Skip to content

T1057 Process Discovery

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

In Windows environments, adversaries could obtain details on running processes using the Tasklist utility via cmd or Get-Process via PowerShell. Information about processes can also be extracted from the output of Native API calls such as CreateToolhelp32Snapshot. In Mac and Linux, this is accomplished with the ps command. Adversaries may also opt to enumerate processes via /proc. ESXi also supports use of the ps command, as well as esxcli system process list.42

On network devices, Network Device CLI commands such as show processes can be used to display current running processes.31

Item Value
ID T1057
Sub-techniques
Tactics TA0007
Platforms ESXi, Linux, Network Devices, Windows, macOS
Version 1.6
Created 31 May 2017
Last Modified 24 October 2025

Procedure Examples

ID Name Description
S0065 4H RAT 4H RAT has the capability to obtain a listing of running processes (including loaded modules).156
S0045 ADVSTORESHELL ADVSTORESHELL can list running processes.142
S0331 Agent Tesla Agent Tesla can list the current running processes on the system.97
S1129 Akira Akira verifies the deletion of volume shadow copies by checking for the existence of the process ID related to the process created to delete these items.252
G0138 Andariel Andariel has used tasklist to enumerate processes and find a specific string.316
S1133 Apostle Apostle retrieves a list of all running processes on a victim host, and stops all services containing the string “sql,” likely to propagate ransomware activity to database files.62
S0622 AppleSeed AppleSeed can enumerate the current process on a compromised host.102
G0006 APT1 APT1 gathered a list of running processes on the system using tasklist /v.308
G0007 APT28 An APT28 loader Trojan will enumerate the victim’s processes searching for explorer.exe if its current process does not have necessary permissions.130
G0022 APT3 APT3 has a tool that can list out currently running processes.342343
G0067 APT37 APT37’s Freenki malware lists running processes using the Microsoft Windows API.331
G0082 APT38 APT38 leveraged Sysmon to understand the processes, services in the organization.348
G1023 APT5 APT5 has used Windows-based utilities to carry out tasks including tasklist.exe. 324
S0456 Aria-body Aria-body has the ability to enumerate loaded modules for a process.25.
S0373 Astaroth Astaroth searches for different processes on the system.84
S1087 AsyncRAT AsyncRAT can examine running processes to determine if a debugger is present.13
S0640 Avaddon Avaddon has collected information about running processes.129
S0473 Avenger Avenger has the ability to use Tasklist to identify running processes.103
S1053 AvosLocker AvosLocker has discovered system processes by calling RmGetList.298
S0344 Azorult Azorult can collect a list of running processes by calling CreateToolhelp32Snapshot.292293
S0638 Babuk Babuk has the ability to check running processes on a targeted system.247248249
S0414 BabyShark BabyShark has executed the tasklist command.123
S0093 Backdoor.Oldrea Backdoor.Oldrea collects information about running processes.116
S0031 BACKSPACE BACKSPACE may collect information about running processes.39
S0606 Bad Rabbit Bad Rabbit can enumerate all running processes to compare hashes.155
S1081 BADHATCH BADHATCH can retrieve a list of running processes from a compromised machine.65
S0239 Bankshot Bankshot identifies processes and collects the process ids.86
S0534 Bazar Bazar can identity the current process on a compromised host.152
S0127 BBSRAT BBSRAT can list running processes.220
S0017 BISCUIT BISCUIT has a command to enumerate running processes and identify their owners.106
S0268 Bisonal Bisonal can obtain a list of running processes on the victim’s machine.474849
S0069 BLACKCOFFEE BLACKCOFFEE has the capability to discover processes.128
S0089 BlackEnergy BlackEnergy has gathered a process list by using Tasklist.exe.747576
S0657 BLUELIGHT BLUELIGHT can collect process filenames and SID authority level.200
S0486 Bonadan Bonadan can use the ps command to discover other cryptocurrency miners active on the system.294
S0252 Brave Prince Brave Prince lists the running processes.77
S1063 Brute Ratel C4 Brute Ratel C4 can enumerate all processes and locate specific process IDs (PIDs).9
S1039 Bumblebee Bumblebee can identify processes associated with analytical tools.232231233
S0482 Bundlore Bundlore has used the ps command to list processes.54
C0015 C0015 During C0015, the threat actors used the tasklist /s command as well as taskmanager to obtain a list of running processes.354
S0693 CaddyWiper CaddyWiper can obtain a list of current processes.281
S0351 Cannon Cannon can obtain a list of processes running on the system.2729
S0030 Carbanak Carbanak lists running processes.149
S0484 Carberp Carberp has collected a list of running processes.297
S0335 Carbon Carbon can list the processes on the victim’s machine.267
S0348 Cardinal RAT Cardinal RAT contains watchdog functionality that ensures its process is always running, else spawns a new instance.279
S0572 Caterpillar WebShell Caterpillar WebShell can gather a list of processes running on the machine.82
S0674 CharmPower CharmPower has the ability to list running processes through the use of tasklist.205
S0144 ChChes ChChes collects its process identifier (PID) on the victim.268
G0114 Chimera Chimera has used tasklist to enumerate processes.315
S1149 CHIMNEYSWEEP CHIMNEYSWEEP can check if a process name contains “creensaver.”181
S0660 Clambling Clambling can enumerate processes on a targeted system.215
S0611 Clop Clop can enumerate all processes on the victim’s machine.172
S1105 COATHANGER COATHANGER will query running process information to determine subsequent program execution flow.80
S0154 Cobalt Strike Cobalt Strike’s Beacon payload can collect information on process details.277276278
S0244 Comnie Comnie uses the tasklist to view running processes on the victim’s machine.91
S0575 Conti Conti can enumerate through all open processes to search for any that have the string “sql” in their process name.272
S0115 Crimson Crimson contains a command to list processes.177176178
S0625 Cuba Cuba can enumerate processes running on a victim’s machine.234
