Operation Crimson Palace

Reports per quarter

Techniques seen in the last two years

• T1091 1 report
• T1190 1 report
• T1195 1 report
• T1557 1 report
• T1566.001 1 report
• T1566.002 1 report
• T1566.003 1 report
• T1659 1 report

Counts come from technique IDs in the actor's report text.

CVEs named in reports

• CVE-2021-34523 KEV ransomware
• CVE-2023-36884 KEV ransomware
• CVE-2024-11182 KEV
• CVE-2024-49039 KEV ransomware
• CVE-2024-9680 KEV ransomware

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

1. 14 May 2025

   継続するEAGERBEE（Thumtais）マルウェアの活動 | LAC WATCH

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor 継続するEAGERBEE（Thumtais）マルウェアの活動 | LAC WATCH

2. 12 May 2025

   ESET APT Activity Report Q4 2024-Q1 2025

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor ESET APT Activity Report Q4 2024-Q1 2025

Newest first. Details opens the report in Explore.