Click here to download all references as Bib-File.
| 2022-09-22 ⋅ Sentinel LABS ⋅ Void Balaur | The Sprawling Infrastructure of a Careless Mercenary Void Balaur |
| 2022-07-18 ⋅ Fortinet ⋅ From the Front Lines | 8220 Gang Massively Expands Cloud Botnet to 30,000 Infected Hosts |
| 2022-07-07 ⋅ Sentinel LABS ⋅ Targets of Interest - Russian Organizations Increasingly Under Attack By Chinese APTs 8.t Dropper Korlia |
| 2022-03-24 ⋅ Sentinel LABS ⋅ Chinese Threat Actor Scarab Targeting Ukraine HeaderTip Scieron |
| 2022-03-24 ⋅ Sentinel LABS ⋅ Chinese Threat Actor Scarab Targeting Ukraine Scieron Scarab |
| 2022-02-09 ⋅ SentinelOne ⋅ Modified Elephant APT and a Decade of Fabricating Evidence DarkComet Incubator NetWire RC |
| 2022-02-09 ⋅ Sentinel LABS ⋅ ModifiedElephant APT and a Decade of Fabricating Evidence DarkComet Incubator NetWire RC ModifiedElephant |
| 2021-09-23 ⋅ lacework ⋅ HCRootkit / Sutersu Linux Rootkit Analysis |
| 2021-06-21 ⋅ lacework ⋅ Threat Hunting SSH Keys – Bash Script Feature Pivoting |
| 2021-05-20 ⋅ lacework ⋅ 8220 Gangs Recent use of Custom Miner and Botnet |
| 2021-04-13 ⋅ lacework ⋅ Carbine Loader Cryptojacking Campaign |
| 2021-01-13 ⋅ AlienVault ⋅ A Global Perspective of the SideWinder APT 8.t Dropper Koadic SideWinder |
| 2018-05-03 ⋅ ProtectWise ⋅ Burning Umbrella: An Intelligence Report on the Winnti Umbrella and Associated State-Sponsored Attackers APT41 |
| 2017-10-16 ⋅ 401TRG ⋅ An Update on Winnti (LEAD/APT17) |
| 2017-07-11 ⋅ 401 TRG ⋅ Winnti (LEAD/APT17) Evolution - Going Open Source |