S1153 Cuckoo Stealer Cuckoo Stealer can use ps aux to enumerate running processes.127
S0687 Cyclops Blink Cyclops Blink can enumerate the process it is currently running under.184
S0497 Dacls Dacls can collect data on running and parent processes.92
S0334 DarkComet DarkComet can list active processes running on the victim’s machine.170
S1111 DarkGate DarkGate performs various checks for running processes, including security software by looking for hard-coded process name values.185186
G0012 Darkhotel Darkhotel malware can collect a list of running processes on a system.310
S1066 DarkTortilla DarkTortilla can enumerate a list of running processes on a compromised system.173
G0009 Deep Panda Deep Panda uses the Microsoft Tasklist utility to list processes running on systems.307
S0021 Derusbi Derusbi collects current and parent process IDs.282283
S0659 Diavol Diavol has used CreateToolhelp32Snapshot, Process32First, and Process32Next API calls to enumerate the running processes in the system.81
S0600 Doki Doki has searched for the current process’s PID.299
S0695 Donut Donut includes subprojects that enumerate and identify information about Process Injection candidates.10
S0472 down_new down_new has the ability to list running processes on a compromised host.103
S0694 DRATzarus DRATzarus can enumerate and examine running processes to determine if a debugger is present.210
S0567 Dtrack Dtrack’s dropper can list all running processes.224225
S0038 Duqu The discovery modules used with Duqu can collect information on process details.90
S1159 DUSTTRAP DUSTTRAP can enumerate running processes.105
S0062 DustySky DustySky collects information about running processes from victims.290291
G1006 Earth Lusca Earth Lusca has used Tasklist to obtain information from a compromised host.322
S0605 EKANS EKANS looks for processes from a hard-coded list.697071
S0081 Elise Elise enumerates processes via the tasklist command.101
S0064 ELMER ELMER is capable of performing process listings.164
S1247 Embargo Embargo has utilized MS4Killer to detect running processes on the victim device.122 Embargo has also captured a snapshot of active running processes using the Windows API CreateToolHelp32Snapshot().121
S0367 Emotet Emotet has been observed enumerating local processes.266
S0363 Empire Empire can find information about processes running on local and remote systems.1615
S0091 Epic Epic uses the tasklist /v command to obtain a list of processes.1920
S0396 EvilBunny EvilBunny has used EnumProcesses() to identify how many process are running in the environment.264
S0512 FatDuke FatDuke can list running processes on the localhost.159
S0267 FELIXROOT FELIXROOT collects a list of running processes.22
G0046 FIN7 FIN7 has used the PowerShell script 3CF9.ps1 to perform process discovery by executing tasklist /v. Additionally, WsTaskLoad.exe executes tasklist /v to perform process discovery.325
S0355 Final1stspy Final1stspy obtains a list of running processes.98
S0182 FinFisher FinFisher checks its parent process for indications that it is running in a sandbox setup.255254
S0696 Flagpro Flagpro has been used to run the tasklist command on a compromised system.287
S0661 FoggyWeb FoggyWeb’s loader can enumerate all Common Language Runtimes (CLRs) and running Application Domains in the compromised AD FS server’s Microsoft.IdentityServer.ServiceHost.exe process.151
S0503 FrameworkPOS FrameworkPOS can enumerate and exclude selected processes on a compromised host to speed execution of memory scraping.219
C0001 Frankenstein During Frankenstein, the threat actors used Empire to obtain a list of all running processes.15
S0277 FruitFly FruitFly has the ability to list processes on the system.32
S1044 FunnyDream FunnyDream has the ability to discover processes, including Bka.exe and BkavUtil.exe.6
C0007 FunnyDream During FunnyDream, the threat actors used Tasklist on targeted systems.6
S0410 Fysbis Fysbis can collect information about running processes.78
G0047 Gamaredon Group Gamaredon Group has used tools to enumerate processes on target hosts including Process Explorer.344346345
S0666 Gelsemium Gelsemium can enumerate running processes.133
S0049 GeminiDuke GeminiDuke collects information on running processes and environment variables from the victim.83
S0460 Get2 Get2 has the ability to identify running processes on an infected host.135
S0032 gh0st RAT gh0st RAT has the capability to list processes.202
S0249 Gold Dragon Gold Dragon checks the running processes on the victim’s machine.77
S0477 Goopy Goopy has checked for the Google Updater process to ensure Goopy was loaded properly.214
S0531 Grandoreiro Grandoreiro can identify installed security tools based on process names.36
S0237 GravityRAT GravityRAT lists the running processes on the system.124
G0125 HAFNIUM HAFNIUM has used tasklist to enumerate processes.309
S0151 HALFBAKED HALFBAKED can obtain information about running processes on the victim.136
S1229 Havoc Havoc can enumerate processes on targeted hosts.114113115
S0617 HELLOKITTY HELLOKITTY can search for specific processes to terminate.41
S0170 Helminth Helminth has used Tasklist to get information on processes.130
G1001 HEXANE HEXANE has enumerated processes on targeted systems.338
S1027 Heyoka Backdoor Heyoka Backdoor can gather process information.160
G0126 Higaisa Higaisa’s shellcode attempted to find the process ID of the current process.334
S1230 HIUPAN HIUPAN has conducted process discovery to identify the PUBLOAD malware under the process WCBrowserWatcher.exe and will launch it from an install directory if it is not found.108
S0431 HotCroissant HotCroissant has the ability to list running processes on the infected host.204
S0203 Hydraq Hydraq creates a backdoor through which remote attackers can monitor processes.206207
S0278 iKitten iKitten lists the current processes running.32
S0434 Imminent Monitor Imminent Monitor has a “Process Watcher” feature to monitor processes in case the client ever crashes or gets closed.8
S1139 INC Ransomware INC Ransomware can use the Microsoft Win32 Restart Manager to kill processes with a specific handle or that are accessing resources it wants to encrypt.289
G0100 Inception Inception has used a reconnaissance module to identify active processes and other associated loaded modules.339
