All actors

TA410

Also reported as Witchetty, LookingFrog, LookBack and FlowingFrog. Linked to China by two sources.

Reports
33
Last reported
Known CVEs
63
Origin
China
ID
ta410
Merge evidence
6 alias matches

Reports per quarter

  1. 2019 Q3: 2 reports
  2. 2019 Q4: no reports
  3. 2020 Q1: 1 report
  4. 2020 Q2: 5 reports
  5. 2020 Q3: 1 report
  6. 2020 Q4: 2 reports
  7. 2021 Q1: 3 reports
  8. 2021 Q2: 1 report
  9. 2021 Q3: no reports
  10. 2021 Q4: no reports
  11. 2022 Q1: 2 reports
  12. 2022 Q2: 3 reports
  13. 2022 Q3: 2 reports
  14. 2022 Q4: 2 reports
  15. 2023 Q1: no reports
  16. 2023 Q2: 1 report
  17. 2023 Q3: 2 reports
  18. 2023 Q4: 1 report
  19. 2024 Q1: no reports
  20. 2024 Q2: 2 reports
  21. 2024 Q3: no reports
  22. 2024 Q4: no reports
  23. 2025 Q1: no reports
  24. 2025 Q2: no reports
  25. 2025 Q3: no reports
  26. 2025 Q4: no reports
  27. 2026 Q1: no reports
  28. 2026 Q2: 3 reports
Dated reports, 2019 Q3 to 2026 Q2.

CVEs named in reports

Show all 63 CVEs Show fewer

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

  1. CHINACHOPPER (Malware Family)

    date ORKL added it fromORKL

  2. Threat Group Cards: A Threat Actor Encyclopedia

    date ORKL added it fromORKL

  3. Quasar RAT (Malware Family)

    date ORKL added it fromORKL

Show all 33 reports Show fewer
  1. eset_threat_report_t12022

    file creation date fromORKL

  2. eset_threat_report_t32021

    file creation date fromORKL

  3. nao-sec.org-Royal Road ReDive

    date in the CCS '25 data nao_sec fromORKLCCS '25 data

  4. Royal Road! Re-Dive

    date in the title fromORKL

  5. China cyber attacks- the current threat landscape

    date in the title fromORKL

  6. ESET_Threat_Report_Q32020

    file creation date fromORKL

  7. TA410

    file creation date fromORKL

  8. FlowCloud Version 4.1.3 Malware Analysis

    date in the title fromORKL

Newest first. Details opens the report in Explore.