UNKNOWN
Show in Graph
Image Description
Common Information
Type Value
UUID 4a749030-ff23-4f00-8c5a-a38d7f7ee683
Fingerprint 9c495e951f7ef4f85f9fc99abd1e1f2b08f842665d94ed1b4032254950623cb2
Analysis status DONE
Considered CTI value 2
Text language
Published Feb. 1, 2024, 4:52 p.m.
Added to db April 5, 2024, 3:45 p.m.
Last updated Aug. 31, 2024, 6:16 a.m.
Headline UNKNOWN
Title UNKNOWN
Detected Hints/Tags/Attributes 293/3/533
Source URLs
Redirection Url
Details Source https://ti.qianxin.com/uploads/2024/02/02/dcc93e586f9028c68e7ab34c3326ff31.pdf
URL Provider
Details Provider Source level domain
Details qianxin.com ti.qianxin.com
Attributes
Details Type #Events CTI Value
Details Url 1 
https://mp.weixin.qq.com/s/ji37khbyot1sajof2t5heg
Details Url 4 
https://mp.weixin.qq.com/s/boj88zzk27zahshlyucyga
Details Url 1 
https://sentinelone.com/labs/comrades-in-arms-north-korea-compromises-sanctioned-
Details Url 3 
https://mp.weixin.qq.com/s/kiwp2rkfllbrq2afn8jkww
Details Url 1 
https://www.seqrite.com/blog/double-action-triple-infection-and-a-new-rat-sidecopys-
Details Url 4 
https://mp.weixin.qq.com/s/ozgdgmudzsml_nx_wa_c6a
Details Url 4 
https://mp.weixin.qq.com/s/g8osytvgrsv2773kwzyuha
Details Url 1 
https://www.welivesecurity.com/2023/03/07/love-scam-espionage-transparent-tribe-lures-
Details Url 4 
https://mp.weixin.qq.com/s/mhyglpqothzg-h2rveobaw
Details Url 3 
https://mp.weixin.qq.com/s/bssmrqfqz-2llhd3rofrvw
Details Url 2 
https://blogs.blackberry.com/en/2023/02/newspenguin-a-previously-unknown-threat-actor-
Details Url 4 
https://mp.weixin.qq.com/s/bvfz5yrivbuorgotzny65a
Details Url 2 
https://securityaffairs.com/149698/apt/kimsuky-war-simulation-centre.html
Details Url 3 
https://mp.weixin.qq.com/s/uyv4x-46dkkpx76uzqytmg
Details Url 5 
https://securelist.com/the-lazarus-group-deathnote-campaign/109490
Details Url 3 
https://www.group-ib.com/blog/dark-pink-episode-2
Details Url 6 
https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344
Details Url 5 
https://www.mandiant.com/resources/blog/north-korea-supply-chain
Details Url 1 
https://medium.com/checkmarx-security/lazarus-group-launches-first-open-source-supply-
Details Url 4 
https://www.reversinglabs.com/blog/vmconnect-supply-chain-campaign-continues
Details Url 2 
https://www.microsoft.com/en-us/security/blog/2023/11/22/diamond-sleet-supply-chain-
Details Url 1 
https://mp.weixin.qq.com/s/f5ye12w3x3wad5eo0eb53q
Details Url 1 
https://www.cisa.gov/sites/default/files/2023-12/aa23-347a-russian-foreign-intelligence-
Details Url 1 
https://www.microsoft.com/en-us/security/blog/2023/08/02/midnight-blizzard-conducts-
Details Url 2 
https://www.mandiant.com/resources/blog/apt43-north-korea-cybercrime-espionage
Details Url 3 
https://mp.weixin.qq.com/s/nk2zml2d0htk0hszykw2dw
Details Url 3 
https://mp.weixin.qq.com/s/yx8ikapsr9vs3z2wsgdisw
Details Url 3 
https://asec.ahnlab.com/ko/50851
Details Url 2 
https://mp.weixin.qq.com/s/so2rjbybqlcyb3avaumegg
Details Url 1 
https://mp.weixin.qq.com/s/gh6cwcn8pswj4d2ef7zseq
Details Url 5 
https://mp.weixin.qq.com/s/lvsragnmsl3a1jeuubuvyw
Details Url 1 
https://www.sentinelone.com/labs/transparent-tribe-apt36-pakistan-aligned-threat-actor-
Details Url 1 
https://www.seqrite.com/blog/transparent-tribe-apt-actively-lures-indian-army-amidst-
Details Url 1 
https://mp.weixin.qq.com/s/8zpppl6jixqa4qepikc5gq
Details Url 3 
https://www.fbi.gov/news/press-releases/fbi-identifies-cryptocurrency-funds-stolen-by-dprk
Details Url 5 
https://securelist.com/unveiling-lazarus-new-campaign/110888
