APT Notes

This is a repository for various publicly-available documents and notes related to APT, sorted by year. For malware sample hashes, please see the individual reports.

ARCHIVED!

THIS REPO IS NOW MAINTAINED AT https://github.com/aptnotes/data Please update your bookmarks. This repo is backported only once in a while

The new repo makes it easier for automation.
To add new reports, please create a new issue.
For more information, see the new README.

2019

Aug 19 - GAME OVER: Detecting and Stopping an APT41 Operation
Aug 12 - Recent Cloud Atlas activity
Aug 07 - APT41: A Dual Espionage and Cyber Crime Operation
Aug 07 - APT41: A Dual Espionage and Cyber Crime Operation
Jul 18 - Hard Pass: Declining APT34's Invite to Join Their Professional Network
Jul 09 - Sea Turtle keeps on swimming, finds new victims, DNS hijacking techniques
Jun 25 - Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers
Apr 25 - CARBANAK Week Part Four: The CARBANAK Desktop Video Player
Apr 24 - CARBANAK Week Part Three: Behind the CARBANAK Backdoor
Apr 23 - CARBANAK Week Part Two: Continuing the CARBANAK Source Code Analysis
Apr 22 - CARBANAK Week Part One: A Rare Occurrence
Apr 17 - DNS Hijacking Abuses Trust In Core Internet Service
Feb 27 - A Peek into BRONZE UNION's Toolbox
Feb 20 - Attacks Of The Lazarus Cybercriminal Group Attended To Organizations In Russia
Jan 30 - Chafer used Remexi malware to spy on Iran-based foreign diplomatic entities

2018

Dec 13 - Shamoon 3 Targets Oil and Gas Organization
Sep 07 - Domestic Kitten: An Iranian Surveillance Operation
Aug 30 - Two Birds, One STONE PANDA
Aug 22 - OPERATION "Rocket Man"
Aug 20 - Russian Army Exhibition Decoy Leads to New BISKVIT Malware
Jun 19 - Olympic Destroyer is still alive
May 22 - The destruction of APT3
May 09 - Iran's Hacker Hierarchy Exposed
May 04 - Burning Umbrella
Apr 20 - Follow The Money: Dissecting the Operations of the Cyber Crime Group FIN
Apr 05 - M-TRENDS2018
Mar 28 - Lazarus Group Targets More Cryptocurrency Exchanges and FinTech Companies
Mar 10 - APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS
Mar 01 - Industrial Control System Threats
Feb 20 - APT37 (Reaper): The Overlooked North Korean Actor
Jan 18 - Turla group update Neuron malware
Jan 18 - Dark Caracal Cyber-espionage at a Global Scale
Jan 12 - Update on Pawn Storm: New Targets and Politically Motivated Campaigns

