APT Explorer

All actors

HURRICANE PANDA

Also reported as Hurricane Panda. Linked to China by three sources.

Reports
248
Last reported
Known CVEs
154
Origin
China
ID
hurricane-panda
Sources
MISPETDAMalpedia
Merge evidence
2 alias matches

Reports per quarter

Dated reports, 2011 Q2 to 2026 Q3.

Techniques seen in the last two years

Show all 63 techniques Show fewer

Counts come from technique IDs in the actor's report text.

CVEs named in reports

Show all 154 CVEs Show fewer

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

  1. Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident

    Malpedia library date ORKL

    Archived copy on ORKL Details

  2. ChinaZ Revelations: Revealing ChinaZ Relationships with other Chinese Threat Actor Groups

    date ORKL added it ORKL

    Archived copy on ORKL Details

  3. CHINACHOPPER (Malware Family)

    date ORKL added it ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  4. China-based APT Mustang Panda might still have continued their attack activities against organizations in

    date ORKL added it ORKL

    Archived copy on ORKL Details

  5. Accenture | Let there be change

    date ORKL added it ORKL

    Archived copy on ORKL Details

  6. Bitdefender Labs

    date ORKL added it ORKL

    Archived copy on ORKL Details

  7. Accenture | Let there be change

    date ORKL added it ORKL

    Archived copy on ORKL Details

  8. Malware-Free Intrusions: Adversary Tricks and CrowdStrike Treats »

    date ORKL added it ORKL

    The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Details

  9. ICIT Brief – China’s Espionage Dynasty: Economic Death by a Thousand Cuts

    date ORKL added it ORKL

    The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Details

  10. PlugX : Mustang Panda APT

    Malpedia library date ORKL

    Archived copy on ORKL Details

Show all 248 reports Show fewer

  1. PlugX Meeting Invitation via MSBuild and GDATA

    Malpedia library date ORKL

    Archived copy on ORKL Details

  2. The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor

    Malpedia library date ORKL

    Archived copy on ORKL Details

  3. UNC6384 Weaponizes ZDI-CAN-25373 Vulnerability to Deploy PlugX Against Hungarian and Belgian Diplomatic Entities - Arctic Wolf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  4. PRC-Nexus Espionage Campaign Hijacks Web Traffic to Target Diplomats

    Malpedia library date ORKL

    Archived copy on ORKL Details

  5. Lost in Translation: Threat Actors Use SEO Poisoning and Fake DeepL Sites to Distribute Gh0st RAT

    Malpedia library date ORKL

    Archived copy on ORKL Details

  6. Cyber%20Threat%20Intelligence%20Report%202025.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  7. (Larva-25003) 웹 서버 대상 IIS 악성코드 유포 사례 - ASEC

    Malpedia library date ORKL

    Archived copy on ORKL Details

  8. Weaver Ant, the Web Shell Whisperer: Tracking a Live China-nexus Operation

    Malpedia library date ORKL

    Archived copy on ORKL Details

  9. Updated Shadowpad Malware Leads to Ransomware Deployment

    Malpedia library date ORKL

    Archived copy on ORKL Details

  10. Meet NailaoLocker: a ransomware distributed in Europe by ShadowPad and PlugX backdoors

    Malpedia library date ORKL

    Archived copy on ORKL Details

  11. Updated Shadowpad Malware Leads to Ransomware Deployment

    Malpedia library date ORKL

    Archived copy on ORKL Details

  12. China-linked Espionage Tools Used in Ransomware Attacks

    Malpedia library date ORKL

    Archived copy on ORKL Details

  13. CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia

    Malpedia library date ORKL

    Archived copy on ORKL Details

  14. Justice Department and FBI Conduct International Operation to Delete Malware Used by China-Backed Hackers

    Malpedia library date ORKL

    Archived copy on ORKL Details

  15. Chinese State-Sponsored RedDelta Targeted Taiwan, Mongolia, and Southeast Asia with Adapted PlugX Infection Chain

    Malpedia library date ORKL

    Archived copy on ORKL Details

  16. Unmasking Adversary Infrastructure: How Certificates and Redirects Exposed Earth Baxia and PlugX Activity

    Malpedia library date ORKL

    Archived copy on ORKL Details

  17. Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  18. DragonRank, a Chinese-speaking SEO manipulator service provider

