Click here to download all references as Bib-File.
| 2023-10-12 ⋅ Cluster25 ⋅ CVE-2023-38831 Exploited by Pro-Russia Hacking Groups in RU-UA Conflict Zone for Credential Harvesting Operations Agent Tesla Crimson RAT Nanocore RAT SmokeLoader |
| 2023-05-22 ⋅ Cluster25 ⋅ Back in Black: BlackByte Ransomware returns with its New Technology (NT) version BlackByte |
| 2022-09-23 ⋅ Cluster25 ⋅ In the footsteps of the Fancy Bear: PowerPoint mouse-over event abused to deliver Graphite implants Graphite |
| 2022-09-15 ⋅ DuskRise ⋅ Erbium InfoStealer Enters the Scene: Characteristics and Origins Erbium Stealer |
| 2022-07-06 ⋅ Cluster25 ⋅ LockBit 3.0: “Making The Ransomware Great Again” LockBit |
| 2022-05-13 ⋅ Cluster25 ⋅ Cozy Smuggled Into The Box: APT29 Abusing Legitimate Software For Targeted Operations In Europe |
| 2022-05-04 ⋅ Twitter (@ESETresearch) ⋅ Twitter thread on code similarity analysis, focussing on IsaacWiper and recent Cluster25 publication IsaacWiper |
| 2022-05-03 ⋅ Cluster25 ⋅ The Strange Link Between A Destructive Malware And A Ransomware-Gang Linked Custom Loader: IsaacWiper Vs Vatet Cobalt Strike IsaacWiper PyXie |
| 2022-04-29 ⋅ Cluster25 ⋅ The LOTUS PANDA Is Awake, Again. Analysis Of Its Last Strike. APT30 Naikon |
| 2022-04-11 ⋅ Cluster25 ⋅ DPRK-Nexus Adversary Targets South-Korean Individuals In A New Chapter of Kitty Phishing Operation |
| 2022-03-08 ⋅ Cluster25 ⋅ GhostWriter / UNC1151 adopts MicroBackdoor Variants in Cyber Operations against Ukraine MicroBackdoor |
| 2022-03-02 ⋅ Cluster25 ⋅ Conti's Source Code: Deep-Dive Into Conti |
| 2022-02-24 ⋅ Ukraine: Analysis Of The New Disk-Wiping Malware (HermeticWiper) HermeticWiper |
| 2022-01-03 ⋅ Cluster25 ⋅ North Korean Group “KONNI” Targets The Russian Diplomatic Sector With New Versions Of Malware Implants Konni |
| 2021-09-10 ⋅ Cluster25 ⋅ A rattlesnake in the Navy |
| 2021-05 ⋅ Cluster25 ⋅ A Not So Fancy Game: Exploring the New SkinnyBoy Bear's Backdoor SkinnyBoy |