REF5961

Reports per quarter

Techniques seen in the last two years

• T1091 1 report
• T1190 1 report
• T1195 1 report
• T1557 1 report
• T1566.001 1 report
• T1566.002 1 report
• T1566.003 1 report
• T1659 1 report

Counts come from technique IDs in the actor's report text.

CVEs named in reports

• CVE-2021-34523 KEV ransomware
• CVE-2023-36884 KEV ransomware
• CVE-2024-11182 KEV
• CVE-2024-49039 KEV ransomware
• CVE-2024-9680 KEV ransomware

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

1. 14 May 2025

   継続するEAGERBEE（Thumtais）マルウェアの活動 | LAC WATCH

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor 継続するEAGERBEE（Thumtais）マルウェアの活動 | LAC WATCH

2. 12 May 2025

   ESET APT Activity Report Q4 2024-Q1 2025

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor ESET APT Activity Report Q4 2024-Q1 2025

3. 5 June 2024

   日本の組織を狙うマルウェア「Thumtais」 | LAC WATCH

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor 日本の組織を狙うマルウェア「Thumtais」 | LAC WATCH

4. 13 October 2023

   Disclosing the BLOODALCHEMY backdoor

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Disclosing the BLOODALCHEMY backdoor

5. 3 October 2023

   Introducing the REF5961 intrusion set

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Introducing the REF5961 intrusion set

Newest first. Details opens the report in Explore.