    Malpedia library date ORKL

    Archived copy on ORKL Details

  19. Sailing_the_Seven_SEAs_Deep_Dive_into_Polaris_Arsenal_and_Intelligence_Insights.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  20. China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence

    Malpedia library date ORKL

    Archived copy on ORKL Details

  21. Operation Diplomatic Specter: An Active Chinese Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia

    Malpedia library date ORKL

    Archived copy on ORKL Details

  22. Finding Malware: Detecting SOGU with Google Security Operations.

    Malpedia library date ORKL

    Archived copy on ORKL Details

  23. Wirtschaftsspionage gegen Volkwagen: VW-Konzern wurde jahrelang ausge…

    Malpedia library date ORKL

    The title opens archive.today, not the publisher’s page. Archived copy on ORKL Details

  24. Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks

    Malpedia library date ORKL

    Archived copy on ORKL Details

  25. The Secret Life of RATs: connecting the dots by dissecting multiple backdoors

    Malpedia library date ORKL

    Archived copy on ORKL Details

  26. PowerPoint 簡報

    Malpedia library date TeamT5 ORKL

    Archived copy on ORKL Details

  27. A Look into PlugX Kernel driver

    Malpedia library date ORKL

    Archived copy on ORKL Details

  28. 2023 Adversary Infrastructure Report

    Malpedia library date ORKL

    Archived copy on ORKL Details

  29. Unmasking the Enigma: A Historical Dive into the World of PlugX Malware | Splunk

    Malpedia library date ORKL

    Archived copy on ORKL Details

  30. Carderbee Targets Hong Kong in Supply Chain Attack

    Malpedia library date ORKL

    Archived copy on ORKL Details

  31. My Tea’s not cold. An overview of China’s cyber threat

    Malpedia library date ORKL

    Archived copy on ORKL Details

  32. Carderbee: APT Group use Legit Software in Supply Chain Attack Targeting Orgs in Hong Kong

    Malpedia library date ORKL

    Archived copy on ORKL Details

  33. RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale

    Malpedia library date ORKL

    Archived copy on ORKL Details

  34. The Spies Who Loved You: Infected USB Drives to Steal Secrets | Mandiant

    Malpedia library date ORKL

    Archived copy on ORKL Details

  35. Chinese Threat Actors Targeting Europe in SmugX Campaign

    Malpedia library date ORKL

    Archived copy on ORKL Details

  36. Through the Cortex XDR Lens: Uncovering a New Activity Group Targeting Governments in the Middle East and Africa - Palo Alto Networks Blog

    Malpedia library date ORKL

    Archived copy on ORKL Details

  37. Lancefly: Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors

    Malpedia library date ORKL

    Archived copy on ORKL Details

  38. New Mustang Panda’s campaing against Australia

    Malpedia library date ORKL

    Archived copy on ORKL Details

  39. Open-Source Gh0st RAT Still Haunting Inboxes 15 Years After Release

    Malpedia library date ORKL

    Archived copy on ORKL Details

  40. Botconf2022-19-FaouCoteCyr.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  41. With KEYPLUG, China’s RedGolf Spies On, Steals From Wide Field of Targets