Details Url 2 
https://mp.weixin.qq.com/s/eq8nrfe3tkfg4nb8f49vla
Details Url 1 
https://mp.weixin.qq.com/s/w4hkbrjnwn1g32qcpannoa22.https
Details Url 3 
https://www.proofpoint.com/us/blog/threat-insight/ta444-apt-startup-aimed-at-your-funds
Details Url 1 
https://labs.withsecure.com/content/dam/labs/docs/withsecure-lazarus-no-pineapple-
Details Url 2 
https://asec.ahnlab.com/ko/47622
Details Url 3 
https://asec.ahnlab.com/ko/47820
Details Url 3 
https://www.welivesecurity.com/2023/02/23/winordll64-backdoor-vast-lazarus-arsenal
Details Url 3 
https://mp.weixin.qq.com/s/iagumg7umdfcb96hyhqrdw
Details Url 3 
https://asec.ahnlab.com/en/49295
Details Url 2 
https://blog.alyac.co.kr/5102
Details Url 2 
https://blog.alyac.co.kr/5103
Details Url 2 
https://medium.com/s2wblog/kimsuky-group-appears-to-be-exploiting-onenote-like-the-
Details Url 1 
https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-
Details Url 3 
https://threatmon.io/chinotto-backdoor-technical-analysis-of-the-apt-reapers-powerful
Details Url 3 
https://asec.ahnlab.com/en/50625
Details Url 1 
https://blog.google/threat-analysis-group/how-were-protecting-users-from-government-
Details Url 4 
https://blog.virustotal.com/2023/04/apt43-investigation-into-north-korean.html
Details Url 1 
https://www.welivesecurity.com/2023/04/20/linux-malware-strengthens-links-lazarus-3cx-
Details Url 2 
https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/#
Details Url 3 
https://mp.weixin.qq.com/s/icfz9vhygxz0cd8_0-phdq
Details Url 5 
https://research.checkpoint.com/2023/chain-reaction-rokrats-missing-link
Details Url 1 
https://www.sentinelone.com/labs/kimsuky-evolves-reconnaissance-capabilities-in-new-
Details Url 4 
https://asec.ahnlab.com/ko/52662
Details Url 5 
https://mp.weixin.qq.com/s/rjvwkh6ubetzuvtxje_bia
Details Url 2 
https://www.genians.co.kr/hubfs/blogfile/threat_intelligence_report_apt37.pdf?hslang=ko
Details Url 5 
https://asec.ahnlab.com/en/53132
Details Url 2 
https://www.sentinelone.com/labs/kimsuky-ongoing-campaign-using-tailored-reconnaissance-
Details Url 1 
https://threatmon.io/reverse-engineering-rokrat-a-closer-look-at-apt37s-onedrive-based-
Details Url 1 
https://www.nsa.gov/press-room/press-releases-statements/press-release-view
Details Url 2 
https://mp.weixin.qq.com/s/v5jgn15kvr4zgjpkceuovq
Details Url 3 
https://asec.ahnlab.com/en/53377
Details Url 2 
https://www.sentinelone.com/labs/kimsuky-new-social-engineering-campaign-aims-to-steal-
Details Url 1 
https://www.genians.co.kr/hubfs/blogfile/20230620_threat_inteligence_report_apt37_macos.
Details Url 3 
https://asec.ahnlab.com/en/54349
Details Url 2 
https://mp.weixin.qq.com/s/mlkyhlzkamygcf4czw0vag
Details Url 4 
https://securelist.com/lazarus-andariel-mistakes-and-easyrat/110119
Details Url 2 
https://www.elastic.co/cn/security-labs/dprk-strikes-using-a-new-variant-of-rustbucket
Details Url 3 
https://asec.ahnlab.com/ko/54952
Details Url 1 
https://www.sentinelone.com/blog/bluenoroff-how-dprks-macos-rustbucket-seeks-to-evade-
Details Url 3 
https://asec.ahnlab.com/en/55145
Details Url 1 
https://ti.qianxin.com/blog/articles/cloud-spy-analysis-of-recent-attack-activities-by-
Details Url 4 
https://mp.weixin.qq.com/s/13bqdjcfntbfvmubhkgllw
Details Url 2 
https://mp.weixin.qq.com/s/gmgk6lg6pysebf4y7f7g7w
Details Url 3 
https://asec.ahnlab.com/en/55369
Details Url 3 
https://mp.weixin.qq.com/s/8aootjxn3c5sviae08-_gq
Details Url 1 
https://www.genians.co.kr/hubfs/blogfile/20230727_threat_inteligence_report_konni.