S1072 Industroyer2 Industroyer2 has the ability to cyclically enumerate running processes such as PServiceControl.exe, PService_PDD.exe, and other targets supplied through a hardcoded configuration.175
S1245 InvisibleFerret InvisibleFerret has the capability to query installed programs and running processes.137 InvisibleFerret has also identified running processes using the Python project “psutil”.138
S0260 InvisiMole InvisiMole can obtain a list of running processes.273274
S1132 IPsec Helper IPsec Helper can identify the process it is currently running under and its number, and pass this back to a command and control node.62
S0581 IronNetInjector IronNetInjector can identify processes via C# methods such as GetProcessesByName and running Tasklist with the Python os.popen function.5
S0015 Ixeshe Ixeshe can list running processes.53
S0528 Javali Javali can monitor processes for open browsers and custom banking applications.112
S0044 JHUHUGIT JHUHUGIT obtains a list of running processes on the victim.4445
S0201 JPIN JPIN can list running processes.64
S0283 jRAT jRAT can query and kill system processes.169
S0088 Kasidet Kasidet has the ability to search for a given process name in processes currently running in the system.107
S0265 Kazuar Kazuar obtains a list of running processes through WMI querying and the ps command.134
G0004 Ke3chang Ke3chang performs process discovery using tasklist commands.336337
S0271 KEYMARBLE KEYMARBLE can obtain a list of running processes on the system.37
S0607 KillDisk KillDisk has called GetCurrentProcess.161
G0094 Kimsuky Kimsuky can gather a list of all processes running on a victim’s machine.332 Kimsuky has also obtained running processes on the victim device utilizing PowerShell cmdlet Get-Process.333
S0599 Kinsing Kinsing has used ps to list processes.263
S0162 Komplex The OsInfo function in Komplex collects a running process list.197
S0356 KONNI KONNI has used the command cmd /c tasklist to get a snapshot of the current processes on the target machine.157158
S1075 KOPILUWAK KOPILUWAK can enumerate current running processes on the targeted machine.140
C0035 KV Botnet Activity Scripts associated with KV Botnet Activity initial deployment can identify processes related to security tools and other botnet families for follow-on disabling during installation.353
S0236 Kwampirs Kwampirs collects a list of running services with the command tasklist /v.230
S1160 Latrodectus
Latrodectus can enumerate running processes including process grandchildren on targeted hosts.585957
G0032 Lazarus Group Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by Lazarus Group also gathers process times.31831732023892319
S1185 LightSpy If sent the command 16002, LightSpy uses the NSWorkspace runningApplications() method to collect the process ID, path to the executable, bundle information, and the filename of the executable for all running applications.61
S0211 Linfo Linfo creates a backdoor through which remote attackers can retrieve a list of running processes.193
S0681 Lizar Lizar has a plugin designed to obtain a list of processes.270269
S1199 LockBit 2.0 LockBit 2.0 can determine if a running process has administrative privileges and terminate processes that interfere with encryption or exfiltration.162163
S1202 LockBit 3.0 LockBit 3.0 can identify and terminate specific services.237236
S0582 LookBack LookBack can list running processes.141
S0451 LoudMiner LoudMiner used the ps command to monitor the running processes on the system.33
S0532 Lucifer Lucifer can identify the process that owns remote connections.60
S1141 LunarWeb LunarWeb has used shell commands to list running processes.189
S0409 Machete Machete has a component to check for running processes to look for web browsers.63
S1016 MacMa MacMa can enumerate running processes.191
S1048 macOS.OSAMiner macOS.OSAMiner has used ps ax | grep <name> | grep -v grep | ... and ps ax | grep -E... to conduct process discovery.288
S1060 Mafalda Mafalda can enumerate running processes on a machine.87
G0059 Magic Hound Magic Hound malware can list running processes.330
S0652 MarkiRAT MarkiRAT can search for different processes on a system.213
S0449 Maze Maze has gathered all of the running system processes.240
G1051 Medusa Group Medusa Group has utilized a hard-coded security tool process list that identifies and terminates using an undocumented IOCTL code 0x222094.109
S1244 Medusa Ransomware Medusa Ransomware has utilized an encoded list of the processes that it detects and terminates.109110111
S1191 Megazord Megazord can terminate a list of specified services and processes.217
S1059 metaMain metaMain can enumerate the processes that run on the platform.8788
S0455 Metamorfo Metamorfo has performed process name checks and has monitored applications.271
S0688 Meteor Meteor can check if a specific process is running, such as Kaspersky’s avp.exe.284
S1146 MgBot MgBot includes a module for establishing a process watchdog for itself, identifying if the MgBot process is still running.216
S1122 Mispadu Mispadu can enumerate the running processes on a compromised host.212
S0079 MobileOrder MobileOrder has a command to upload information about all running processes to its C2 server.153
G0021 Molerats Molerats actors obtained a list of active processes on the victim and sent them to C2 servers.290
S0149 MoonWind MoonWind has a command to return a list of running processes.26
S0256 Mosquito Mosquito runs tasklist to obtain running processes.195
G0069 MuddyWater MuddyWater has used malware to obtain a list of running processes on the system.326327
G0129 Mustang Panda Mustang Panda has used tasklist /v to determine active process information.323 Mustang Panda has also used TONESHELL malware to check the process name and process path to ensure it matches the expected one prior to triggering a custom exception handler.73
S0247 NavRAT NavRAT uses tasklist /v to check running processes.221
S0630 Nebulae Nebulae can enumerate processes on a target system.143
S0034 NETEAGLE NETEAGLE can send process listings over the C2 channel.39
S0198 NETWIRE NETWIRE can discover processes on compromised hosts.154
S1090 NightClub NightClub has the ability to use GetWindowThreadProcessId to identify the process behind a specified window.239