    Malpedia library date ORKL

    Archived copy on ORKL Details

  42. PlugX Malware Being Distributed via Vulnerability Exploitation

    Malpedia library date ORKL

    Archived copy on ORKL Details

  43. Investigating the PlugX Trojan Disguised as a Legitimate Windows Debugger Tool

    Malpedia library date ORKL

    Archived copy on ORKL Details

  44. Dalbit (m00nlight): Chinese Hacker Group's APT Attack Campaign - ASEC

    Malpedia library date ORKL

    Archived copy on ORKL Details

  45. Mustang Panda APT Group Uses European Commission-Themed Lure to Deliver PlugX Malware

    Malpedia library date ORKL

    Archived copy on ORKL Details

  46. Chinese PlugX Malware Hidden in Your USB Devices?

    Malpedia library date ORKL

    Archived copy on ORKL Details

  47. JSAC2023_2_LT4.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  48. [QuickNote] Another nice PlugX sample

    Malpedia library date ORKL

    Archived copy on ORKL Details

  49. Diving into a PlugX sample of Mustang Panda group

    Malpedia library date ORKL

    Archived copy on ORKL Details

  50. APT41 — The spy who failed to encrypt me

    Malpedia library date ORKL

    Archived copy on ORKL Details

  51. RedDelta Targets European Government Organizations and Continues to Iterate Custom PlugX Variant

    Malpedia library date ORKL

    Archived copy on ORKL Details

  52. Secure Communications Blog

    Malpedia library date ORKL

    Archived copy on ORKL Details

  53. Hitching a ride with Mustang Panda

    Malpedia library date ORKL

    Archived copy on ORKL Details

  54. PlugXローダーの進化

    Malpedia library date ORKL

    Archived copy on ORKL Details

  55. Conceptualizing a Continuum of Cyber Threat Attribution

    date ORKL added it ORKL

    The original link failed its last check. Original publisher Details

  56. Secure Communications Blog

    Malpedia library date ORKL

    Archived copy on ORKL Details

  57. Witchetty: Group Uses Updated Toolset in Attacks on Governments in Middle East

    Malpedia library date ORKL

    Archived copy on ORKL Details

  58. Hunting for Unsigned DLLs to Find APTs

    Malpedia library date ORKL

    Archived copy on ORKL Details

  59. Webworm: Espionage Attackers Testing and Using Older Modified RATs

    Malpedia library date ORKL

    Archived copy on ORKL Details

  60. Dissecting PlugX to Extract Its Crown Jewels

    Malpedia library date Ido Naor ORKL

    Archived copy on ORKL Details

  61. New Wave of Espionage Activity Targets Asian Governments

    Malpedia library date ORKL

    Archived copy on ORKL Details

  62. MustangPanda%20-%20Enemy%20at%20the%20gate_final.pdf

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  63. THREAT ANALYSIS REPORT: PlugX RAT Loader Evolution

    Malpedia library date ORKL

    Archived copy on ORKL Details

  64. Malicious IIS extensions quietly open persistent backdoors into servers | Microsoft Security Blog

    Malpedia library date ORKL

    Archived copy on ORKL Details

  65. Attacks on industrial control systems using ShadowPad | Kaspersky ICS CERT EN

    Malpedia library date ORKL

    Archived copy on ORKL Details

  66. Backdoor via XFF – Mysterious Threat Actor Under Radar

    Malpedia library date ORKL

    Archived copy on ORKL Details

  67. Unknown APT group has targeted Russia repeatedly since Ukraine invasion

    Malpedia library date ORKL

    Archived copy on ORKL Details

  68. Operation Earth Berberoka: An Analysis of a Multivector and Multiplatform APT Campaign Targeting Online Gambling Sites

    Malpedia library date ORKL

    Archived copy on ORKL Details

  69. China-based APT Mustang Panda might still have continued their attack activities against organizations in

    Malpedia library date VinCSS ORKLCCS '25 data

    Archived copy on ORKL Details

  70. Space Pirates: analyzing the tools and connections of a new hacker group

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  71. HUI Loaderの分析 - JPCERT/CC Eyes

    Malpedia library date ORKL

    Archived copy on ORKL Details

  72. AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  73. Mustang Panda deploys a new wave of malware targeting Europe

    Malpedia library date ORKL

    Archived copy on ORKL Details

  74. Moshen Dragon’s Triad-and-Error Approach | Abusing Security Software to Sideload PlugX and ShadowPad

    Malpedia library date ORKL

    Archived copy on ORKL Details

  75. Chinese APT Bronze President Mounts Spy Campaign on Russian Military

    Malpedia library date ORKL

    Archived copy on ORKL Details

  76. yir-cyber-threats-annex-download.pdf

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  77. Botconf2022-40-LunghiHorejsi.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  78. https://documents.trendmicro.com/assets/txt/earth-berberoka-windows-iocs-2.txt