Details Url 1 
https://www.sentinelone.com/labs/comrades-in-arms-north-korea-compromises-sanctioned-
Details Url 2 
https://asec.ahnlab.com/ko/56256
Details Url 4 
https://blog.talosintelligence.com/lazarus-quiterat
Details Url 5 
https://blog.talosintelligence.com/lazarus-collectionrat
Details Url 1 
https://mp.weixin.qq.com/s/2anqicw1lii3j-ickcuthw?poc_token=hav7d2wjfljxoutf772bre3m
Details Url 2 
https://asec.ahnlab.com/ko/56654
Details Url 2 
https://mp.weixin.qq.com/s/pzfbhtrz6jelwibujrzcyw
Details Url 3 
https://mp.weixin.qq.com/s/qr8ljrz9d7rgj9xh9vpctg
Details Url 2 
https://mp.weixin.qq.com/s/1j4jnqlvust6psawwoq1cq
Details Url 2 
https://blog.alyac.co.kr/5251
Details Url 2 
https://mp.weixin.qq.com/s/hwveqib68aadnpqvrknaeq
Details Url 1 
https://www.welivesecurity.com/en/eset-research/lazarus-luring-employees-trojanized-
Details Url 2 
https://asec.ahnlab.com/ko/57427
Details Url 2 
https://asec.ahnlab.com/ko/57748
Details Url 2 
https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-
Details Url 4 
https://cyble.com/blog/higaisa-apt-resurfaces-via-phishing-website-targeting-chinese-users
Details Url 1 
https://medium.com/s2wblog/fastviewer-variant-merged-with-fastspy-and-disguised-as-a-
Details Url 5 
https://www.elastic.co/security-labs/elastic-catches-dprk-passing-out-kandykorn
Details Url 6 
https://www.jamf.com/blog/bluenoroff-strikes-again-with-new-macos-malware
Details Url 4 
https://asec.ahnlab.com/ko/58215
Details Url 1 
https://asec.ahnlab.com/ko/59209
Details Url 1 
https://asec.ahnlab.com/en/59318
Details Url 1 
https://mp.weixin.qq.com/s/s3wvspnjkfvhroufxrdtiq
Details Url 1 
https://asec.ahnlab.com/ko/59460
Details Url 1 
https://securelist.com/bluenoroff-new-macos-malware/111290
Details Url 1 
https://mp.weixin.qq.com/s/2cxw68ion9ch2fg37_cdqw
Details Url 1 
https://ti.qianxin.com/blog/articles/analysis-of-suspected-lazarus-apt-q-1-attack-sample-
Details Url 2 
https://blog.talosintelligence.com/lazarus_new_rats_dlang_and_telegram
Details Url 1 
https://mp.weixin.qq.com/s/bdab1bbgtd3amuziu2_tsw
Details Url 4 
https://mp.weixin.qq.com/s/g3gujg9wc96nw4crpww6gw
Details Url 5 
https://www.group-ib.com/blog/dark-pink-apt
Details Url 2 
https://mp.weixin.qq.com/s/7kojlgehsgei7kudhfoika
Details Url 1 
https://www.deepinstinct.com/blog/ducktail-threat-operation-re-emerges-with-new-lnk-
Details Url 1 
https://mp.weixin.qq.com/s/_wmljf41etsbrqda3bjftq120.https://blog.talosintelligence.com
Details Url 1 
https://yoroi.company/en/research/ducktail-dissecting-a-complex-infection-chain-started-
Details Url 1 
https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-
Details Url 5 
https://www.elastic.co/cn/security-labs/elastic-charms-spectralviper
Details Url 3 
https://www.zscaler.com/blogs/security-research/look-ducktail
Details Url 1 
https://labs.withsecure.com/publications/meet-the-ducks
Details Url 1 
https://blog.nsfocus.net/aptdarkpinkwinrar-0daycve-2023-38831
Details Url 1 
https://www.appgate.com/blog/vietnamese-information-stealer-campaigns-target-
Details Url 3 
https://securelist.com/ducktail-fashion-week/111017
Details Url 3 
https://mp.weixin.qq.com/s/ib2w86cxcpmgs8qronprkw
Details Url 1 
https://labs.withsecure.com/publications/darkgate-rises
Details Url 2 
https://labs.withsecure.com/publications/ducktail
Details Url 1 
https://www.zscaler.com/blogs/security-research/new-php-variant-ducktail-infostealer-
Details Url 1 
https://labs.withsecure.com/publications/ducktail-returns
Details Url 2 
https://mp.weixin.qq.com/s/jbaepcmvc80eoe8x0dnwkq
Details Url 2 
https://mp.weixin.qq.com/s/p7vxmhib5djl9zoe1obdww
Details Url 2 
https://mp.weixin.qq.com/s/7q2nulqlsofjsftbwqt2ka
Details Url 4 
https://mp.weixin.qq.com/s/rslbgqgtl_jzd73ajqi05q
Details Url 2 
https://mp.weixin.qq.com/s/sr-m-rrqyt3v2zkopbm-9g
Details Url 4 
https://mp.weixin.qq.com/s/xu7b3m-l2olai2bu7nbj0a
Details Url 2 
https://www.group-ib.com/media-center/press-releases/sidewinder-apt-report
Details Url 3 
https://threatmon.io/apt-sidecopy-targeting-indian-government-entities
Details Url 3 
https://mp.weixin.qq.com/s/rd03yh2ngrubume80d18uw
Details Url 4 
https://blog.cyble.com/2023/03/21/notorious-sidecopy-apt-group-sets-sights-on-indias-drdo
Details Url 2 
https://mp.weixin.qq.com/s/21klaapezgbbalgulgu9cw
Details Url 1 
https://mp.weixin.qq.com/s/duzinbdwpwj3qbbafrnzyg
Details Url 2 
https://www.intezer.com/blog/research/phishing-campaign-targets-nuclear-energy-industry
Details Url 1 
