Lucky Cat
Also reported as TA413 and White Dev 9. Linked to China by one source.
Reports per quarter
Techniques seen in the last two years
- T1005 1 report
- T1027.009 1 report
- T1036.005 1 report
- T1041 1 report
- T1071.001 1 report
- T1123 1 report
- T1125 1 report
- T1189 1 report
- T1204.002 1 report
- T1509 1 report
Show all 17 techniques Show fewer
Counts come from technique IDs in the actor's report text.
CVEs named in reports
- CVE-2009-0563 KEV
- CVE-2010-0188 KEV ransomware
- CVE-2010-2883 KEV
- CVE-2010-3333 KEV
- CVE-2010-3654
- CVE-2011-0611 KEV
- CVE-2011-2462 KEV
- CVE-2012-1856 KEV
- CVE-2012-1889 KEV
- CVE-2014-0322 KEV
- CVE-2015-2545 KEV
- CVE-2015-5119 KEV
Show all 20 CVEs Show fewer
- CVE-2017-0199 KEV ransomware
- CVE-2017-11882 KEV ransomware
- CVE-2017-8759 KEV
- CVE-2018-0798 KEV
- CVE-2018-0802 KEV ransomware
- CVE-2019-0604 KEV ransomware
- CVE-2022-1040 KEV
- CVE-2022-30190 KEV ransomware
KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.
Reports
-
Threat Group Cards: A Threat Actor Encyclopedia
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia
-
Threat Group Cards: A Threat Actor Encyclopedia
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia
-
The Approach of TA413 for Tibetan Targets
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Approach of TA413 for Tibetan Targets
Show all 29 reports Show fewer
-
Rising Tide- Chasing the Currents of Espionage in the South China Sea
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Rising Tide- Chasing the Currents of Espionage in the South China Sea
-
CVE-2022-30190- Microsoft Support Diagnostic Tool (MSDT) RCE Vulnerability “Follina”
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor CVE-2022-30190- Microsoft Support Diagnostic Tool (MSDT) RCE Vulnerability “Follina”
-
Investigating TA413 Threat Actor Group Using OpenCTI in Maltego
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Investigating TA413 Threat Actor Group Using OpenCTI in Maltego
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor proofpoint.com-TA413 Leverages New FriarFox Browser Extension to Target the Gmail Accounts of Global Tibetan Organiz
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor TA413 Leverages New FriarFox Browser Extension to Target the Gmail Accounts of Global Tibetan Organizations
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Chinese APT TA413 Resumes Targeting of Tibet Following COVID-19 Themed Economic Espionage Campaign Delivering Sepulcher Malware Targeting Europe
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Chinese APT TA413 Resumes Targeting of Tibet Following COVID-19 Themed Economic Espionage Campaign Delivering Sepulcher Malware Targeting Europe _ Proofpoint US
-
ExileRAT shares C2 with LuckyCat, targets Tibet
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor ExileRAT shares C2 with LuckyCat, targets Tibet
-
New Version of OSX.SabPub & Confirmed Mac APT attacks - Securelist
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor New Version of OSX.SabPub & Confirmed Mac APT attacks - Securelist
-
The link to Mirror on Box failed its last check. Mirror on Box Detailsfor The Luckycat Hackers
-
Luckycat Redux: Inside an APT Campaign with Multiple Targets in India and Japan
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Luckycat Redux: Inside an APT Campaign with Multiple Targets in India and Japan
-
LUCKYCAT REDUX Inside an APT Campaign with Multiple Targets in India and Japan
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor LUCKYCAT REDUX Inside an APT Campaign with Multiple Targets in India and Japan
Newest first. Details opens the report in Explore.