2017

Dec 19 - North Korea Bitten by Bitcoin Bug
Dec 14 - Attackers Deploy New ICS Attack Framework "TRITON" and Cause Operational Disruption to Critical Infrastructure
Dec 14 - TRISIS Malware
Dec 05 - Charming Kitten: CSV Data
Dec 05 - Charming Kitten: Iranian Cyber Espionage Against Human Rights Activists
Nov 30 - Inside the Response of a Unique CARBANAK Intrusion
Nov 22 - Turla group using Neuron and Nautilus tools alongside Snake malware
Nov 22 - The Carbanak/Fin7 syndicate
Nov 08 - OilRig Deploys "ALMA Communicator" - DNS Tunneling Trojan
Nov 07 - Threat Group APT28 Slips Office Malware into Doc Citing NYC Terror Attack
Nov 06 - OceanLotus Blossoms: Mass Digital Surveillance and Attacks Targeting ASEAN
Nov 06 - ChessMaster's New Strategy: Evolving Tools and Tactics
Nov 02 - The KeyBoys are back in town
Oct 27 - Investigation: WannaCry cyber attack and the NHS
Oct 27 - Tracking Subaat: Targeted Phishing Attack Leads to Threat Actor's Repository
Oct 26 - Remote Control Interloper: Analyzing New Chinese htpRAT Attacks Against ASEAN
Oct 24 - Iranian Threat Agent Greenbug Impersonates Israeli High-Tech and Cyber Security Companies
Oct 22 - Cyber Conflict Decoy Document Used In Real Cyber Conflict
Oct 16 - BlackOasis APT and new targeted attacks leveraging zero-day exploit
Oct 16 - Taiwan Heist: Lazarus Tools And Ransomware
Oct 02 - Evidence Aurora Operation Still Active: Supply Chain Attack Through CCleaner part2
Sep 28 - Threat Actors Target Government of Belarus Using CMSTAR Trojan
Sep 20 - Evidence Aurora Operation Still Active: Supply Chain Attack Through CCleaner
Sep 12 - CVE-2017-8759: Zero-Day Used in the Wild to Distribute FINSPY
Sep 06 - Dragonfly: Western energy sector targeted by sophisticated attack group
Aug 30 - Gazing at Gazer
Aug 30 - Introducing WhiteBear
Aug 18 - Russian Bank Offices Hit with Broad Phishing Wave
Jul 27 - ChessMaster Makes its Move: A Look into the Campaign's Cyberespionage Arsenal
Jul 25 - Operation Wilted Tulip
Jul 18 - Cyberattacks Against Ukrainian ICS
Jul 18 - Inexsmar: An unusual DarkHotel campaig
Jul 05 - An intrusion campaign targeting Chinese language news sites
Jun 30 - TeleBots are back: supply-chain attacks against Ukraine
Jun 30 - From BlackEnergy to ExPetr
Jun 23 - Bronze Butler
Jun 15 - North Korea Is Not Crazy
Jun 14 - KASPERAGENT Malware Campaign resurfaces in May Election
Jun 12 - CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations
Jun 12 - WIN32/INDUSTROYER A new threat for industrial control systems
Jun 07 - PLATINUM continues to evolve, find ways to maintain invisibility
Jun 06 - Privileges and Credentials: Phished at the Request of Counsel
May 25 - TAINTED LEAKS Disinformation and Phishing With a Russian Nexus
May 24 - Operation Cobalt Kitty Threat Actor Profile & IOC
May 24 - Operation Cobalt Kitty: A large-scale APT in Asia carried out by the OceanLotus Group
May 17 - Recorded Future Research Concludes Chinese Ministry of State Security Behind APT3
May 14 - Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations
May 11 - Cyber Attack Impersonating Identity Of Indian Think Tank To Target Central Bureau Of Investigation (cbi) And Possibly Indian Army Officials
Apr 27 - APT Targets Financial Analysts with CVE-2017-0199
Apr 10 - Longhorn: Tools used by cyberespionage group
Apr 07 - The Blockbuster Sequel
Apr 03 - Lazarus Under The Hood
Apr 03 - Operation Cloud Hopper
Mar 30 - Carbon Paper: Peering into Turla second stage backdoor
Mar 28 - Dimnie: Hiding in Plain Sight
Mar 27 - APT29 Domain Fronting With TOR
Mar 14 - Operation Electric Powder - Who is targeting Israel Electric Company?
Mar 07 - FIN7 Spear Phishing Campaign Targets Personnel Involved in SEC Filings
Mar 06 - From Shamoon to StoneDrill
Feb 27 - The Deception Project: A New Japanese-Centric Threat
Feb 27 - The Gamaredon Group Toolset Evolution
Feb 23 - Dissecting the APT28 Mac OS X Payload
Feb 22 - Spear Phishing Techniques Used in Attacks Targeting the Mongolian Government
Feb 21 - Additional Insights on Shamoon2
Feb 20 - Lazarus' False Flag Malware
Feb 17 - ChChes - Malware that Communicates with C&C Servers Using Cookie Headers
Feb 16 - Breaking The Weakest Link Of The Strongest Chain
Feb 16 - ViperRAT: The mobile APT targeting the Israeli Defense Force that should be on your radar
Feb 15 - Operation Bugdrop: Cyberx Discovers Large-Scale Cyber-Reconnaissance Operation Targeting Ukrainian Organizations
Feb 15 - The Full Shamoon: How the Devastating Malware Was Inserted Into Networks
Feb 15 - Iranian PupyRAT Bites Middle Eastern Organizations
Feb 15 - Magic Hound Campaign Attacks Saudi Targets
Feb 12 - Lazarus & Watering-Hole Attacks
Feb 10 - Cyber Attack Targeting Indian Navy's Submarine And Warship Manufacturer
Feb 10 - Enhanced Analysis of GRIZZLY STEPPE Activity
Feb 03 - KingSlayer A Supply chain attack
Feb 03 - Several Polish banks hacked, information stolen by unknown attackers
Feb 02 - Nile Phish: Large-Scale Phishing Campaign Targeting Egyptian Civil Society
Jan 19 - URI Terror Attack & Kashmir Protest Themed Spear Phishing Emails Targeting Indian Embassies And Indian Ministry Of External Affairs
Jan 15 - Bear Spotting Vol. 1: Russian Nation State Targeting of Government and Military Interests
Jan 14 - A Pretty Dope Story About Bears: Early Indicators of Continued World Anti-Doping Agency (WADA) Targeting
Jan 11 - At the Center of the Storm: Russia's APT28 Strategically Evolves its Cyber Operations
Jan 05 - Foreign Cyber Threats to the United States
Jan 05 - Mm Core In-Memory Backdoor Returns As Bigboss And Sillygoose
Jan 05 - DragonOK Updates Toolset and Targets Multiple Geographic Regions
Jan 05 - Iranian Threat Agent OilRig Delivers Digitally Signed Malware, Impersonates University of Oxford
Jan 01 - The Digital Plagiarist Campaign: TelePorting the Carbanak Crew to a New Dimension