https://www.cyfirma.com/outofband/donot-apt-targets-individuals-in-south-asia-using-
Details Url 1 
https://mp.weixin.qq.com/s/zjsz5yqqzy5vnunrb9ylxg
Details Url 1 
https://www.uptycs.com/blog/cyber_espionage_in_india_decoding_apt_36_new_linux_
Details Url 3 
https://mp.weixin.qq.com/s/lb_nyxhi9ijgmvi2wjy9qg
Details Url 4 
https://www.fortinet.com/blog/threat-research/clean-rooms-nuclear-missiles-and-sidecopy
Details Url 1 
https://blogs.blackberry.com/en/2023/05/sidewinder-uses-server-side-polymorphism-to-
Details Url 4 
https://mp.weixin.qq.com/s/syk4ptmjloruogbmnd3hrg
Details Url 5 
https://www.group-ib.com/blog/hunting-sidewinder
Details Url 2 
https://mp.weixin.qq.com/s/qtsefcnpz9aeg0v2sipwua
Details Url 4 
https://mp.weixin.qq.com/s/dhqj9-0qlwvsqyh_ugdw2g
Details Url 4 
https://mp.weixin.qq.com/s/wu0vnmcf-fqyxibkzfzaew
Details Url 4 
https://mp.weixin.qq.com/s/h-zrvcofbzwz8ikyn5vu4w
Details Url 1 
https://perception-point.io/blog/operation-red-deer
Details Url 2 
https://mp.weixin.qq.com/s/mzadlpxbpcfqav41rtvm3a
Details Url 1 
https://www.cyfirma.com/outofband/donot-apt-elevates-its-tactics-by-deploying-malicious-
Details Url 1 
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-apt-c-35-aka-donot-team-active-
Details Url 1 
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-sidewinder-apt-group-launches-
Details Url 2 
https://asec.ahnlab.com/en/54916
Details Url 3 
https://mp.weixin.qq.com/s/ewgyvlmwud45xtvsoxevpg
Details Url 1 
https://threatmon.io/from-slides-to-threats-transparent-tribes-new-attack-on-indian-
Details Url 1 
https://threatmon.io/unraveling-the-complex-infection-chain-analysis-of-the-sidecopy-apts-
Details Url 3 
https://mp.weixin.qq.com/s/qkwd_x3afpurthjqu7lbvg
Details Url 3 
https://mp.weixin.qq.com/s/hvhxyib4skug6ddwwe4pcw
Details Url 2 
https://mp.weixin.qq.com/s/9cqxdfn7erjupk9qprhqpg
Details Url 1 
https://mp.weixin.qq.com/s/f
Details Url 1 
https://mp.weixin.qq.com/s/wjji5dr9ohsgwiaysetcfg
Details Url 2 
https://mp.weixin.qq.com/s/vcgi3ftr4lwxpwzf5eulia
Details Url 2 
https://mp.weixin.qq.com/s/6bicahgymobqmxnm27nnaq
Details Url 3 
https://mp.weixin.qq.com/s/nmtqww-jhkdkbwfpydfpra
Details Url 2 
https://mp.weixin.qq.com/s/iobcv0huvjfurebbynrw-w
Details Url 5 
https://www.zscaler.com/blogs/security-research/peek-apt36-s-updated-arsenal
Details Url 1 
https://www.sentinelone.com/labs/capratube-transparent-tribes-caprarat-mimics-youtube-
Details Url 2 
https://www.seqrite.com/blog/sidecopys-multi-platform-onslaught-leveraging-winrar-zero-
Details Url 4 
https://mp.weixin.qq.com/s/iwx2tgclor0jtdbnc3fowq
Details Url 4 
https://mp.weixin.qq.com/s/crx7nlpe4zzgwheowe8_ba
Details Url 1 
https://mp.weixin.qq.com/s/npepqjoclkdrsrhjp-ztga
Details Url 1 
https://mp.weixin.qq.com/s/cew83kzo6omopglpg-qgxw
Details Url 1 
https://mp.weixin.qq.com/s/o8kegk1dkffxcqt2kfdhha
Details Url 2 
https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-
Details Url 4 
https://www.mandiant.com/resources/blog/turla-galaxy-opportunity
Details Url 3 
https://cert.gov.ua/article/3718487
Details Url 3 
https://www.welivesecurity.com/2023/01/27/swiftslicer-new-destructive-wiper-malware-
Details Url 2 
https://therecord.media/latvia-confirms-phishing-attack-on-ministry-of-defense-linking-it-to-
Details Url 3 
https://cert.gov.ua/article/3761023
Details Url 1 
https://mrtiepolo.medium.com/russian-apt-gamaredon-exploits-hoaxshell-to-target-
Details Url 1 
https://mrtiepolo.medium.com/sophisticated-apt29-campaign-abuses-notion-api-to-target-
Details Url 1 
https://threatmon.io/beyond-bullets-and-bombs-an-examination-of-armageddon-groups-
Details Url 5 
https://blogs.blackberry.com/en/2023/03/nobelium-targets-eu-governments-assisting-ukraine
Details Url 3 
https://informnapalm.org/en/hacked-russian-gru-officer
Details Url 1 
https://securityintelligence.com/posts/ex-conti-fin7-actors-collaborate-new-domino-
Details Url 2 
https://blog.eclecticiq.com/exposed-web-panel-reveals-gamaredon-groups-automated-spear-
Details Url 1 
https://www.ncsc.gov.uk/news/apt28-exploits-known-vulnerability-to-carry-out-
Details Url 5 
https://securelist.com/tomiris-called-they-want-their-turla-malware-back/109552
Details Url 4 
https://labs.withsecure.com/publications/fin7-target-veeam-servers
Details Url 3 
https://www.prodaft.com/resource/detail/paperbug-nomadic-octopus-paperbug-campaign
Details Url 5 
https://cert.gov.ua/article/4492467
Details Url 4 
https://cert.gov.ua/article/4501891