    Malpedia library date ORKL

    Archived copy on ORKL Details

  79. New APT Group Earth Berberoka Targets Gambling Websites With Old and New Malware

    Malpedia library date ORKL

    Archived copy on ORKL Details

  80. Blog |Top 10 Malware March 2022

    Malpedia library date ORKL

    Archived copy on ORKL Details

  81. Hacking activity of SectorB Group in 2021 – Red Alert

    Malpedia library date ORKL

    Archived copy on ORKL Details

  82. Ghidra script to handle stack strings – Max Kersten

    Malpedia library date ORKL

    Archived copy on ORKL Details

  83. Chinese Hackers Target VMware Horizon Servers with Log4Shell to Deploy Rootkit

    Malpedia library date ORKL

    Archived copy on ORKL Details

  84. New Milestones for Deep Panda: Log4Shell and Digitally Signed Fire Chili Rootkits

    Malpedia library date ORKL

    Archived copy on ORKL Details

  85. Mustang Panda's Hodur : Vieux trucs, nouvelle variante de Korplug

    Malpedia library date ORKL

    Archived copy on ORKL Details

  86. Chinese APT Combines Fresh Hodur RAT with Complex Anti-Detection

    Malpedia library date ORKL

    Archived copy on ORKL Details

  87. New Mustang Panda hacking campaign targets diplomats, ISPs

    Malpedia library date ORKL

    Archived copy on ORKL Details

  88. Mustang Panda’s Hodur: Old tricks, new Korplug variant

    Malpedia library date ORKL

    Archived copy on ORKL Details

  89. Gh0stCringe RAT Being Distributed to Vulnerable Database Servers

    Malpedia library date ORKL

    Archived copy on ORKL Details

  90. TA416: Activity, Techniques, & Targeting Explained | Proofpoint US

    Malpedia library date ORKL

    Archived copy on ORKL Details

  91. Adam Kozy Testimony

    Malpedia library date Adam Kozy ORKL

    Archived copy on ORKL Details

  92. Threat Roundup for February 4 to February 11

    Malpedia library date ORKL

    Archived copy on ORKL Details

  93. What We Can Do against the Chaotic A41APT Campaign（公開版）

    Malpedia library date ORKL

    Archived copy on ORKL Details

  94. A “GULP” of PlugX

    Malpedia library date ORKL

    Archived copy on ORKL Details

  95. Tropic Trooper Targets Transportation and Government Organizations

    Malpedia library date ORKL

    Archived copy on ORKL Details

  96. Threat Spotlight: BlackMatter, LockBit, and THOR - Cisco Umbrella

    Malpedia library date ORKL

    Archived copy on ORKL Details

  97. Microsoft Exchange vulnerabilities exploited once again for ransomware, this time with Babuk

    Malpedia library date ORKL

    Archived copy on ORKL Details

  98. Microsoft Word - exorcist whitepaper.docx

    Malpedia library date ORKL

    Archived copy on ORKL Details

  99. Secure Communications Blog

    Malpedia library date ORKL

    Archived copy on ORKL Details

  100. Malware Gh0stTimes Used by BlackTech - JPCERT/CC Eyes

    Malpedia library date ORKL

    Archived copy on ORKL Details

  101. 4 Chinese APT Groups Identified Targeting Mail Server of Afghan Telecommunications Firm Roshan

    date in the CCS '25 data Recorded Future CCS '25 data

    The original link failed its last check. Details

  102. Indonesian intelligence agency compromised in suspected Chinese hack

    Malpedia library date ORKL

    Archived copy on ORKL Details

  103. D1T1%20-%20%20ShadowPad%20-%20A%20Masterpiece%20of%20Privately%20Sold%20Malware%20in%20Chinese%20Espionage%20-%20Yi-Jhen%20Hsieh%20&%20Joey%20Chen.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  104. DeadRinger: Exposing Chinese Threat Actors Targeting Major Telcos

    Malpedia library date ORKL

    Archived copy on ORKL Details

  105. THOR: Previously Unseen PlugX Variant Deployed During Microsoft Exchange Server Attacks by PKPLUG Group

    Malpedia library date ORKL

    Archived copy on ORKL Details

  106. LuminousMoth – PlugX, File Exfiltration and Persistence Revisited

    Malpedia library date ORKL

    Archived copy on ORKL Details

  107. Threat Activity Group RedFoxtrot Linked to China’s PLA Unit 69010; Targets Bordering Asian Countries

    Malpedia library date ORKL

    Archived copy on ORKL Details

  108. BackdoorDiplomacy: Upgrading from Quarian to Turian

    Malpedia library date ORKL

    Archived copy on ORKL Details

  109. RedDelta PlugX Undergoing Changes and Overlapping Again with Mustang Panda PlugX Infrastructure

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  110. Mustang Panda PlugX - 45.251.240.55 Pivot