2016

Dec 29 - GRIZZLY STEPPE - Russian Malicious Cyber Activity
Dec 28 - Bear Hunting Season: Tracking APT28
Dec 22 - Use of Fancy Bear Android Malware tracking of Ukrainian Artillery Units
Dec 21 - Danger Close: Fancy Bear Tracking of Ukrainian Field Artillery Units
Dec 15 - Let It Ride: The Sofacy Group's DealersChoice Attacks Continue
Dec 14 - PROMETHIUM and NEODYMIUM: Parallel zero-day attacks targeting individuals in Europe
Nov 30 - Malware Actors Using Nic Cyber Security Themed Spear Phishing To Target Indian Government Organizations
Nov 17 - It's Parliamentary: KeyBoy and the targeting of the Tibetan Community
Nov 14 - New Carbanak / Anunak Attack Methodology
Nov 09 - PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs
Nov 03 - When The Lights Went Out: Ukraine Cybersecurity Threat Briefing
Oct 27 - BLACKGEAR Espionage Campaign Evolves, Adds Japan To Target List
Oct 27 - En Route with Sednit Part 3: A Mysterious Downloader
Oct 26 - BITTER: A Targeted attack against Pakistan
Oct 26 - Moonlight - Targeted attacks in the Middle East
Oct 25 - Houdini's Magic Reappearance
Oct 25 - En Route with Sednit Part 2: Observing the Comings and Goings
Oct 20 - En Route with Sednit Part 1: Approaching the Target
Oct 05 - Apt Reports And Opsec Evolution, Or: These Are Not The Apt Reports You Are Looking For
Oct 05 - Wave your false flags! Deception tactics muddying attribution in targeted attacks
Oct 03 - On the StrongPity Waterhole Attacks Targeting Italian and Belgian Encryption Users
Sep 28 - Belling the BEAR
Sep 26 - Sofacy's Komplex OS X Trojan
Sep 18 - Hunting Libyan Scorpions
Sep 06 - Buckeye cyberespionage group shifts gaze from US to Hong Kong
Aug 24 - The Million Dollar Dissident: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender
Aug 13 - Visa Alert and Update on the Oracle Breach
Aug 08 - Carbanak Oracle Breach
Aug 08 - The ProjectSauron APT
Aug 07 - Strider: Cyberespionage group turns eye of Sauron on targets
Aug 06 - Moonsoon - Analysis of an APT Campaign
Aug 03 - Operation Manul
Jul 25 - Patchwork cyberespionage group expands targets from governments to wide range of industries
Jul 08 - The Dropping Elephant - aggressive cyber-espionage in the Asian region
Jul 07 - NetTraveler APT Targets Russian, European Interests
Jul 07 - Unveiling Patchwork the Copy Paste APT
Jul 01 - Espionage toolkit targeting Central and Eastern Europe uncovered
Jul 01 - Pacifier APT
Jun 30 - Asruex: Malware Infecting through Shortcut Files
Jun 28 - Prince of Persia Game Over
Jun 26 - Threat Group-4127 Targets Google Accounts
Jun 23 - Tracking Elirks Variants in Japan: Similarities to Previous Attacks
Jun 21 - Visiting The Bear Den A Journey in the Land of (Cyber-)Espionage
Jun 20 - Red Line Drawn: China Recalculates Its Use Of Cyber Espionage
Jun 20 - Findings from Analysis of DNC Intrusion Malware
Jun 20 - Reverse-engineering DUBNIUM's Flash-targeting exploit
Jun 17 - Operation Daybreak
Jun 17 - Flash zero-day exploit deployed by the ScarCruft APT Group
Jun 16 - Threat Group 4127 Targets Hillary Clinton Presidential Campaign
Jun 16 - Threat Group-4127 Targets Hillary Clinton Presidential Campaign
Jun 14 - Group5: Syria and the Iranian Connection
Jun 14 - New Sofacy Attacks Against US Government Agency
Jun 09 - Reverse-engineering DUBNIUM
Jun 09 - Operation DustySky Part 2 Indicators
Jun 09 - Operation DustySky Part 2
Jun 04 - Bears in the Midst: Intrusion into the Democratic National Committee
Jun 03 - Apt Group Sends Spear Phishing Emails To Indian Government Officials
Jun 03 - APT Group Sends Spear Phishing Emails to Indian Government Officials
Jun 02 - IRONGATE ICS Malware: Nothing to See Here...Masking Malicious Activity on SCADA Systems
May 29 - Stealth Falcon
May 27 - IXESHE Derivative IHEATE Targets Users in America
May 26 - SWIFT attackers' malware linked to more financial attacks
May 25 - CVE-2015-2545: overview of current threats
May 24 - New Wekby Attacks Use DNS Requests As Command and Control Mechanism
May 23 - Operation Ke3chang Resurfaces With New TidePool Malware
May 23 - APT Case RUAG Technical Report
May 23 - Targeted Attacks against Banks in the Middle East
May 18 - Operation C-Major Actors Also Used Android BlackBerry Mobile Spyware Against Targets
May 17 - Indian organizations targeted in Suckfly attacks
May 17 - Operation Groundbait:Analysis of a surveillance toolkit
May 17 - Mofang: A politically motivated information stealing adversary
May 06 - Exploring CVE-2015-2545 and its users
May 02 - Prince of Persia: Infy Malware Active In Decade of Targeted Attacks
May 02 - Turbo Twist: Two 64-bit Derusbi Strains Converge
Apr 26 - PLATINUM Targeted attacks in South and Southeast Asia
Apr 25 - Two Bytes to $951M
Apr 22 - The Ghost Dragon
Apr 21 - Looking Into a Cyber-Attack Facilitator in the Netherlands (Appendix)
Apr 21 - Looking Into a Cyber-Attack Facilitator in the Netherlands
Apr 18 - Between Hong Kong and Burma: Tracking UP007 and SLServer Espionage Campaign
Apr 13 - The Four Element Sword Engagement
Mar 29 - Taiwan targeted with new cyberespionage back door Trojan
Mar 17 - Taiwan Presidential Election: A Case Study on Thematic Targeting
Mar 15 - Suckfly: Revealing the secret life of your code signing certificates
Mar 10 - Shifting Tactics Tracking Changes In Years Long Espionage Campaign Against Tibetans
Mar 01 - Operation Transparent Tribe
Feb 24 - FROM SEOUL TO SONY: THE HISTORY OF THE DARKSEOUL GROUP AND THE SONY INTRUSION MALWARE DESTOVER
Feb 24 - Operation Blockbuster
Feb 23 - Operation Duststorm
Feb 12 - A Look Into Fysbis: Sofacy's Linux Backdoor
Feb 09 - Poseidon Group
Feb 08 - Know Your Enemies 2.0: A Primer on Advanced Persistent Threat Groups
Feb 08 - Attack On French Diplomat Linked To Operation Lotus Blossom
Feb 04 - T9000: Advanced Modular Backdoor Uses Complex Anti Analysis Techniques
Feb 03 - Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It To Evolve
Jan 28 - BlackEnergy APT Attacks in Ukraine employ spearphishing with Word documents
Jan 24 - Scarlet Mimic
Jan 20 - New wave of cyberattacks against Ukrainian power industry
Jan 14 - RESEARCH SPOTLIGHT: NEEDLES IN A HAYSTACK
Jan 11 - Uncovering the Seven Pointed Dagger
Jan 07 - Operation Dusty Sky (indicators)
Jan 07 - Operation Dusty Sky
Jan 03 - BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry

2015

Dec 23 - ELISE: Security Through Obesity
Dec 22 - BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger
Dec 16 - Dissecting the Malware Involved in the INOCNATION Campaign
Dec 10 - Evolution of Cyber Threats in the Corporate Sector
Dec 07 - Iran-based attackers use back door threats to spy on Middle Eastern targets
Nov 23 - PEERING INTO GLASSRAT: A Zero Detection Trojan from China
Nov 16 - Microsoft Security Intelligence Report (Volume 19)
Nov 09 - Rocket Kitten: A Campaign With 9 Lives
Oct 15 - Pay No Attention to the Server Behind the Proxy: Mapping FinFisher's Continuing Proliferation
Oct 07 - Hacker Group Creates Network of Fake LinkedIn Profiles
Sep 17 - THE DUKES: 7 years of Russian cyberespionage
Sep 08 - Carbanak is packing new guns
Aug 10 - Darkhotel's attacks in 2015
Aug 05 - Threat Group-3390 Targets Organizations For Cyberespionage
Aug 04 - RSA Research Terracotta VPN: Enabler Of Advanced Threat Anonymity
Aug 03 - Cyber war in perspective: Russian aggression against Ukraine
Jul 31 - Operation Potao Express: Analysis Of A Cyber-Espionage Toolkit
Jul 28 - The Black Vine Cyberespionage Group
Jul 27 - Hammertoss: Stealthy Tactics Define A Russian Cyber Threat Group
Jul 22 - Duke APT Group's Latest Tools: Cloud Services And Linux Support
Jul 20 - China Hacks The Peace Palace: All Your Eez's Are Belong To Us
Jul 20 - Watering Hole Attack On Aerospace Firm Exploits CVE-2015-5122 To Install Isspace Backdoor
Jul 14 - Tracking Minidionis: Cozycar's New Ride Is Related To Seaduke
Jul 13 - "Forkmeiamfamous": Seaduke, Latest Weapon In The Duke Armory
Jul 09 - Butterfly: Corporate Spies Out For Financial Gain
Jul 08 - Wild Neutron _ Economic Espionage Threat Actor Returns With New Tricks
Jun 30 - Dino: The Latest Spying Malware From An Allegedly French Espionage Group Analyzed
Jun 24 - Unfin4Ished Business
Jun 22 - Games Are Over: Winnti Is Now Targeting Pharmaceutical Companies
Jun 16 - Operation Lotusblossom
Jun 15 - Target Attacks Against Tibetan And Hong Kong Groups Exploiting CVE-2014-4114
Jun 15 - The Naikon APT: Tracking Down Geo-Political Intelligence Across APAC, One Nation At A Time
Jun 11 - The Duqu 2.0 Technical Details
Jun 10 - Duqu 2.0: Reemergence of an aggressive cyberespionage threat
Jun 10 - Duqu 2.0: A Comparison To Duqu
Jun 04 - Blue Termite (Internet Watch)
Jun 03 - An Iranian Cyber-Attack Campaign Against Targets In The Middle East
May 29 - Oceanlotus
May 28 - Grabit And The Rats
May 27 - Analysis On APT-To-Be Attack That Focusing On China's Government Agency
May 26 - Dissecting Linux/Moose: The Analysis Of A Linux Router-Based Worm Hungry For Social Networks
May 21 - The Msnmm Campaigns: The Earliest Naikon APT Campaigns
May 19 - Operation Oil Tanker: The Phantom Menace
May 18 - Cmstar Downloader: Lurid And Enfal's New Cousin
May 14 - Operation Tropic Trooper: Relying On Tried-And-Tested Flaws To Infiltrate Secret Keepers
May 13 - Cylance Spear Team: A Threat Actor Resurfaces
May 10 - APT28 Targets Financial Markets: Zero Day Hashes Released
May 07 - Dissecting The Kraken
May 05 - Targeted Attack on France's TV5Monde
Apr 27 - Attacks Against Israeli & Palestinian Interests
Apr 26 - Operation Clandestine Wolf _ Adobe Flash Zero-Day In APT3 Phishing Campaign
Apr 22 - Cozyduke
Apr 21 - The Cozyduke APT
Apr 20 - Sofacy II_ Same Sofacy, Different Day
Apr 18 - Operation Russiandoll: Adobe & Windows ZeroDay Exploits Likely leveraged By Russia's APT28
Apr 15 - Hellsing Indicators Of Compromise
Apr 15 - The Chronicles Of The Hellsing APT: The Empire Strikes Back
Apr 12 - APT30 And The Mechanics Of A Long-Running Cyber Espionage Operation
Apr 08 - RSA Incident Response: An APT Case Study
Apr 07 - WINNTI Analysis
Mar 31 - Volatile Cedar Threat Intelligence And Research
Mar 19 - Operation Woolen-Goldfish When Kittens Go Phishing
Mar 11 - Inside The Equationdrug Espionage Platform
Mar 10 - Tibetan Uprising Day Malware Attacks
Feb 27 - The Anthem Hack: All Roads Lead To China
Feb 25 - Plugx Goes To The Registry (And India)
Feb 25 - Southeast Asia: An Evolving Cyber Threat Landscape
Feb 24 - Scanbox Ii
Feb 18 - Shooting Elephants
Feb 17 - The Desert Falcons Targeted Attacks
Feb 16 - Carbanak APT The Great Bank Robbery
Feb 16 - Equation Group: Questions And Answers
Feb 16 - Operation Arid Viper: Bypassing The Iron Dome
Feb 10 - Global Threat Intel Report
Feb 04 - Pawn Storm Update: Ios Espionage App Found
Feb 02 - Behind The Syrian Conflict's Digital Front Lines
Jan 29 - Backdoor.Winnti Attackers Have A Skeleton In Their Closet?
Jan 29 - Analysis Of A Recent Plugx Variant - P2P Plugx
Jan 22 - An Analysis Of Regin's Hopscotch And Legspin
Jan 22 - Scarab Attackers Took Aim At Select Russian Targets Since 2012
Jan 22 - The Waterbug Attack Group
Jan 20 - Reversing The Inception APT Malware
Jan 20 - Analysis Of Project Cobra
Jan 15 - Evolution Of Sophisticated Spyware: From Agent.Btz To Comrat
Jan 12 - Insight In To A Strategic Web Compromise And Attack Campaign Against Hong Kong Infrastructure
Jan 12 - Skeleton Key Malware Analysis