Details Url 1 
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/analyzing-the-ntc-vulkan-
Details Url 5 
https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out
Details Url 1 
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-russia-
Details Url 3 
https://cert.gov.ua/article/4905718
Details Url 1 
https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-
Details Url 6 
https://cert.gov.ua/article/4905829
Details Url 3 
https://cert.gov.ua/article/5098518
Details Url 2 
https://blog.talosintelligence.com/malicious-campaigns-target-entities-in-ukraine-poland
Details Url 2 
https://cert.gov.ua/article/5160737
Details Url 4 
https://cert.gov.ua/article/5213167
Details Url 1 
https://www.avertium.com/resources/threat-reports/evolution-of-russian-apt29-new-attacks-
Details Url 3 
https://mp.weixin.qq.com/s/32u2nbhye0hjbwskhwct4g
Details Url 1 
https://go.recordedfuture.com/hubfs/reports/cta-2023-0727-1.pdf
Details Url 1 
https://blog.eclecticiq.com/german-embassy-lure-likely-part-of-campaign-against-nato-
Details Url 2 
https://www.cisa.gov/news-events/analysis-reports/ar23-243a
Details Url 4 
https://www.zscaler.com/blogs/security-research/steal-it-campaign
Details Url 3 
https://www.silentpush.com/blog/from-russia-with-a-71
Details Url 2 
https://unit42.paloaltonetworks.com/turla-pensive-ursa-threat-assessment
Details Url 3 
https://mp.weixin.qq.com/s/qflq_i08mdwyl8wl5_vshq
Details Url 1 
https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-
Details Url 3 
https://www.cert.ssi.gouv.fr/uploads/certfr-2023-cti-009.pdf
Details Url 4 
https://unit42.paloaltonetworks.com/pensive-ursa-uses-upgraded-kazuar-backdoor
Details Url 1 
https://www.mandiant.com/resources/blog/sandworm-disrupts-power-ukraine-operational-
Details Url 1 
https://www.rnbo.gov.ua/files/2023_year/cybercenter/november/apt29%20attacks%20
Details Url 2 
https://research.checkpoint.com/2023/malware-spotlight-into-the-trash-analyzing-
Details Url 1 
https://www.wojsko-polskie.pl/woc/articles/aktualnosci-w/detecting-malicious-activity-
Details Url 2 
https://www.proofpoint.com/us/blog/threat-insight/ta422s-dedicated-exploitation-loop-
Details Url 1 
https://mp.weixin.qq.com/s/qxegbv6ltn_udjrsks-srg
Details Url 2 
https://socradar.io/dark-web-profile-muddywater-apt-group
Details Url 1 
https://www.welivesecurity.com/2023/01/10/strongpity-espionage-campaign-targeting-
Details Url 1 
https://www.trendmicro.com/en_us/research/23/b/new-apt34-malware-targets-the-middle-
Details Url 2 
https://www.gov.il/en/departments/news/_muddywater
Details Url 5 
https://mp.weixin.qq.com/s/nomfjajgydsoplbtioszpa
Details Url 3 
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/mantis-palestinian-
Details Url 2 
https://www.microsoft.com/en-us/security/blog/2023/04/07/mercury-and-dev-1084-
Details Url 2 
https://www.microsoft.com/en-us/security/blog/2023/04/18/nation-state-threat-actor-mint-
Details Url 4 
https://www.group-ib.com/blog/muddywater-infrastructure
Details Url 1 
https://research.checkpoint.com/2023/educated-manticore-iran-aligned-threat-actor-
Details Url 1 
https://www.bitdefender.com/blog/businessinsights/unpacking-bellaciao-a-closer-look-at-
Details Url 3 
https://www.welivesecurity.com/2023/05/02/apt-groups-muddying-waters-msps
Details Url 2 
https://research.checkpoint.com/2023/agrius-deploys-moneybird-in-targeted-attacks-against-
Details Url 1 
https://www.volexity.com/blog/2023/06/28/charming-kitten-updates-powerstar-with-an-
Details Url 1 
https://www.deepinstinct.com/blog/phonyc2-revealing-a-new-malicious-command-control-
Details Url 1 
https://www.proofpoint.com/us/blog/threat-insight/welcome-new-york-exploring-ta453s-
Details Url 3 
https://mp.weixin.qq.com/s/xvv3boad7cdpaz0na8id1q
Details Url 2 
https://mp.weixin.qq.com/s/e4s10n9slxjrmmgyjfzn0g
Details Url 2 
https://mp.weixin.qq.com/s/yeiyujvg2rmgri8gddapba
Details Url 1 
https://www.welivesecurity.com/en/eset-research/sponsor-batch-filed-whiskers-ballistic-
Details Url 1 
https://www.microsoft.com/en-us/security/blog/2023/09/14/peach-sandstorm-password-
Details Url 3 
https://mp.weixin.qq.com/s/-lyxjtjehdwa8km_ri1cxg
Details Url 1 
https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-
Details Url 2 
https://www.welivesecurity.com/en/eset-research/stealth-falcon-preying-middle-eastern-
Details Url 1 
https://www.trendmicro.com/en_us/research/23/i/apt34-deploys-phishing-attack-with-new-
Details Url 4 