S1147 Nightdoor Nightdoor can collect information on installed applications via Windows registry keys, as well as collecting information on running processes.66
S1100 Ninja Ninja can enumerate processes on a targeted host.226227
S0385 njRAT njRAT can search a list of running processes for Tr.exe.253
S1107 NKAbuse NKAbuse will check victim systems to ensure only one copy of the malware is running.46
S0644 ObliqueRAT ObliqueRAT can check for blocklisted process names on a compromised host.241
S0346 OceanSalt OceanSalt can collect the name and ID for every process running on the system.201
G0049 OilRig OilRig has run tasklist on a victim’s machine and used infostealers to capture processes.340341
C0012 Operation CuckooBees During Operation CuckooBees, the threat actors used the tasklist command as part of their advanced reconnaissance.356
C0006 Operation Honeybee During Operation Honeybee, the threat actors obtained a list of running processes on a victim machine using cmd /c tasklist > %temp%\temp.ini.355
C0014 Operation Wocao During Operation Wocao, the threat actors used tasklist to collect a list of running processes on an infected system.357
S0229 Orz Orz can gather a process list from the victim.56
S1017 OutSteel OutSteel can identify running processes on a compromised host.223
S0626 P8RAT P8RAT can check for specific processes associated with virtual environments.126
S1233 PAKLOG PAKLOG has detected and logged the full path of processes active in the foreground using Windows API calls.280
S0664 Pandora Pandora can monitor processes on a compromised host.168
S0208 Pasam Pasam creates a backdoor through which remote attackers can retrieve lists of running processes.120
S1050 PcShare PcShare can obtain a list of running processes on a compromised host.6
S0517 Pillowmint Pillowmint can iterate through running processes every six seconds collecting a list of processes to capture from later.182
S0501 PipeMon PipeMon can iterate over the running processes to find a suitable injection target.190
S0254 PLAINTEE PLAINTEE performs the tasklist command to list running processes.192
G1040 Play
Play has used the information stealer Grixba to check for a list of security processes.311
S0435 PLEAD PLEAD has the ability to list processes on the compromised host.261
S0013 PlugX PlugX has a module to list the processes running on a machine.104
S0428 PoetRAT PoetRAT has the ability to list all running processes.209
S0216 POORAIM POORAIM can enumerate processes.38
G0033 Poseidon Group After compromising a victim, Poseidon Group lists all running processes.335
S0139 PowerDuke PowerDuke has a command to list the victim’s processes.139
S0441 PowerShower PowerShower has the ability to deploy a reconnaissance module to retrieve a list of the active processes.100
S0194 PowerSploit PowerSploit’s Get-ProcessTokenPrivilege Privesc-PowerUp module can enumerate privileges for a given process.1112
S0393 PowerStallion PowerStallion has been used to monitor process lists.165
S0223 POWERSTATS POWERSTATS has used get_tasklist to discover processes on the compromised host.300
S0184 POWRUNER POWRUNER may collect process information by running tasklist on a victim.93
S0238 Proxysvc Proxysvc lists processes running on the system.238
S1228 PUBLOAD PUBLOAD has used tasklist to gather running processes on victim host.108 PUBLOAD has also leveraged the OpenEventA Windows API function to check whether the same process was already running.73
S0192 Pupy Pupy can list the running processes and get the process ID and parent process’s ID.18
S0650 QakBot QakBot has the ability to check running processes.150
S1242 Qilin Qilin can define specific processes to be terminated or left alone at execution.147148145146
S0629 RainyDay RainyDay can enumerate processes on a target system.143
S0458 Ramsay Ramsay can gather a list of running processes by using Tasklist.188
S1212 RansomHub RansomHub can stop processes associated with files currently in use to maximize the impact of encryption.208
S1130 Raspberry Robin Raspberry Robin can identify processes running on the victim machine, such as security software, during execution.166167
S0241 RATANKBA RATANKBA lists the system’s processes.179180
S0662 RCSession RCSession can identify processes based on PID.68
C0056 RedPenguin During RedPenguin, UNC3886 used malware capable of reading the PID for the Junos OS snmpd daemon.349
S0125 Remsec Remsec can obtain a process list from the victim.79
S0448 Rising Sun Rising Sun can enumerate all running processes and process information on an infected machine.183
G0106 Rocke Rocke can detect a running process’s PID on the infected machine.329
S0270 RogueRobin RogueRobin checks the running processes for evidence it may be running in a sandbox environment. It specifically enumerates processes for Wireshark and Sysinternals.235
S0240 ROKRAT ROKRAT can list the current running processes on the system.118119
S1078 RotaJakiro RotaJakiro can monitor the /proc/[PID] directory of known RotaJakiro processes as a part of its persistence when executing with non-root permissions. If the process is found dead, it resurrects the process. RotaJakiro processes can be matched to an associated Advisory Lock, in the /proc/locks folder, to ensure it doesn’t spawn more than one process.259
S1073 Royal Royal can use GetCurrentProcess to enumerate processes.285
S0148 RTM RTM can obtain information about process integrity levels.286
S0446 Ryuk Ryuk has called CreateToolhelp32Snapshot to enumerate all running processes.43
S1210 Sagerunex Sagerunex identifies the explorer.exe process on the executing system.132
S1018 Saint Bot Saint Bot has enumerated running processes on a compromised host to determine if it is running under the process name dfrgui.exe.223
S1085 Sardonic Sardonic has the ability to execute the tasklist command.203
S0461 SDBbot SDBbot can enumerate a list of running processes on a compromised machine.251
S0345 Seasalt Seasalt has a command to perform a process listing.106
S0596 ShadowPad ShadowPad has collected the PID of a malicious process.194
S0445 ShimRatReporter ShimRatReporter listed all running processes on the machine.17
S0063 SHOTPUT SHOTPUT has a command to obtain a process listing.245
S1178 ShrinkLocker ShrinkLocker checks whether the Bitlocker Drive Encryption Tools service is running.296
G0121 Sidewinder Sidewinder has used tools to identify running processes on the victim’s machine.306
