Click here to download all references as Bib-File.

Enter keywords to filter the library entries below or Propose new Entry
2022-08-16KasperskyLeonid Bezvershenko, Igor Kuznetsov
@online{bezvershenko:20220816:two:89002d5, author = {Leonid Bezvershenko and Igor Kuznetsov}, title = {{Two more malicious Python packages in the PyPI}}, date = {2022-08-16}, organization = {Kaspersky}, url = {https://securelist.com/two-more-malicious-python-packages-in-the-pypi/107218/}, language = {English}, urldate = {2022-08-28} } Two more malicious Python packages in the PyPI
W4SP Stealer
2022-07-28KasperskyIgor Kuznetsov, Leonid Bezvershenko
@online{kuznetsov:20220728:lofylife:44645c7, author = {Igor Kuznetsov and Leonid Bezvershenko}, title = {{LofyLife: malicious npm packages steal Discord tokens and bank card data}}, date = {2022-07-28}, organization = {Kaspersky}, url = {https://securelist.com/lofylife-malicious-npm-packages/107014}, language = {English}, urldate = {2022-08-28} } LofyLife: malicious npm packages steal Discord tokens and bank card data
2022-07-28Kaspersky LabsIgor Kuznetsov, Leonid Bezvershenko
@online{kuznetsov:20220728:lofylife:0d316b3, author = {Igor Kuznetsov and Leonid Bezvershenko}, title = {{LofyLife: malicious npm packages steal Discord tokens and bank card data}}, date = {2022-07-28}, organization = {Kaspersky Labs}, url = {https://securelist.com/lofylife-malicious-npm-packages/107014/}, language = {English}, urldate = {2022-08-28} } LofyLife: malicious npm packages steal Discord tokens and bank card data
Lofy
2022-07-19GoogleBilly Leonard
@online{leonard:20220719:continued:2a97da1, author = {Billy Leonard}, title = {{Continued cyber activity in Eastern Europe observed by TAG}}, date = {2022-07-19}, organization = {Google}, url = {https://blog.google/threat-analysis-group/continued-cyber-activity-in-eastern-europe-observed-by-tag}, language = {English}, urldate = {2022-08-05} } Continued cyber activity in Eastern Europe observed by TAG
CyberAzov APT28 Callisto Ghostwriter Sandworm Turla
2022-07-19GoogleBilly Leonard
@online{leonard:20220719:continued:e1dd77e, author = {Billy Leonard}, title = {{Continued cyber activity in Eastern Europe observed by TAG}}, date = {2022-07-19}, organization = {Google}, url = {https://blog.google/threat-analysis-group/continued-cyber-activity-in-eastern-europe-observed-by-tag/}, language = {English}, urldate = {2022-07-25} } Continued cyber activity in Eastern Europe observed by TAG
CyberAzov
2022-07-08Twitter (@billyleonard)Billy Leonard
@online{leonard:20220708:twiiter:d77eb54, author = {Billy Leonard}, title = {{Twiiter thread about some recent Turla activity spoofing the Azov Regiment ... but targeting Android users.}}, date = {2022-07-08}, organization = {Twitter (@billyleonard)}, url = {https://twitter.com/billyleonard/status/1545461166377508865}, language = {English}, urldate = {2022-07-25} } Twiiter thread about some recent Turla activity spoofing the Azov Regiment ... but targeting Android users.
2022-05-12TEAMT5Leon Chang, Silvia Yeh
@techreport{chang:20220512:next:5fd8a83, author = {Leon Chang and Silvia Yeh}, title = {{The Next Gen PlugX/ShadowPad? A Dive into the Emerging China-Nexus Modular Trojan, Pangolin8RAT (slides)}}, date = {2022-05-12}, institution = {TEAMT5}, url = {https://i.blackhat.com/Asia-22/Thursday-Materials/AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf}, language = {English}, urldate = {2022-08-08} } The Next Gen PlugX/ShadowPad? A Dive into the Emerging China-Nexus Modular Trojan, Pangolin8RAT (slides)
KEYPLUG Cobalt Strike CROSSWALK FunnySwitch PlugX ShadowPad Winnti SLIME29 TianWu
2022-05-03GoogleBilly Leonard, Google Threat Analysis Group
@online{leonard:20220503:update:cee4563, author = {Billy Leonard and Google Threat Analysis Group}, title = {{Update on cyber activity in Eastern Europe}}, date = {2022-05-03}, organization = {Google}, url = {https://blog.google/threat-analysis-group/update-on-cyber-activity-in-eastern-europe/}, language = {English}, urldate = {2022-05-04} } Update on cyber activity in Eastern Europe
Curious Gorge
2022-05-03GoogleBilly Leonard
@online{leonard:20220503:update:e2039f6, author = {Billy Leonard}, title = {{Update on cyber activity in Eastern Europe}}, date = {2022-05-03}, organization = {Google}, url = {https://blog.google/threat-analysis-group/update-on-cyber-activity-in-eastern-europe}, language = {English}, urldate = {2022-08-25} } Update on cyber activity in Eastern Europe
Callisto
2022-04-25MandiantDaniel Kapellmann Zafra, Raymond Leong, Chris Sistrunk, Ken Proska, Corey Hildebrandt, Keith Lunden, Nathan Brubaker
@online{zafra:20220425:industroyerv2:5548d98, author = {Daniel Kapellmann Zafra and Raymond Leong and Chris Sistrunk and Ken Proska and Corey Hildebrandt and Keith Lunden and Nathan Brubaker}, title = {{INDUSTROYER.V2: Old Malware Learns New Tricks}}, date = {2022-04-25}, organization = {Mandiant}, url = {https://www.mandiant.com/resources/industroyer-v2-old-malware-new-tricks}, language = {English}, urldate = {2022-04-29} } INDUSTROYER.V2: Old Malware Learns New Tricks