https://mp.weixin.qq.com/s/xy9pfucgtytzae_xlwsn6w
Details Url 1 
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/crambus-middle-
Details Url 2 
https://research.checkpoint.com/2023/from-albania-to-the-middle-east-the-scarred-
Details Url 5 
https://blog.talosintelligence.com/arid-viper-mobile-spyware
Details Url 3 
https://www.deepinstinct.com/blog/muddywater-en-able-spear-phishing-with-new-ttps
Details Url 1 
https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-
Details Url 1 
https://www.sentinelone.com/labs/arid-viper-apts-nest-of-spyc23-malware-continues-to-
Details Url 4 
https://mp.weixin.qq.com/s/f6t_zqhylcdcjzrhihdxfa
Details Url 1 
https://www.proofpoint.com/us/blog/threat-insight/ta402-uses-complex-ironwind-infection-
Details Url 2 
https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-
Details Url 1 
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/iran-apt-seedworm-
Details Url 4 
https://securelist.com/operation-triangulation/109842
Details Url 2 
https://securelist.com/find-the-triangulation-utility/109867
Details Url 2 
https://securelist.com/triangledb-triangulation-implant/110050
Details Url 2 
https://securelist.com/triangulation-validators-modules/110847
Details Url 1 
https://securelist.com/operation-triangulation-catching-wild-triangle/110916
Details Url 1 
https://securelist.com/operation-triangulation-the-last-hardware-mystery/111669
Details Url 1 
https://research.checkpoint.com/2023/blindeagle-targeting-ecuador-with-sharpened-tools
Details Url 3 
https://blogs.blackberry.com/en/2023/02/blind-eagle-apt-c-36-targets-colombia
Details Url 1 
https://mp.weixin.qq.com/s/agvwff-ubtbtevusm2yspw
Details Url 2 
https://threatmon.io/apt-blind-eagles-malware-arsenal-technical-analysis
Details Url 4 
https://mp.weixin.qq.com/s/6ydnmaf0lailkukj04xltq
Details Url 2 
https://it.rising.com.cn/anquan/20037.html
Details Url 4 
https://mp.weixin.qq.com/s/-7u1-ntp0edvotptzbhusg
Details Url 1 
https://mp.weixin.qq.com/s/b0fskq6d3mvla8yx3v4iug
Details Url 2 
https://mp.weixin.qq.com/s/5e_ftpmscivfouwpigv7gw
Details Url 2 
https://www.trendmicro.com/en_us/research/23/b/earth-kitsune-delivers-new-whiskerspy-
Details Url 6 
https://blog.sekoia.io/following-noname05716-ddosia-projects-targets
Details Url 6 
https://securelist.com/goldenjackal-apt-group/109677
Details Url 2 
https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-
Details Url 2 
https://www.paloaltonetworks.com/blog/security-operations/through-the-cortex-xdr-lens-
Details Url 1 
https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/space-pirates-a-look-
Details Url 4 
https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia
Details Url 1 
https://mp.weixin.qq.com/s/dzwbj8-utji29kh2on90fq
Details Url 2 
https://mp.weixin.qq.com/s/doq5ka7mwqcdg2x_ngboea
Details Url 7 
https://www.barracuda.com/company/legal/esg-vulnerability
Details Url 4 
https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
Details Url 1 
https://msrc.microsoft.com/blog/2023/07/microsoft-mitigates-china-based-threat-actor-
Details Url 1 
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-193a
Details Url 1 
https://practical365.com/storm-0558-snafus
Details Url 1 
https://docs.google.com/spreadsheets/d/1lknj0uqwbec1ztrrxdtuplcil7mlureokfsigajnsyy
Details Url 1 
https://blog.google/threat-analysis-group/active-north-korean-campaign-targeting-security-
Details Url 1 
https://blog.google/threat-analysis-group/0-days-exploited-by-commercial-surveillance-
Details Url 1 
https://citizenlab.ca/2023/09/predator-in-the-wires-ahmed-eltantawy-targeted-with-predator-
Details Url 1 
https://www.trendmicro.com/en_us/research/22/d/new-apt-group-earth-berberoka-targets-
Details Url 1 
https://ti.qianxin.com/uploads/2023/03/20/396eaf4482e610119ce0cdcd7526c945.pdf
Details Url 1 
https://ti.qianxin.com/apt/detail/5acb29d0596a10001a1a9794?name=turla&type=map
Details Url 1 
https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-
Details CERT Ukraine 49 
UAC-0056
Details CERT Ukraine 14 
UAC-0057
Details China National Vulnerability Database CNVD 2 
CNVD-2023-69477
Details CVE 176 
cve-2023-23397
Details CVE 117 
cve-2023-2868
Details CVE 133 
cve-2023-38831
Details CVE 34 
cve-2022-4262
Details CVE 21 
cve-2022-3038
Details CVE 53 
cve-2023-42793
Details CVE 375 
cve-2017-11882
Details CVE 6 
cve-2023-41990
Details CVE 61 
cve-2023-32434
Details CVE 26 
cve-2023-38606
Details CVE 51 
cve-2023-32435
Details CVE 8 