S0692 SILENTTRINITY SILENTTRINITY can enumerate processes, including properties to determine if they have the Common Language Runtime (CLR) loaded.14
S0468 Skidmap Skidmap has monitored critical processes to ensure resiliency.187
S0533 SLOTHFULMEDIA SLOTHFULMEDIA has enumerated processes by ID, name, or privileges.246
S1124 SocGholish SocGholish can list processes on targeted hosts.229
S0273 Socksbot Socksbot can list all running processes.275
S0627 SodaMaster SodaMaster can search a list of running processes.126
C0024 SolarWinds Compromise During the SolarWinds Compromise, APT29 used multiple command-line utilities to enumerate running processes.350352351
S0615 SombRAT SombRAT can use the getprocesslist command to enumerate processes on a compromised host.404142
S0516 SoreFang SoreFang can enumerate processes on a victim machine through use of Tasklist.55
G0038 Stealth Falcon Stealth Falcon malware gathers a list of running processes.312
G1053 Storm-0501 Storm-0501 has discovered running processes through tasklist.exe.321
S0142 StreamEx StreamEx has the ability to enumerate processes.24
S0491 StrongPity StrongPity can determine if a user is logged in by checking to see if explorer.exe is running.262
S0559 SUNBURST SUNBURST collected a list of process names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.196
S0562 SUNSPOT SUNSPOT monitored running processes for instances of MsBuild.exe by hashing the name of each running process and comparing it to the corresponding value 0x53D525. It also extracted command-line arguments and individual arguments from the running MsBuild.exe process to identify the directory path of the Orion software Visual Studio solution.23
S1064 SVCReady SVCReady can collect a list of running processes from an infected host.242
S0018 Sykipot Sykipot may gather a list of running processes by running tasklist /v.99
S0242 SynAck SynAck enumerates all running processes.257258
S0464 SYSCON SYSCON has the ability to use Tasklist to list running processes.218
S0663 SysUpdate SysUpdate can collect information about running processes.67
S0011 Taidoor Taidoor can use GetCurrentProcessId for process discovery.250
S0586 TAINTEDSCRIBE TAINTEDSCRIBE can execute ProcessList for process discovery.94
S0467 TajMahal TajMahal has the ability to identify running processes and associated plugins on an infected host.171
S0057 Tasklist Tasklist can be used to discover processes running on a system.7
G0139 TeamTNT TeamTNT has searched for rival malware and removes it if found.314 TeamTNT has also searched for running processes containing the strings aliyun or liyun to identify machines running Alibaba Cloud Security tools.313
S0595 ThiefQuest ThiefQuest obtains a list of running processes using the function kill_unwanted.244
G1022 ToddyCat ToddyCat has run cmd /c start /b tasklist to enumerate processes.227
S1239 TONESHELL TONESHELL has checked the process name and process path to ensure it matches the expected one prior to triggering a custom exception handler.73 TONESHELL has also searched for running antivirus processes to include ESET’s antivirus associated executables ekrn.exe and egui.exe.72
S0266 TrickBot TrickBot uses module networkDll for process list discovery.198199
S0094 Trojan.Karagany Trojan.Karagany can use Tasklist to collect a list of running tasks.116117
G0081 Tropic Trooper Tropic Trooper is capable of enumerating the running processes on the system using pslist.305228
S0436 TSCookie TSCookie has the ability to list processes on the infected host.52
G0010 Turla Turla surveys a system upon check-in to discover running processes using the tasklist /v command.19 Turla RPC backdoors have also enumerated processes associated with specific open ports or named pipes.165
S0333 UBoatRAT UBoatRAT can list running processes on the system.265
G1048 UNC3886 UNC3886 has run scripts to list all running processes on a guest VM from an ESXi host.328
S1164 UPSTYLE UPSTYLE has the ability to read /proc/self/cmdline to see if it is running as a monitored process.243
S0022 Uroburos Uroburos can use its Process List command to enumerate processes on compromised hosts.260
S0386 Ursnif Ursnif has gathered information about running processes.9596
S0452 USBferry USBferry can use tasklist to gather information about the process running on the infected system.228
S0476 Valak Valak has the ability to enumerate running processes on a compromised host.51
S0257 VERMIN VERMIN can get a list of the processes and running tasks on the system.295
S0180 Volgmer Volgmer can gather a list of processes.174
G1017 Volt Typhoon Volt Typhoon has enumerated running processes on targeted systems including through the use of Tasklist.304303302
S0670 WarzoneRAT WarzoneRAT can obtain a list of processes on a compromised host.21
S0579 Waterbear Waterbear can identify the process for a specific security product.256
G0112 Windshift Windshift has used malware to enumerate active processes.301
S0219 WINERACK WINERACK can enumerate processes.38
S0059 WinMM WinMM sets a WH_CBT Windows hook to collect information on process creation.34
S0141 Winnti for Windows Winnti for Windows can check if the explorer.exe process is responsible for calling its install function.125
G0044 Winnti Group Winnti Group looked for a specific process running on infected servers.347
S1065 Woody RAT Woody RAT can call NtQuerySystemProcessInformation with SystemProcessInformation to enumerate all running processes, including associated information such as PID, parent PID, image name, and owner.85
S0161 XAgentOSX XAgentOSX contains the getProcessList function to run ps aux to get running processes.222
S0248 yty yty gets an output of running processes using the tasklist command.131
S0251 Zebrocy Zebrocy uses the tasklist and wmic process get Capture, ExecutablePath commands to gather the processes running on the system.2728293031
S0330 Zeus Panda Zeus Panda checks for running processes on the victim’s machine.89
S1114 ZIPLINE ZIPLINE can identify running processes and their names.50
S0672 Zox Zox has the ability to list processes.211
S0412 ZxShell ZxShell has a command, ps, to obtain a listing of processes on the system.144
S1013 ZxxZ ZxxZ has created a snapshot of running processes using CreateToolhelp32Snapshot.35