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  111. PowerPoint 簡報

    Malpedia library date ORKL

    Archived copy on ORKL Details

  112. Lemon Duck spreads its wings: Actors target Microsoft Exchange servers, incorporate new TTPs

    Malpedia library date ORKL

    Archived copy on ORKL Details

  113. Proxylogon: A Coinminer, a Ransomware, and a Botnet Join the Party

    Malpedia library date ORKL

    Archived copy on ORKL Details

  114. Multi-Factor Authentication: Headache for Cyber Actors Inspires New Attack Techniques

    Malpedia library date ORKL

    Archived copy on ORKL Details

  115. Analysis of top non-HTTP/S threats | Zscaler Blog

    Malpedia library date ORKL

    Archived copy on ORKL Details

  116. Water Pamola Attacked Online Shops Via Malicious Orders

    Malpedia library date ORKL

    Archived copy on ORKL Details

  117. Microsoft Word - Appendix_Water-Pamola-Attacked-Online-Shops.docx

    Malpedia library date ORKL

    Archived copy on ORKL Details

  118. Hello Ransomware Uses Updated China Chopper Web Shell, SharePoint Vulnerability

    Malpedia library date ORKL

    Archived copy on ORKL Details

  119. Microsoft Exchange Breach in Jan. 2021

    Malpedia library date ORKL

    Archived copy on ORKL Details

  120. Actor Exploits Microsoft Exchange Server Vulnerabilities, Cortex XDR Blocks Harvesting of Credentials

    Malpedia library date ORKL

    Archived copy on ORKL Details

  121. Study of targeted attacks on Russian research institutes

    Malpedia library date ORKL

    Archived copy on ORKL Details

  122. RedEcho group parks domains after public exposure

    Malpedia library date ORKL

    Archived copy on ORKL Details

  123. Imperva Observes Hive of Activity Following Hafnium Microsoft Exchange Disclosures

    Malpedia library date ORKL

    Archived copy on ORKL Details

  124. Web Shell Threat Hunting with Azure Sentinel

    Malpedia library date ORKL

    Archived copy on ORKL Details

  125. Analyzing attacks taking advantage of the Exchange Server vulnerabilities

    Malpedia library date ORKL

    Archived copy on ORKL Details

  126. https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/hafnium-china-chopper-and-aspnet-runtime/

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  127. You Don't Know the HAFNIUM of it...

    Malpedia library date ORKL

    Archived copy on ORKL Details

  128. Microsoft Exchange Server Attack Timeline

    Malpedia library date ORKL

    Archived copy on ORKL Details

  129. Tactics, Techniques, and Procedures (TTPs) Used by HAFNIUM to Target Microsoft Exchange Servers

    Malpedia library date ORKL

    Archived copy on ORKL Details

  130. Lessons from Exchange Exploitation for Defenders

    Malpedia library date ORKL

    Archived copy on ORKL Details

  131. Exchange servers under siege from at least 10 APT groups

    Malpedia library date ORKL

    Archived copy on ORKL Details

  132. Remediation Steps for the Microsoft Exchange Server Vulnerabilities

    Malpedia library date ORKL

    Archived copy on ORKL Details

  133. Microsoft Exchange attacks: how to detect, mitigate, and stay calm

    Malpedia library date ORKL

    Archived copy on ORKL Details

  134. Reproducing the Microsoft Exchange Proxylogon Exploit Chain

    Malpedia library date ORKL

    Archived copy on ORKL Details

  135. Analyzing Attacks Against Microsoft Exchange Server With China Chopper Webshells

    Malpedia library date ORKL

    Archived copy on ORKL Details

  136. How Symantec Stops Microsoft Exchange Server Attacks

    Malpedia library date ORKL

    Archived copy on ORKL Details

  137. Detection and Response to Exploitation of Microsoft Exchange Zero-Day Vulnerabilities | Mandiant

    Malpedia library date ORKL

    Archived copy on ORKL Details

  138. https://www.huntress.com/hubfs/Videos/Webinars/Overlay-Mass_Exploitation_of_Exchange.mp4

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  139. Rapid Response: Mass Exploitation of On-Prem Exchange Servers | Huntress

    Malpedia library date ORKL

    Archived copy on ORKL Details

  140. HAFNIUM targeting Exchange Servers with 0-day exploits | Microsoft Security Blog

    Malpedia library date ORKL

    Archived copy on ORKL Details

  141. Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities

    Malpedia library date ORKL

    Archived copy on ORKL Details

  142. China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions

    Malpedia library date ORKL

    Archived copy on ORKL Details

  143. Cyber Threats 2020: A Year in Retrospect

    Malpedia library date ORKL

    Archived copy on ORKL Details

  144. Report2021GTR.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  145. Gh0stRat Anti-Debugging : Nested SEH (try - catch) to Decrypt and Load its Payload