cve-2019-5782
Details CVE 30 
cve-2023-21674
Details CVE 43 
cve-2023-23529
Details CVE 27 
cve-2023-21823
Details CVE 20 
cve-2023-21715
Details CVE 36 
cve-2023-23376
Details CVE 24 
cve-2023-20963
Details CVE 43 
cve-2023-24880
Details CVE 14 
cve-2023-21768
Details CVE 20 
cve-2023-0266
Details CVE 26 
cve-2023-26083
Details CVE 53 
cve-2023-28206
Details CVE 54 
cve-2023-28205
Details CVE 73 
cve-2023-28252
Details CVE 48 
cve-2023-2033
Details CVE 41 
cve-2023-2136
Details CVE 15 
cve-2023-21492
Details CVE 32 
cve-2023-28204
Details CVE 33 
cve-2023-32373
Details CVE 39 
cve-2023-32409
Details CVE 46 
cve-2023-29336
Details CVE 37 
cve-2023-3079
Details CVE 48 
cve-2023-32439
Details CVE 50 
cve-2023-37450
Details CVE 31 
cve-2023-32046
Details CVE 34 
cve-2023-36874
Details CVE 119 
cve-2023-36884
Details CVE 20 
cve-2023-37580
Details CVE 5 
cve-2023-35674
Details CVE 8 
cve-2023-4762
Details CVE 22 
cve-2023-41064
Details CVE 12 
cve-2023-41061
Details CVE 51 
cve-2023-4863
Details CVE 17 
cve-2023-26369
Details CVE 21 
cve-2023-36802
Details CVE 13 
cve-2023-36761
Details CVE 25 
cve-2023-41992
Details CVE 22 
cve-2023-41991
Details CVE 38 
cve-2023-41993
Details CVE 27 
cve-2023-5217
Details CVE 5 
cve-2023-4211
Details CVE 4 
cve-2023-33106
Details CVE 4 
cve-2023-33107
Details CVE 4 
cve-2023-33063
Details CVE 11 
cve-2023-42824
Details CVE 102 
cve-2023-22515
Details CVE 24 
cve-2023-36036
Details CVE 28 
cve-2023-36033
Details CVE 84 
cve-2023-46604
Details CVE 7 
cve-2023-6345
Details CVE 5 
cve-2023-42916
Details CVE 6 
cve-2023-42917
Details CVE 31 
cve-2022-44698
Details CVE 6 
cve-2021-39793
Details Domain 13 
qianxin.com
Details Domain 58 
ti.qianxin.com
Details Domain 7 
000webhostapp.com
Details Domain 55 
live.com
Details Domain 1 
xxxx.co
Details Domain 7 
xxxx.com
Details Domain 101 
cert.pl
Details Domain 118 
sekoia.io
Details Domain 12 
www.gov.pl
Details Domain 224 
unit42.paloaltonetworks.com
Details Domain 21 
lab52.io
Details Domain 546 
www.recordedfuture.com
Details Domain 83 
cert.gov.ua
Details Domain 58 
blog.sekoia.io
Details Domain 208 
mp.weixin.qq.com
Details Domain 20 
sentinelone.com
Details Domain 20 
www.seqrite.com
Details Domain 262 
www.welivesecurity.com
Details Domain 53 
blogs.blackberry.com
Details Domain 137 
securityaffairs.com
Details Domain 403 
securelist.com
Details Domain 101 
www.group-ib.com
Details Domain 182 
www.mandiant.com
Details Domain 434 
medium.com
Details Domain 45 
www.reversinglabs.com
Details Domain 397 
www.microsoft.com
Details Domain 469 
www.cisa.gov
Details Domain 189 
asec.ahnlab.com
Details Domain 124 
www.sentinelone.com
Details Domain 128 
www.fbi.gov
Details Domain 370 
www.proofpoint.com
Details Domain 20 
labs.withsecure.com
Details Domain 37 
blog.alyac.co.kr
Details Domain 84 
www.zscaler.com
Details Domain 13 
threatmon.io
Details Domain 55 
blog.google
Details Domain 11 
blog.virustotal.com
Details Domain 26 
www.jamf.com
Details Domain 141 
research.checkpoint.com
Details Domain 22 
www.genians.co.kr
Details Domain 25 
www.nsa.gov
Details Domain 101 
www.elastic.co
Details Domain 261 
blog.talosintelligence.com
Details Domain 25 
cyble.com
Details Domain 17 
www.deepinstinct.com
Details Domain 15 
yoroi.company
Details Domain 604 
www.trendmicro.com
Details Domain 25 
blog.nsfocus.net
Details Domain 2 
www.appgate.com
Details Domain 65 
blog.cyble.com
Details Domain 23 
www.intezer.com
Details Domain 25 
www.cyfirma.com
Details Domain 27 
www.uptycs.com
Details Domain 144 
www.fortinet.com
Details Domain 6 
perception-point.io
Details Domain 6 
www.rewterz.com
Details Domain 99 
therecord.media
Details Domain 3 
mrtiepolo.medium.com
Details Domain 10 
informnapalm.org
Details Domain 88 
securityintelligence.com
Details Domain 15 
blog.eclecticiq.com
Details Domain 98 
www.ncsc.gov.uk
Details Domain 13 
www.prodaft.com
Details Domain 20 
www.trustwave.com
Details Domain 74 
thedfirreport.com
Details Domain 72 
symantec-enterprise-blogs.security.com
Details Domain 2 
www.avertium.com
Details Domain 47 
go.recordedfuture.com
Details Domain 14 
www.silentpush.com
Details Domain 65 
www.cert.ssi.gouv.fr
Details Domain 8 
www.rnbo.gov.ua
Details Domain 2 
www.wojsko-polskie.pl
Details Domain 78 
socradar.io
Details Domain 4 
www.gov.il
Details Domain 128 
www.bitdefender.com
Details Domain 36 
www.volexity.com
Details Domain 7 
it.rising.com.cn
Details Domain 34 
www.paloaltonetworks.com
