UNC3569

Reports per quarter

CVEs named in reports

• CVE-2017-15944 KEV
• CVE-2018-1207
• CVE-2020-16040
• CVE-2021-26855 KEV ransomware
• CVE-2021-26857 KEV ransomware
• CVE-2021-27065 KEV ransomware
• CVE-2021-31195
• CVE-2021-31196 KEV
• CVE-2021-31206
• CVE-2021-31207 KEV ransomware
• CVE-2021-34473 KEV ransomware
• CVE-2021-34523 KEV ransomware

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

1. 26 January 2026

   PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups

2. 4 October 2024

   it didn't turn into a truck, but a widely spread Android botnet

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor it didn't turn into a truck, but a widely spread Android botnet

3. 4 October 2024

   Virus Bulletin :: TA577 walked just past you: indirect syscalls in Pikabot

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Virus Bulletin :: TA577 walked just past you: indirect syscalls in Pikabot

4. 24 September 2024

   Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdf

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdf

Newest first. Details opens the report in Explore.