Malpedia Library

Click here to download all references as Bib-File.

2021-06-01 ⋅ Rising Threat Intelligence Center ⋅ Rising Threat Intelligence Center
Rising warning: APT organizes Lazarus Group to launch an attack on China

2021-05-28 ⋅ Microsoft ⋅ Microsoft Threat Intelligence Center (MSTIC)
Breaking down NOBELIUM’s latest early-stage toolset
BOOMBOX Cobalt Strike

2021-05-10 ⋅ Anheng Threat Intelligence Center ⋅ Hunting Shadow Lab
Analysis of U.S. Oil Products Pipeline Operators Suspended by Ransomware Attacks
DarkSide

2021-04-20 ⋅ 360 Threat Intelligence Center ⋅ Advanced Threat Institute
Transparent Tribe uses the new crown vaccine hotspot to analyze the targeted attacks on the Indian medical industry
Crimson RAT

2021-03-04 ⋅ Microsoft ⋅ Ramin Nafisi, Andrea Lelli, Microsoft Threat Intelligence Center (MSTIC), Microsoft 365 Defender Threat Intelligence Team
GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence
SUNBURST TEARDROP UNC2452

2021-03-02 ⋅ Microsoft ⋅ Microsoft Threat Intelligence Center (MSTIC)
HAFNIUM targeting Exchange Servers with 0-day exploits
PowerCat

2021-03-02 ⋅ Microsoft ⋅ Microsoft Threat Intelligence Center (MSTIC), Microsoft 365 Defender Threat Intelligence Team, Microsoft 365 Security
HAFNIUM targeting Exchange Servers with 0-day exploits
CHINACHOPPER HAFNIUM

2021-02-10 ⋅ Anheng Threat Intelligence Center ⋅ Hunting Shadow Lab
Windows kernel zero-day exploit (CVE-2021-1732) is used by BITTER APT in targeted attack

2021-01-28 ⋅ Microsoft ⋅ Microsoft Threat Intelligence Center (MSTIC), Microsoft 365 Defender Threat Intelligence Team
ZINC attacks against security researchers
ComeBacker Klackring

2021-01-26 ⋅ 360 Threat Intelligence Center ⋅ Advanced Threat Institute
Shell Break-Lazarus (APT-C-26) organized targeted attacks against security researchers to reveal the secret

2021-01-26 ⋅ Anheng Threat Intelligence Center ⋅ Hunting Shadow Lab
Undefeated, hackers use Visual Studio compiler features to target binary vulnerabilities security researcher

2021-01-21 ⋅ 360 Threat Intelligence Center ⋅ Advanced Threat Institute
Disclosure of Manling Flower Organization (APT-C-08) using Warzone RAT attack
Ave Maria

2021-01-20 ⋅ Microsoft ⋅ Microsoft 365 Defender Research Team, Microsoft Threat Intelligence Center (MSTIC), Microsoft Cyber Defense Operations Center (CDOC)
Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop
Cobalt Strike SUNBURST TEARDROP

2020-12-18 ⋅ Microsoft ⋅ Microsoft 365 Defender Research Team, Microsoft Threat Intelligence Center (MSTIC)
Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers
SUNBURST SUPERNOVA TEARDROP UNC2452

2020-12-16 ⋅ 360 Threat Intelligence Center ⋅ Advanced Threat Institute
旺刺组织（APT-C-47）使用ClickOnce技术的攻击活动披露

2020-12-15 ⋅ 360 Threat Intelligence Center ⋅ Advanced Threat Institute
Operation Falling Eagle-the secret of the most influential supply chain attack in history
SUNBURST

2020-12-01 ⋅ Qianxin ⋅ Qi Anxin Threat Intelligence Center
Blade Eagle Group - Targeted attack group activities circling the Middle East and West Asia's cyberspace revealed
SpyNote BladeHawk

2020-11-30 ⋅ Microsoft ⋅ Microsoft 365 Defender Threat Intelligence Team, Microsoft Threat Intelligence Center (MSTIC)
Threat actor (BISMUTH) leverages coin miner techniques to stay under the radar – here’s how to spot them
Cobalt Strike

2020-11-12 ⋅ Anheng Threat Intelligence Center ⋅ Hunting Shadow Lab
Operation Gold Hunting: Targeting the Cutting-Edge Technology Industry

2020-11-09 ⋅ 360 ⋅ 360 Threat Intelligence Center
Analysis of the latest targeted attacks by Lugansk against Ukraine