    Malpedia library date ORKL

    Archived copy on ORKL Details

  146. Operation NightScout: Supply-chain attack targets online gaming in Asia

    Malpedia library date ORKL

    Archived copy on ORKL Details

  147. Chopper ASPX Web Shell Used in Targeted Attack

    Malpedia library date ORKL

    Archived copy on ORKL Details

  148. Investigation into PlugX Uncovers Unique APT Technique

    Malpedia library date ORKL

    Archived copy on ORKL Details

  149. CRACKING A SOFT CELL IS HARDER THAN YOU THINK

    Malpedia library date ORKL

    Archived copy on ORKL Details

  150. Higaisa or Winnti? APT41 backdoors, old and new

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  151. China's APT hackers move to ransomware attacks

    Malpedia library date ORKL

    Archived copy on ORKL Details

  152. RAT used by Chinese cyberspies infiltrating Indian businesses

    Malpedia library date ORKL

    Archived copy on ORKL Details

  153. Operation StealthyTrident: corporate software under attack

    Malpedia library date ORKL

    Archived copy on ORKL Details

  154. Cyber Actors Target K-12 Distance Learning Education to Cause Disruptions and Steal Data | CISA

    Malpedia library date ORKL

    Archived copy on ORKL Details

  155. No pandas, just people: The current state of China’s cybercrime underground

    Malpedia library date ORKL

    Archived copy on ORKL Details

  156. APT group targeting governmental agencies in East Asia

    Malpedia library date ORKL

    Archived copy on ORKL Details

  157. Investigation with a twist: an accidental APT attack and averted data destruction

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  158. TA416's Golang PlugX Malware Loader | Proofpoint US

    Malpedia library date ORKL

    Archived copy on ORKL Details

  159. Weaponizing Open Source Software for Targeted Attacks

    Malpedia library date ORKL

    Archived copy on ORKL Details

  160. APT trends report Q3 2020

    Malpedia library date ORKL

    Archived copy on ORKL Details

  161. Potential for China Cyber Response to Heightened U.S.–China Tensions | CISA

    Malpedia library date ORKL

    Archived copy on ORKL Details

  162. APT41: Indictments Put Chinese Espionage Group in the Spotlight

    Malpedia library date Symantec ORKLCCS '25 data

    Archived copy on ORKL Details

  163. MAR-10297887-1.v2 – Iranian Web Shells | CISA

    Malpedia library date ORKL

    Archived copy on ORKL Details

  164. Back Despite Disruption: RedDelta Resumes Operations

    Malpedia library date Insikt Group® ORKL

    Archived copy on ORKL Details

  165. Iran-Based Threat Actor Exploits VPN Vulnerabilities | CISA

    Malpedia library date ORKL

    Archived copy on ORKL Details

  166. Research Roundup: Activity on Previously Identified APT33 Domains | ThreatConnect

    Malpedia library date ThreatConnect ORKLCCS '25 data

    Archived copy on ORKL Details

  167. ESET_Threat_Report_Q22020.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  168. APT trends report Q2 2020

    Malpedia library date ORKL

    Archived copy on ORKL Details

  169. Two Chinese Hackers Working with the Ministry of State Security Charged with Global Computer Intrusion Campaign Targeting Intellectual Property and Confidential Business Information, Including COVID-19 Research