References

  1. Cisco. (2022, August 16). show processes - . Retrieved July 13, 2022. ↩

  2. Michael Dawson. (2021, August 30). Hypervisor Jackpotting, Part 2: eCrime Actors Increase Targeting of ESXi Servers with Ransomware. Retrieved March 26, 2025. ↩

  3. US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020. ↩

  4. Zhongyuan Hau (Aaron), Ren Jie Yow, and Yoav Mazor. (2025, January 21). ESXi Ransomware Attacks: Stealthy Persistence through. Retrieved March 27, 2025. ↩

  5. Reichel, D. (2021, February 19). IronNetInjector: Turla’s New Malware Loading Tool. Retrieved February 24, 2021. ↩

  6. Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022. ↩↩↩

  7. Microsoft. (n.d.). Tasklist. Retrieved December 23, 2015. ↩

  8. Unit 42. (2019, December 2). Imminent Monitor – a RAT Down Under. Retrieved May 5, 2020. ↩

  9. Harbison, M. and Renals, P. (2022, July 5). When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors. Retrieved February 1, 2023. ↩

  10. TheWover. (2019, May 9). donut. Retrieved March 25, 2022. ↩

  11. PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018. ↩

  12. PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018. ↩

  13. Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023. ↩

  14. Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022. ↩

  15. Adamitis, D. et al. (2019, June 4). It’s alive: Threat actors cobble together open-source pieces into monstrous Frankenstein campaign. Retrieved May 11, 2020. ↩↩

  16. Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016. ↩

  17. Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020. ↩

  18. Nicolas Verdier. (n.d.). Retrieved January 29, 2018. ↩

  19. Kaspersky Lab’s Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014. ↩↩

  20. Kaspersky Lab’s Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018. ↩

  21. Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021. ↩

  22. Cherepanov, A. (2018, October). GREYENERGY A successor to BlackEnergy. Retrieved November 15, 2018. ↩

  23. CrowdStrike Intelligence Team. (2021, January 11). SUNSPOT: An Implant in the Build Process. Retrieved January 11, 2021. ↩

  24. Cylance SPEAR Team. (2017, February 9). Shell Crew Variants Continue to Fly Under Big AV’s Radar. Retrieved February 15, 2017. ↩

