Click here to download all references as Bib-File.•
| 2026-05-08
⋅
Lab52
⋅
Easter Bunny. APT29's most advanced implant |
| 2026-02-26
⋅
Lab52
⋅
PlugX Meeting Invitation via MSBuild and GDATA PlugX |
| 2025-09-03
⋅
Lab52
⋅
Analyzing NotDoor: Inside APT28’s Expanding Arsenal GONEPOSTAL |
| 2024-02-19
⋅
Lab52
⋅
Pelmeni Wrapper: New Wrapper of Kazuar (Turla Backdoor) Pelmeni |
| 2023-12-11
⋅
Lab52
⋅
Mustang Panda’s PlugX new variant targetting Taiwanese government and diplomats DOPLUGS |
| 2023-07-12
⋅
Lab52
⋅
New invitation from APT29 to use CCleaner Unidentified 107 (APT29) |
| 2023-07-07
⋅
Lab52
⋅
Beyond appearances: unknown actor using APT29’s TTP against Chinese users Cobalt Strike |
| 2023-05-25
⋅
Lab52
⋅
New tricks of APT29 – update on the CERT.PL report |
| 2023-05-03
⋅
Lab52
⋅
New Mustang Panda’s campaing against Australia PlugX |
| 2023-03-24
⋅
Lab52
⋅
Bypassing Qakbot Anti-Analysis QakBot |
| 2023-03-15
⋅
Lab52
⋅
APT-C-36: from NjRAT to LimeRAT AsyncRAT NjRAT |
| 2022-06-21
⋅
MuddyWater’s “light” first-stager targetting Middle East Unidentified VBS 004 (RAT) |
| 2022-04-01
⋅
Lab52
⋅
Complete dissection of an APK with a suspicious C2 Server |
| 2022-03-24
⋅
Lab52
⋅
Another cyber espionage campaign in the Russia-Ukrainian ongoing cyber attacks Quasar RAT |
| 2022-03-09
⋅
Lab52
⋅
Very very lazy Lazyscripter’s scripts: double compromise in a single obfuscation NjRAT |
| 2022-02-28
⋅
Lab52
⋅
Looking for Penquins in the Wild Penquin Turla |
| 2022-01-24
⋅
Lab52
⋅
New TransparenTribe Operation: Targeting India with weaponized COVID-19 lure documents |
| 2022-01-12
⋅
Lab52
⋅
TokyoX: DLL side-loading an unknown artifact (Part 2) TokyoX |
| 2022-01-10
⋅
Lab52
⋅
TokyoX: DLL side-loading an unknown artifact TokyoX |
| 2021-12-14
⋅
Lab52
⋅
Cuba Ransomware Analysis Cuba |