    Malpedia library date ORKL

    Archived copy on ORKL Details

  170. What even is Winnti? - Risky Business Media

    Malpedia library date ORKL

    Archived copy on ORKL Details

  171. Chinese state hackers target Hong Kong Catholic Church

    Malpedia library date ORKL

    Archived copy on ORKL Details

  172. Accenture | Let there be change

    Malpedia library date ORKL

    Archived copy on ORKL Details

  173. Deep-dive: The DarkHotel APT

    Malpedia library date Bushido Token ORKLCCS '25 data

    Archived copy on ORKL Details

  174. COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  175. Cycldek: Bridging the (air) gap

    Malpedia library date ORKL

    Archived copy on ORKL Details

  176. Mustang Panda Recent Activity: Dll-Sideloading trojans with temporal C2 servers

    Malpedia library date ORKL

    Archived copy on ORKL Details

  177. What happened between the BigBadWolf and the Tiger?

    Malpedia library date ORKL

    Archived copy on ORKL Details

  178. APT group planted backdoors targeting high profile networks in Central Asia

    Malpedia library date ORKL

    Archived copy on ORKL Details

  179. The energy reserves in the Eastern Mediterranean Sea and a malicious campaign of APT10 against Turkey

    Malpedia library date Lab52 ORKLCCS '25 data

    Archived copy on ORKL Details

  180. COVID-19 Themes Are Being Utilized by Threat Actors of Varying Sophistication

    Malpedia library date ORKL

    Archived copy on ORKL Details

  181. Phân tích mã độc lợi dụng dịch Covid-19 để phát tán giả mạo “Chỉ thị của thủ tướng Nguyễn Xuân Phúc” - Phần

    Malpedia library date ORKL

    Archived copy on ORKL Details

  182. Is APT 27 Abusing COVID-19 To Attack People !

    date in the CCS '25 data Yoroi CCS '25 data

    The original link failed its last check. Details

  183. Phân tích mã độc lợi dụng dịch Covid-19 để phát tán giả mạo “Chỉ thị của thủ tướng Nguyễn Xuân Phúc” - Phần 1 - VinCSS Blog

    Malpedia library date ORKL

    Archived copy on ORKL Details

  184. the adversary playbook for the long-standing espionage activity of a Chinese nation-state adversary

    Malpedia library date ORKL

    Archived copy on ORKL Details

  185. Operation DRBControl: Uncovering a Cyberespionage Campaign Targeting Gambling Companies in Southeast Asia

    Malpedia library date ORKL

    Archived copy on ORKL Details

  186. CLAMBLING - A New Backdoor Base On Dropbox (EN)

    Malpedia library date ORKL

    Archived copy on ORKL Details

  187. Microsoft Word - Threat Intelligence and the Limits of Malware Analysis_smc1.docx

    Malpedia library date ORKL

    Archived copy on ORKL Details

  188. GALLIUM: Targeting global telecom

    Malpedia library date ORKL

    Archived copy on ORKL Details

  189. Fresh PlugX October 2019

    Malpedia library date ORKL

    Archived copy on ORKL Details

  190. APT cases exploiting vulnerabilities in region‑specific software

    Malpedia library date ORKL

    Archived copy on ORKL Details

  191. 腾讯iOA官网(腾讯自研自用的一体化办公安全平台）-免费使用

    Malpedia library date ORKL

    Archived copy on ORKL Details

  192. Analytics

    Malpedia library date Positive Technologies ORKLCCS '25 data

    The original link failed its last check. Original publisher Details

  193. New threat group behind Airbus cyber attacks, claim researchers

    Malpedia library date ORKL

    Archived copy on ORKL Details

  194. PKPLUG: Chinese Cyber Espionage Group Attacking Southeast Asia

    Malpedia library date ORKL

    Archived copy on ORKL Details

  195. Cryptocurrency miners aren’t dead yet: Documenting the voracious but simple “Panda”

    Malpedia library date ORKL

    Archived copy on ORKL Details

  196. China Chopper still active 9 years later

    Malpedia library date ORKL

    Archived copy on ORKL Details

  197. GAME OVER: Detecting and Stopping an APT41 Operation | Mandiant

    Malpedia library date ORKL

    Archived copy on ORKL Details

  198. Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers

    Malpedia library date ORKL

    Archived copy on ORKL Details

  199. Into the Fog - The Return of ICEFOG APT

    Malpedia library date ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  200. Emissary Panda Attacks Middle East Government SharePoint Servers

    Malpedia library date ORKL

    Archived copy on ORKL Details

  201. Uncovering New Activity By APT10 | FortiGuard Labs

    Malpedia library date ORKL

    Archived copy on ORKL Details

  202. 중국 기반 해커, 국내 에너지 기관 공격

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  203. SectorM04 Targeting Singapore – An Analysis – Red Alert

    Malpedia library date ORKL

    Archived copy on ORKL Details

  204. ChinaZ Revelations: Revealing ChinaZ Relationships with other Chinese Threat Actor Groups

    Malpedia library date ORKL

    Archived copy on ORKL Details

  205. (C)0ld Case : From Aerospace to China’s interests.