2014

Dec 22 - Anunak: Apt Against Financial Institutions
Dec 21 - Operation Poisoned Helmand
Dec 19 - Alert (Ta14-353A) Targeted Destructive Malware
Dec 18 - Malware Attack Targeting Syrian Isis Critics
Dec 17 - Wiper Malware _ A Detection Deep Dive
Dec 12 - Bots, Machines, And The Matrix
Dec 12 - Vinself Now With Steganography
Dec 10 - Cloud Atlas: Redoctober Apt Is Back In Style
Dec 10 - Vulnerability, Malicious Code Appeared In The Mbr Destruction Function Using Hangul File
Dec 10 - W32/Regin, Stage #1
Dec 10 - W64/Regin, Stage #1
Dec 09 - The Inception Framework: Cloud-Hosted Apt
Dec 08 - The 'Penquin' Turla
Dec 03 - Operation Cleaver: The Notepad Files
Dec 01 - Hacking The Street? Fin4 Likely Playing The Market
Nov 24 - I Am Ironman: Deep Panda Uses Sakula Malware To Target Organizations In Multiple Sectors
Nov 24 - The Regin Platform Nation-State Ownership Of Gsm Networks
Nov 24 - Secret Malware In European Union Attack Linked To U.S. And British Intelligence
Nov 23 - Regin: Top-Tier Espionage Tool Enables Stealthy Surveillance
Nov 21 - Operation Double Tap
Nov 20 - Evil Bunny: Suspect #4
Nov 14 - Derusbi (Server Variant) Analysis
Nov 14 - Onionduke: Apt Attacks Via The Tor Network - F-Secure Weblog : News From The Lab
Nov 14 - Roaming Tiger
Nov 13 - Operation Cloudyomega: Ichitaro Zero-Day And Ongoing Cyberespionage Campaign Targeting Japan
Nov 12 - Korplug Military Targeted Attacks: Afghanistan & Tajikistan
Nov 11 - The Uroburos Case: New Sophisticated Rat Identified
Nov 10 - The Darkhotel APT A Story of Unusual Hospitality v1.1
Nov 10 - The Darkhotel Apt A Story Of Unusual Hospitality v1.0
Nov 10 - Darkhotel Indicators Of Compromise
Nov 03 - Be2 Custom Plugins, Router Abuse, And Target Profiles
Nov 03 - Operation Poisoned Handover: Unveiling Ties Between Apt Activity In Hong Kong's Pro-Democracy Movement
Oct 31 - Operation Toohash How Targeted Attacks Work
Oct 30 - The Rotten Tomato Campaign
Oct 28 - Apt28: A Window Into Russia's Cyber Espionage Operations
Oct 28 - Threat Spotlight: Group 72, Opening The Zxshell
Oct 27 - Full Disclosure Of Havex Trojans
Oct 27 - Micro-Targeted Malvertising Via Real-Time Ad Bidding
Oct 27 - Scanbox Framework: Who's Affected, And Who's Using It?
Oct 24 - Operation SMN
Oct 24 - Leouncia And Orcarat
Oct 23 - Modified Binaries Tor
Oct 23 - Operation Pawn Storm Using Decoys To Evade Detection
Oct 22 - Tactical Intelligence Bulletin Sofacy Phishing
Oct 20 - Orcarat - A Whale Of A Tale
Oct 14 - Threat Spotlight: Group 72
Oct 14 - Hikit Analysis
Oct 14 - Russian Cyber Espionage Campaign - Sandworm Team
Oct 14 - Zoxpng Analysis
Oct 09 - Democracy In Hong Kong Under Attack
Oct 03 - New Indicators Of Compromise For Apt Group Nitro Uncovered
Sep 26 - Aided Frame, Aided Direction (Because It's A Redirect)
Sep 26 - Blackenergy & Quedagh: The Convergence Of Crimeware And Apt Attacks
Sep 19 - Recent Watering Hole Attacks Attributed To Apt Group Th3Bug Using Poison Ivy
Sep 18 - Cosmicduke Cosmu With A Twist Of Miniduke