  25. CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020. ↩

  26. Miller-Osborn, J. and Grunzweig, J.. (2017, March 30). Trochilus and New MoonWind RATs Used In Attack Against Thai Organizations. Retrieved March 30, 2017. ↩

  27. Falcone, R., Lee, B. (2018, November 20). Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan. Retrieved November 26, 2018. ↩↩

  28. ESET. (2018, November 20). Sednit: What’s going on with Zebrocy?. Retrieved February 12, 2019. ↩

  29. Lee, B., Falcone, R. (2018, December 12). Dear Joohn: The Sofacy Group’s Global Campaign. Retrieved April 19, 2019. ↩↩

  30. ESET Research. (2019, May 22). A journey to Zebrocy land. Retrieved June 20, 2019. ↩

  31. Accenture Security. (2018, November 29). SNAKEMACKEREL. Retrieved April 15, 2019. ↩

  32. Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018. ↩↩

  33. Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020. ↩

  34. Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved April 10, 2019. ↩

  35. Raghuprasad, C . (2022, May 11). Bitter APT adds Bangladesh to their targets. Retrieved June 1, 2022. ↩

  36. ESET. (2020, April 28). Grandoreiro: How engorged can an EXE get?. Retrieved November 13, 2020. ↩

  37. US-CERT. (2018, August 09). MAR-10135536-17 – North Korean Trojan: KEYMARBLE. Retrieved August 16, 2018. ↩

  38. FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024. ↩↩

  39. FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved November 17, 2024. ↩↩

  40. The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021. ↩

  41. McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021. ↩↩

  42. CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021. ↩

  43. Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020. ↩

  44. ESET. (2016, October). En Route with Sednit - Part 1: Approaching the Target. Retrieved November 8, 2016. ↩

  45. Lee, B, et al. (2018, February 28). Sofacy Attacks Multiple Government Entities. Retrieved March 15, 2018. ↩

  46. KASPERSKY GERT. (2023, December 14). Unveiling NKAbuse: a new multiplatform threat abusing the NKN protocol. Retrieved February 8, 2024. ↩

  47. Hayashi, K., Ray, V. (2018, July 31). Bisonal Malware Used in Attacks Against Russia and South Korea. Retrieved August 7, 2018. ↩

  48. Zykov, K. (2020, August 13). CactusPete APT group’s updated Bisonal backdoor. Retrieved May 5, 2021. ↩

  49. Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022. ↩

  50. McLellan, T. et al. (2024, January 12). Cutting Edge: Suspected APT Targets Ivanti Connect Secure VPN in New Zero-Day Exploitation. Retrieved February 27, 2024. ↩

  51. Salem, E. et al. (2020, May 28). VALAK: MORE THAN MEETS THE EYE . Retrieved June 19, 2020. ↩

  52. Tomonaga, S. (2018, March 6). Malware “TSCookie”. Retrieved May 6, 2020. ↩

  53. Sancho, D., et al. (2012, May 22). IXESHE An APT Campaign. Retrieved June 7, 2019. ↩

  54. Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020. ↩

  55. CISA. (2020, July 16). MAR-10296782-1.v1 – SOREFANG. Retrieved September 29, 2020. ↩

  56. Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018. ↩

  57. Batista, J. (2024, June 17). Latrodectus, are you coming back?. Retrieved September 13, 2024. ↩

  58. Proofpoint Threat Research and Team Cymru S2 Threat Research. (2024, April 4). Latrodectus: This Spider Bytes Like Ice . Retrieved May 31, 2024. ↩

  59. Stepanic, D. and Bousseaden, S. (2024, May 15). Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID. Retrieved September 13, 2024. ↩

  60. Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020. ↩

  61. Stuart Ashenbrenner, Alden Schmidt. (2024, April 25). LightSpy Malware Variant Targeting macOS. Retrieved January 3, 2025. ↩

  62. Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024. ↩↩

  63. ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019. ↩

  64. Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018. ↩

  65. Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021. ↩

  66. Ahn Ho, Facundo Muñoz, & Marc-Etienne M.Léveillé. (2024, March 7). Evasive Panda leverages Monlam Festival to target Tibetans. Retrieved July 25, 2024. ↩

  67. Daniel Lunghi. (2023, March 1). Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting. Retrieved March 20, 2023. ↩

  68. Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021. ↩

  69. Dragos. (2020, February 3). EKANS Ransomware and ICS Operations. Retrieved February 9, 2021. ↩

  70. Zafra, D., et al. (2020, February 24). Ransomware Against the Machine: How Adversaries are Learning to Disrupt Industrial Production by Targeting IT and OT. Retrieved March 2, 2021. ↩

  71. Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025. ↩

  72. Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025. ↩↩↩

  73. F-Secure Labs. (2014). BlackEnergy & Quedagh: The convergence of crimeware and APT attacks. Retrieved March 24, 2016. ↩

  74. Baumgartner, K. and Garnaeva, M.. (2014, November 3). BE2 custom plugins, router abuse, and target profiles. Retrieved March 24, 2016. ↩

  75. Cherepanov, A.. (2016, January 3). BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry . Retrieved June 10, 2020. ↩