Details Domain 57 
www.ptsecurity.com
Details Domain 15 
www.barracuda.com
Details Domain 452 
msrc.microsoft.com
Details Domain 3 
practical365.com
Details Domain 112 
docs.google.com
Details Domain 67 
citizenlab.ca
Details Email 11 
ti_support@qianxin.com
Details Email 1 
用硬编码的发件人地址pivn-kr@prokuratura.dp
Details File 1 
ank.php
Details File 1 
%public%\documents\svchost2.png
Details File 1 
mwvcis.png
Details File 1 
%public%\documents\svchost2.exe
Details File 1 
释放名为nvspcaps1.db
Details File 99 
cert.pl
Details File 40 
gov.pl
Details File 2 
kimsuky-war-simulation-centre.html
Details File 1 
service-svr-exploiting-jetbrains-teamcity-cve-globally_0.pdf
Details File 1 
threat-intelligence-report-2023.pdf
Details File 4 
apt43-investigation-into-north-korean.html
Details File 4 
threat_intelligence_report_apt37.pdf
Details File 1 
trend-micro-vision-one.html
Details File 1 
cta-2023-0727-1.pdf
Details File 141 
www.cer
Details File 3 
certfr-2023-cti-009.pdf
Details File 1 
embassies%20using%20cve-2023-38831%20-%20report%20en.pdf
Details File 2 
wojsko-polskie.pl
Details File 3 
east.html
Details File 4 
malware.html
Details File 2 
20037.html
Details File 3 
backdoor.html
Details File 1 
gambling-websites-with-old.html
Details File 1 
396eaf4482e610119ce0cdcd7526c945.pdf
Details md5 1 
396eaf4482e610119ce0cdcd7526c945
Details Mandiant Uncategorized Groups 21 
UNC4899
Details Mandiant Uncategorized Groups 54 
UNC4841
Details Deprecated Microsoft Threat Actor Naming Taxonomy (Groups in development) 25 
DEV-1084
Details Microsoft Threat Actor Naming Taxonomy (Groups in development) 115 
Storm-0558
Details Microsoft Threat Actor Naming Taxonomy (Groups in development) 79 
Storm-0978
Details Microsoft Threat Actor Naming Taxonomy (Groups in development) 9 
storm-0558
Details Threat Actor Identifier - APT-C 15 
APT-C-28
Details Threat Actor Identifier - APT-C 30 
APT-C-26
Details Threat Actor Identifier - APT-C 15 
APT-C-55
Details Threat Actor Identifier - APT-C 102 
APT-C-35
Details Threat Actor Identifier - APT-C 14 
APT-C-56
Details Threat Actor Identifier - APT-C 7 
APT-C-52
Details Threat Actor Identifier - APT-C 79 
APT-C-23
Details Threat Actor Identifier - APT-C 83 
APT-C-36
Details Threat Actor Identifier - APT-C 44 
APT-C-00
Details Threat Actor Identifier - APT-Q 3 
APT-Q-77
Details Threat Actor Identifier - APT-Q 8 
APT-Q-15
Details Threat Actor Identifier - APT-Q 20 
APT-Q-27
Details Threat Actor Identifier - APT-Q 4 
APT-Q-29
Details Threat Actor Identifier - APT-Q 4 
APT-Q-1
Details Threat Actor Identifier - APT-Q 9 
APT-Q-31
Details Threat Actor Identifier - APT-Q 11 
APT-Q-36
Details Threat Actor Identifier - APT-Q 5 
APT-Q-20
Details Threat Actor Identifier - APT-Q 15 
APT-Q-12
Details Threat Actor Identifier - APT-Q 2 
APT-Q-41
Details Threat Actor Identifier - APT-Q 7 
APT-Q-37
Details Threat Actor Identifier - APT-Q 3 
APT-Q-78
Details Threat Actor Identifier - APT-Q 7 
APT-Q-11
Details Threat Actor Identifier - APT-Q 7 
APT-Q-14
Details Threat Actor Identifier - APT-Q 4 
APT-Q-38
Details Threat Actor Identifier - APT-Q 2 
APT-Q-58
Details Threat Actor Identifier - APT 783 
APT28
Details Threat Actor Identifier - APT 665 
APT29
Details Threat Actor Identifier - APT 115 
APT43
Details Threat Actor Identifier - APT 277 
APT37
Details Threat Actor Identifier - APT 144 
APT38
Details Threat Actor Identifier - APT 121 
APT36
Details Threat Actor Identifier - APT 258 
APT34
Details Threat Actor Identifier - APT 194 
APT35
Details Threat Actor Identifier - APT 181 
APT33
Details Threat Actor Identifier - APT 121 
APT42
Details Threat Actor Identifier - FIN 377 
FIN7
Details Threat Actor Identifier by Unit 42 7 
CL-STA-0043
Details Url 24 
https://ti.qianxin.com
Details Url 1 
https://xxxx.com/mwvcis.png
Details Url 1 
https://www.gov.pl/web/baza-wiedzy/espionage-campaign-linked-to-russian-intelligence-
Details Url 4 
https://unit42.paloaltonetworks.com/cloaked-ursa-phishing
Details Url 1 
https://lab52.io/blog/2344-2
Details Url 1 
https://www.recordedfuture.com/bluebravo-adapts-to-target-diplomatic-entities-with-
Details Url 5 
https://cert.gov.ua/article/5105791
Details Url 4 
https://blog.sekoia.io/aridviper-an-intrusion-set-allegedly-associated-with-hamas
Details Url 3 
https://mp.weixin.qq.com/s/_wmljf41etsbrqda3bjftq
Details Url 3 
https://mp.weixin.qq.com/s/w--fsifrhquaiv80auitzq
Details Url 2 
https://mp.weixin.qq.com/s/fixirwadiknrv4wlghj_mw