Sep 10 - Operation Quantum Entanglement
Sep 08 - Targeted Threat Index: Characterizing And Quantifying Politically-Motivated Targeted Malware
Sep 08 - When Governments Hack Opponents: A Look At Actors And Technology
Sep 04 - Analysis Of Chinese Mitm On Google
Sep 04 - Forced To Adapt: Xslcmd Backdoor Now On Os X
Sep 03 - Darwin's Favorite Apt Group
Aug 29 - Connecting The Dots: Syrian Malware Team Uses Blackworm For Attacks
Aug 28 - Scanbox: A Reconnaissance Framework Used With Watering Hole Attacks
Aug 27 - Profiling An Enigma: The Mystery Of North Korea's Cyber Threat Landscape
Aug 27 - Nettraveler Apt Gets A Makeover For 10Th Birthday
Aug 20 - El Machete
Aug 07 - The Epic Turla Operation: Solving Some Of The Mysteries Of Snake/Uroboros
Aug 06 - Operation Poisoned Hurricane
Aug 05 - Operation Arachnophobia Caught In The Spider's Web
Aug 04 - Sidewinder Targeted Attack Against Android In The Golden Age Of Ad Libraries
Aug 04 - Gholee Protective Edge Themed Spear Phishing Campaign
Aug 01 - Syrian Malware, The Ever-Evolving Threat
Jul 31 - Energetic Bear _ Crouching Yeti
Jul 31 - Crouching Yeti: Appendixes
Jul 20 - Sayad (Flying Kitten) Infostealer: Is This The Work Of The Iranian Ajax Security Team?
Jul 11 - The Eye Of The Tiger (Pitty Tiger)
Jul 10 - Tr-25 Analysis - Turla / PNet / Snake/ Uroburos
Jun 30 - Dragonfly: Cyberespionage Attacks Against Energy Suppliers
Jun 20 - #9 Blitzanalysis: Embassy Of Greece Beijing - Compromise
Jun 10 - Snake In The Grass: Python-based Malware Used For Targeted Attacks
Jun 10 - Anatomy Of The Attack: Zombie Zero
Jun 09 - Putter Panda
Jun 06 - Illuminating The Etumbot Apt Backdoor
May 21 - Rat In A Jar: A Phishing Campaign Using Unrecom
May 20 - Miniduke Still Duking It Out
May 13 - Cat Scratch Fever: Crowdstrike Tracks Newly Reported Iranian Actor As Flying Kitten
May 13 - Operation Saffron Rose
Apr 26 - New Zero-Day Exploit Targeting Internet Explorer Versions 9 Through 11 Identified In Targeted Attacks
Mar 08 - Suspected Russian Spyware Turla Targets Europe, United States
Mar 07 - Snake Campaign & Cyber Espionage Toolkit
Mar 06 - The Siesta Campaign: A New Cybercrime Operation Awakens
Feb 28 - Uroburos Highly Complex Espionage Software With Russian Roots
Feb 25 - The French Connection: French Aerospace-Focused CVE-2014-0322 Attack Shares Similarities with 2012 Capstone Turbine Activity
Feb 23 - Gathering In The Middle East, Operation Stteam
Feb 20 - Mo' Shells Mo' Problems - Deep Panda Web Shells
Feb 20 - Operation Greedywonk: Multiple Economic And Foreign Policy Sites Compromised, Serving Up Flash Zero-Day Exploit
Feb 19 - The Monju Incident
Feb 19 - Xtremerat: Nuisance Or Threat?
Feb 13 - Operation Snowman: Deputydog Actor Compromises Us Veterans Of Foreign Wars Website
Feb 11 - Unveiling Careto - The Masked Apt
Jan 31 - Intruder File Report- Sneakernet Trojan
Jan 21 - Emerging Threat Profile Shell_Crew
Jan 15 - New Cdto: A Sneakernet Trojan Solution
Jan 13 - Targeted Attacks Against The Energy Sector