    Malpedia library date ORKL

    Archived copy on ORKL Details

  206. Hex-Rays Microcode API vs. Obfuscating Compiler – Hex Rays

    Malpedia library date ORKL

    Archived copy on ORKL Details

  207. Operation Red Signature Targets South Korean Companies

    Malpedia library date ORKL

    Archived copy on ORKL Details

  208. Malicious document targets Vietnamese officials

    Malpedia library date ORKL

    Archived copy on ORKL Details

  209. Malware Analysis – PlugX – Part 2

    Malpedia library date ORKL

    Archived copy on ORKL Details

  210. Cyber Security Research

    Malpedia library date ORKL

    Archived copy on ORKL Details

  211. Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries | Mandiant

    Malpedia library date ORKL

    Archived copy on ORKL Details

  212. Time of death? A therapeutic postmortem of connected medicine

    Malpedia library date ORKL

    Archived copy on ORKL Details

  213. Malware Analysis – PlugX

    Malpedia library date ORKL

    Archived copy on ORKL Details

  214. Bitdefender Labs

    Malpedia library date Bitdefender ORKLCCS '25 data

    Archived copy on ORKL Details

  215. Malware-Traffic-Analysis.net - 2018-01-04 - PCRAT/Gh0st infection

    Malpedia library date ORKL

    Archived copy on ORKL Details

  216. An End to “Smash-and-Grab” and a Move to More Targeted Approaches

    Malpedia library date ORKL

    Archived copy on ORKL Details

  217. North Korea Bitten by Bitcoin Bug: Financially motivated campaigns reveal new dimension of the Lazarus Group | Proofpoint US

    Malpedia library date ORKL

    Archived copy on ORKL Details

  218. PlugXと攻撃者グループ "DragonOK"の関連性 | LAC WATCH

    Malpedia library date ORKL

    Archived copy on ORKL Details

  219. Paranoid PlugX

    Malpedia library date ORKL

    Archived copy on ORKL Details

  220. Intrusions Affecting Multiple Victims Across Multiple Sectors | CISA

    Malpedia library date ORKL

    Archived copy on ORKL Details

  221. RedLeaves - Malware Based on Open Source RAT - JPCERT/CC Eyes

    Malpedia library date ORKL

    Archived copy on ORKL Details

  222. [HackCon] Silent Rifle Response Against Advanced Threat

    Malpedia library date ORKL

    Archived copy on ORKL Details

  223. Unpacking the spyware disguised as antivirus | Malwarebytes Labs

    Malpedia library date ORKL

    Archived copy on ORKL Details

  224. ICIT-Brief-China-Espionage-Dynasty

    date in the CCS '25 data Debra Obyrne ORKLCCS '25 data

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  225. security_report_20160613.pdf

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  226. Targeted Attack Distributes PlugX in Russia | Proofpoint US

    Malpedia library date ORKL

    Archived copy on ORKL Details

  227. Uncovering the Seven Pointed Dagger

    Malpedia library date Arbor Networks ORKLCCS '25 data

    The link to Mirror on Box failed its last check. Mirror on Box Details

  228. Cyber Deterrence in Action- A story of one long HURRICANE PANDA campaign

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  229. Global Threat Intel Report

    Malpedia library date Crowdstrike ORKL

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  230. Storm Chasing- Hunting Hurricane Panda

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  231. Security vendors take action against Hidden Lynx malware

    Malpedia library date ORKL

    The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Details

  232. CrowdStrike Discovers Use of 64-bit Exploit by Hurricane Panda

    Malpedia library date ORKL

    Archived copy on ORKL Details

  233. CrowdStrike Discovers Use of 64-bit Zero-Day Privilege Escalation Exploit (CVE-2014-4113) by Hurricane Panda

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  234. SonicALERT: CVE 2014-0322 Malware - Sakurel (Feb 21, 2014)

    Malpedia library date ORKL

    The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Details

  235. Breaking Down the China Chopper Web Shell - Part I | Mandiant

    Malpedia library date ORKL

    Archived copy on ORKL Details

  236. BKDR_RARSTONE: New RAT to Watch Out For - TrendLabs Security Intelligence Blog

    Malpedia library date ORKL

    The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Details

  237. China Chopper Webshell - the 4KB that Owns your Web Server

    Malpedia library date ORKL

    Archived copy on ORKL Details

  238. Inside a Back Door Attack

    Malpedia library date ORKL

    The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Details

Newest first. Details opens the report in Explore.