INDUSTROYER2
2022-03-30GoogleBilly Leonard, Google Threat Analysis Group
@online{leonard:20220330:tracking:faab472, author = {Billy Leonard and Google Threat Analysis Group}, title = {{Tracking cyber activity in Eastern Europe}}, date = {2022-03-30}, organization = {Google}, url = {https://blog.google/threat-analysis-group/tracking-cyber-activity-eastern-europe/}, language = {English}, urldate = {2022-03-31} } Tracking cyber activity in Eastern Europe
2022-03-30GoogleBilly Leonard
@online{leonard:20220330:tracking:ff3709f, author = {Billy Leonard}, title = {{Tracking cyber activity in Eastern Europe}}, date = {2022-03-30}, organization = {Google}, url = {https://blog.google/threat-analysis-group/tracking-cyber-activity-eastern-europe}, language = {English}, urldate = {2022-05-08} } Tracking cyber activity in Eastern Europe
Callisto Curious Gorge
2022-03-16TrustwaveHomer Pacag
@online{pacag:20220316:attack:2206ea8, author = {Homer Pacag}, title = {{The Attack of the Chameleon Phishing Page}}, date = {2022-03-16}, organization = {Trustwave}, url = {https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-attack-of-the-chameleon-phishing-page/}, language = {English}, urldate = {2022-03-17} } The Attack of the Chameleon Phishing Page
2022-03-09BreachQuestMarco Figueroa, Napoleon Bing, Bernard Silvestrini
@online{figueroa:20220309:conti:d237b64, author = {Marco Figueroa and Napoleon Bing and Bernard Silvestrini}, title = {{The Conti Leaks | Insight into a Ransomware Unicorn}}, date = {2022-03-09}, organization = {BreachQuest}, url = {https://www.breachquest.com/conti-leaks-insight-into-a-ransomware-unicorn/}, language = {English}, urldate = {2022-03-14} } The Conti Leaks | Insight into a Ransomware Unicorn
Cobalt Strike MimiKatz TrickBot
2022-01-14Twitter (@billyleonard)Billy Leonard, Google Threat Analysis Group
@online{leonard:20220114:apt28:6c659cc, author = {Billy Leonard and Google Threat Analysis Group}, title = {{Tweet on APT28 credential phishing campaigns targeting Ukraine}}, date = {2022-01-14}, organization = {Twitter (@billyleonard)}, url = {https://twitter.com/billyleonard/status/1482034733072752640}, language = {English}, urldate = {2022-01-18} } Tweet on APT28 credential phishing campaigns targeting Ukraine
2021-11-10Twitter (@billyleonard)Billy Leonard, Google Threat Analysis Group
@online{leonard:20211110:rekoobe:2f64840, author = {Billy Leonard and Google Threat Analysis Group}, title = {{Tweet on Rekoobe (used by APT31), being a fork of open source tool called Tiny SHell, used by different actor since at least 2012}}, date = {2021-11-10}, organization = {Twitter (@billyleonard)}, url = {https://twitter.com/billyleonard/status/1458531997576572929}, language = {English}, urldate = {2021-11-17} } Tweet on Rekoobe (used by APT31), being a fork of open source tool called Tiny SHell, used by different actor since at least 2012
Rekoobe
2021-10-07Twitter (@billyleonard)Billy Leonard, Google Threat Analysis Group
@online{leonard:20211007:iocs:db42716, author = {Billy Leonard and Google Threat Analysis Group}, title = {{Tweet on IOCs related to APT28}}, date = {2021-10-07}, organization = {Twitter (@billyleonard)}, url = {https://twitter.com/billyleonard/status/1446226367008313344}, language = {English}, urldate = {2021-11-17} } Tweet on IOCs related to APT28
2021-09-27KasperskyLeonid Bezvershenko, Marc Rivero López, Dmitry Galov
@online{bezvershenko:20210927:bloodystealer:5944099, author = {Leonid Bezvershenko and Marc Rivero López and Dmitry Galov}, title = {{BloodyStealer and gaming assets for sale}}, date = {2021-09-27}, organization = {Kaspersky}, url = {https://securelist.com/bloodystealer-and-gaming-assets-for-sale/104319/}, language = {English}, urldate = {2021-10-05} } BloodyStealer and gaming assets for sale
BloodyStealer
2021-07-21Twitter (@billyleonard)Billy Leonard
@online{leonard:20210721:apt31:95e177c, author = {Billy Leonard}, title = {{Tweet on APT31 using a router implant.}}, date = {2021-07-21}, organization = {Twitter (@billyleonard)}, url = {https://twitter.com/billyleonard/status/1417910729005490177}, language = {English}, urldate = {2021-12-17} } Tweet on APT31 using a router implant.
SoWaT
2021-05-12KasperskyDmitry Galov, Leonid Bezvershenko, Ivan Kwiatkowski
@online{galov:20210512:ransomware:439cee0, author = {Dmitry Galov and Leonid Bezvershenko and Ivan Kwiatkowski}, title = {{Ransomware world in 2021: who, how and why}}, date = {2021-05-12}, organization = {Kaspersky}, url = {https://securelist.com/ransomware-world-in-2021/102169/}, language = {English}, urldate = {2021-05-13} } Ransomware world in 2021: who, how and why
Babuk REvil