2013

Dec 31 - Energy At Risk: A Study Of It Security In The Energy And Natural Resources Industry
Dec 20 - Etso Apt Attacks Analysis
Dec 11 - Operation Ke3Chang Targeted Attacks Against Ministries Of Foreign Affairs
Dec 02 - "Njrat", The Saga Continues
Nov 11 - Supply Chain Analysis: From Quartermaster To Sunshopfireeye
Oct 24 - Evasive Tactics: Terminator Rat
Oct 24 - Fakem Rat: Malware Disguised As Windows Messenger And Yahoo! Messenger
Sep 30 - World War C: Understanding Nation-State Motives Behind Today's Advanced Cyber Attacks
Sep 19 - 2Q Report On Targeted Attack Campaigns
Sep 17 - Hidden Lynx: Professional Hackers For Hire
Sep 13 - Operation Deputydog: Zero-Day (Cve-2013-3893) Attack Against Japanese Targets
Sep 11 - The "Kimsuky" Operation: A North Korean Apt?
Sep 10 - Operation Ephemeral Hydra: Ie Zero-Day Linked To Deputydog Uses Diskless Method
Aug 23 - Operation Molerats
Aug 21 - Poison Ivy: Assessing Damage And Extracting Intelligence
Aug 19 - Byebye Shell And The Targeting Of Pakistan
Aug 12 - Survival Of The Fittest: New York Times Attackers Evolve Quickly
Aug 07 - The Little Malware That Could: Detecting And Defeating The China Chopper Web Shell
Aug 02 - Where There Is Smoke, There Is Fire: South Asian Cyber Espionage Heats Up
Aug 02 - Surtr: Malware Family Targeting The Tibetan Community
Aug 01 - Inside Report _ Apt Attacks On Indian Cyber Space
Aug 01 - Operation Hangover - Unveiling An Indian Cyberattack Infrastructure (Appendix)
Jul 31 - Secrets Of The Comfoo Masters
Jul 15 - The Plugx Malware Revisited: Introducing Smoaler
Jul 09 - Dark Seoul Cyber Attack: Could It Be Worse?
Jul 01 - Hunting The Shadows: In Depth Analysis Of Escalated Apt Attacks
Jun 28 - Njrat Uncovered
Jun 21 - A Call To Harm: New Malware Attacks Target The Syrian Opposition
Jun 18 - Trojan.Apt.Seinup Hitting Asean
Jun 07 - Keyboy, Targeted Attacks Against Vietnam And India
Jun 04 - The Nettraveler (Aka Travnet)
Jun 01 - Crude Faux: An Analysis Of Cyber Conflict Within The Oil & Gas Industries
Jun 01 - The Chinese Malware Complexes: The Maudi Surveillance Operation
May 30 - Analysis Of A Stage 3 Miniduke Sample
May 20 - Operation Hangover |Executive Summary
May 20 - Operation Hangover - Unveiling An Indian Cyberattack Infrastructure
May 03 - Deep Panda
Apr 17 - The Mutter Backdoor: Operation Beebus with New Targets
Apr 13 - Winnti: More Than Just A Game
Apr 03 - A Closer Look At Miniduke
Apr 01 - Trojan.Apt.Banechant: In-Memory Trojan That Observes For Multiple Mouse Clicks
Mar 28 - Analysis Of A Plugx Variant (Plugx Version 7.0)
Mar 27 - Apt1: Technical Backstage
Mar 20 - Dissecting Operation Troy: Cyberespionage In South Korea
Mar 20 - The Teamspy Story - Abusing Teamviewer In Cyberespionage Campaigns
Mar 17 - Safe A Targeted Threat
Mar 13 - You Only Click Twice: Finfisher's Global Proliferation
Feb 27 - Miniduke: Indicators
Feb 27 - The Miniduke Mystery: Pdf 0-Day Government Spy Assembler 0X29A Micro Backdoor
Feb 26 - Stuxnet 0.5: The Missing Link
Feb 22 - Comment Crew: Indicators Of Compromise
Feb 18 - Apt1 Exposing One Of China's Cyber Espionage Units
Feb 12 - Targeted Cyber Attacks: Examples And Challenges Ahead
Feb 03 - Command And Control In The Fifth Domain
Feb 01 - Operation Beebus
Jan 18 - Operation Red October
Jan 14 - The Icefog Apt: A Tale Of Cloak And Three Daggers
Jan 14 - "Red October" Diplomatic Cyber Attacks Investigation
Jan 14 - The "Red October" Campaign - An Advanced Cyber Espionage Network Targeting Diplomatic And Government Agencies

