malware Via Open Directories (Part 1)

    Malpedia library date ORKL

    Archived copy on ORKL Details

  17. XWorm Malware: Exploring C&C Communication

    Malpedia library date ORKL

    Archived copy on ORKL Details

  18. Malware stories: Deworming the XWorm

    Malpedia library date ORKL

    Archived copy on ORKL Details

  19. Uncovering DDGroup — A long-time threat actor

    Malpedia library date ORKL

    Archived copy on ORKL Details

  20. XWorm: Technical Analysis of a New Malware Version

    Malpedia library date ORKL

    Archived copy on ORKL Details

  21. NodeStealer 2.0 – The Python Version: Stealing Facebook Business Accounts

    Malpedia library date ORKL

    Archived copy on ORKL Details

  22. Securonix Threat Labs Security Advisory: Latest Update: Ongoing MEME#4CHAN Attack/Phishing Campaign uses Meme-Filled Code to Drop XWorm Payloads

    Malpedia library date ORKL

    Archived copy on ORKL Details

  23. Attack chain leads to XWORM and AGENTTESLA

    Malpedia library date ORKL

    Archived copy on ORKL Details

  24. Research As A Service | Loginsoft

    Malpedia library date ORKL

    Archived copy on ORKL Details

  25. Cyble - EvilCoder Project Selling Multiple Dangerous Tools Online

    Malpedia library date ORKL

    Archived copy on ORKL Details

Newest first. Details opens the report in Explore.