2012

Nov 30 - The Many Faces Of Gh0St Rat: Plotting The Connections Between Malware Attacks
Nov 03 - Systematic Cyber Attacks Against Israeli And Palestinian Targets Going On For A Year
Nov 01 - Recovering From Shamoon
Nov 01 - "Wicked Rose" And The Ncph Hacking Group
Oct 27 - Trojan.Taidoor: Targeting Think Tanks
Sep 07 - Iexpl0Re Rat
Sep 06 - The Elderwood Project
Aug 18 - The Mirage Campaign
Aug 12 - The Voho Campaign: An In Depth Analysis
Aug 09 - Gauss: Abnormal Distribution
Jul 27 - The 'Madi' Infostealers - A Detailed Analysis
Jul 25 - From Bahrain With Love: Finfisher Spy Kit Exposed?
Jul 10 - Recent Observations In Tibet-Related Information Operations: Advanced Social Engineering For The Distribution Of Lurk Malware
Jun 13 - Pest Control: Taming The Rats
May 31 - Skywiper (A.K.A. Flame A.K.A. Flamer): A Complex Malware For Targeted Attacks
May 22 - Ixeshe An Apt Campaign
May 18 - Have I Got Newsforyou: Analysis Of Flamer C&C Server
Apr 16 - New Version Of Osx.Sabpub & Confirmed Mac Apt Attacks
Apr 03 - The Luckycat Hackers
Mar 26 - Luckycat Redux: Inside An Apt Campaign With Multiple Targets In India And Japan
Mar 13 - It'S Not The End Of The World: Darkcomet Misses By A Mile
Mar 12 - Crouching Tiger, Hidden Dragon, Stolen Data
Feb 29 - The Sin Digoo Affair
Jan 03 - The Heartbeat Apt Campaign

2011

Dec 28 - Stuxnet/Duqu: The Evolution Of Drivers
Dec 08 - Cyber-intruder sparks response, debate
Dec 08 - Palebot Trojan Harvests Palestinian Online Credentials
Oct 31 - The Nitro Attacks: Stealing Secrets From The Chemical Industry
Oct 26 - Duqu Trojan Questions And Answers
Oct 12 - Alleged Apt Intrusion Set: 1.Php Group
Sep 11 - Sk Hack By An Advanced Persistent Threat
Aug 22 - The Lurid Downloader
Aug 04 - Revealed: Operation Shady Rat
Aug 03 - Htran And The Advanced Persistent Threat
Aug 02 - Operation Shady Rat: Unprecedented Cyber-Espionage Campaign And Intellectual-Property Bonanza
Jun 01 - Advanced Persistent Threats: A Decade In Review
Apr 20 - Stuxnet Under The Microscope
Feb 18 - Night Dragon: Specific Protection Measures For Consideration
Feb 10 - Global Energy Cyberattacks: Night Dragon
Feb 01 - W32.Stuxnet Dossier

2010

Sep 03 - The Msupdater Trojan And Ongoing Targeted Attacks
Aug 24 - Defense official discloses cyberattack
Apr 06 - Shadows In The Cloud: Investigating Cyber Espionage 2.0
Mar 14 - In-Depth Analysis Of Hydraq: The Face Of Cyberwar Enemies Unfolds
Feb 24 - How Can I Tell If I Was Infected By Aurora?
Feb 10 - Operation Aurora
Jan 27 - Operation Aurora: Detect, Diagnose, Respond
Jan 20 - Combating Aurora
Jan 13 - The Command Structure Of The Aurora Botnet
Jan 01 - Case Study: Operation Aurora

2009

Mar 29 - Tracking Ghostnet: Investigating A Cyber Espionage Network
Jan 18 - Impact Of Alleged Russian Cyber Attack

2008

Nov 11 - Russian Cyberwar On Georgia
Oct 01 - How China Will Use Cyber Warfare

kbandla/APTnotes

kbandla

Reviews

Repository Details

APT Notes

ARCHIVED!

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

More Repositories