  76. Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018. ↩↩

  77. Doctor Web. (2014, November 21). Linux.BackDoor.Fysbis.1. Retrieved December 7, 2017. ↩

  78. Kaspersky Lab’s Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016. ↩

  79. Dutch Military Intelligence and Security Service (MIVD) & Dutch General Intelligence and Security Service (AIVD). (2024, February 6). Ministry of Defense of the Netherlands uncovers COATHANGER, a stealthy Chinese FortiGate RAT. Retrieved February 7, 2024. ↩

  80. Neeamni, D., Rubinfeld, A.. (2021, July 1). Diavol - A New Ransomware Used By Wizard Spider?. Retrieved November 12, 2021. ↩

  81. ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021. ↩

  82. F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015. ↩

  83. Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019. ↩

  84. MalwareBytes Threat Intelligence Team. (2022, August 3). Woody RAT: A new feature-rich malware spotted in the wild. Retrieved December 6, 2022. ↩

  85. Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018. ↩

  86. Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023. ↩↩

  87. SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023. ↩

  88. Ebach, L. (2017, June 22). Analysis Results of Zeus.Variant.Panda. Retrieved November 5, 2018. ↩

  89. Symantec Security Response. (2011, November). W32.Duqu: The precursor to the next Stuxnet. Retrieved September 17, 2015. ↩

  90. Grunzweig, J. (2018, January 31). Comnie Continues to Target Organizations in East Asia. Retrieved June 7, 2018. ↩

  91. Mabutas, G. (2020, May 11). New MacOS Dacls RAT Backdoor Shows Lazarus’ Multi-Platform Attack Capability. Retrieved August 10, 2020. ↩↩

  92. Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017. ↩

  93. USG. (2020, May 12). MAR-10288834-2.v1 – North Korean Trojan: TAINTEDSCRIBE. Retrieved March 5, 2021. ↩

  94. Caragay, R. (2015, March 26). URSNIF: The Multifaceted Malware. Retrieved June 5, 2019. ↩

  95. Sioting, S. (2013, June 15). BKDR_URSNIF.SM. Retrieved June 5, 2019. ↩

  96. Zhang, X. (2017, June 28). In-Depth Analysis of A New Variant of .NET Malware AgentTesla. Retrieved November 5, 2018. ↩

  97. Grunzweig, J. (2018, October 01). NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT. Retrieved November 5, 2018. ↩

  98. Blasco, J. (2011, December 12). Another Sykipot sample likely targeting US federal agencies. Retrieved March 28, 2016. ↩

  99. GReAT. (2019, August 12). Recent Cloud Atlas activity. Retrieved May 8, 2020. ↩

  100. Accenture Security. (2018, January 27). DRAGONFISH DELIVERS NEW FORM OF ELISE MALWARE TARGETING ASEAN DEFENCE MINISTERS’ MEETING AND ASSOCIATES. Retrieved November 17, 2024. ↩

  101. Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021. ↩

  102. Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020. ↩↩

  103. Computer Incident Response Center Luxembourg. (2013, March 29). Analysis of a PlugX variant. Retrieved November 5, 2018. ↩

  104. Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024. ↩

  105. Mandiant. (n.d.). Appendix C (Digital) - The Malware Arsenal. Retrieved July 18, 2016. ↩↩

  106. Yadav, A., et al. (2016, January 29). Malicious Office files dropping Kasidet and Dridex. Retrieved March 24, 2016. ↩

  107. Lenart Bermejo, Sunny Lu, Ted Lee. (2024, September 9). Earth Preta Evolves its Attacks with New Malware and Strategies. Retrieved August 4, 2025. ↩↩

  108. Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025. ↩↩

  109. Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025. ↩

  110. Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025. ↩

  111. GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020. ↩

  112. Shivtarkar, N. and Jain, S. (2023, February 14). Havoc Across the Cyberspace. Retrieved August 4, 2025. ↩

  113. Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025. ↩

  114. Wan, Y. (2025, March 3). Havoc: SharePoint with Microsoft Graph API turns into FUD C2. Retrieved August 4, 2025. ↩

  115. Symantec Security Response. (2014, June 30). Dragonfly: Cyberespionage Attacks Against Energy Suppliers. Retrieved April 8, 2016. ↩↩

  116. Secureworks. (2019, July 24). Updated Karagany Malware Targets Energy Sector. Retrieved August 12, 2020. ↩

  117. Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018. ↩

  118. Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020. ↩

  119. Mullaney, C. & Honda, H. (2012, May 4). Trojan.Pasam. Retrieved February 22, 2018. ↩

  120. Cyble. (2024, May 24). The Rust Revolution: New Embargo Ransomware Steps In. Retrieved October 19, 2025. ↩

  121. Jan Holman, Tomas Zvara. (2024, October 23). Embargo ransomware: Rock’n’Rust. Retrieved October 19, 2025. ↩

  122. Unit 42. (2019, February 22). New BabyShark Malware Targets U.S. National Security Think Tanks. Retrieved October 7, 2019. ↩

  123. Mercer, W., Rascagneres, P. (2018, April 26). GravityRAT - The Two-Year Evolution Of An APT Targeting India. Retrieved May 16, 2018. ↩

  124. Novetta Threat Research Group. (2015, April 7). Winnti Analysis. Retrieved February 8, 2017. ↩

  125. GREAT. (2021, March 30). APT10: sophisticated multi-layered loader Ecipekac discovered in A41APT campaign. Retrieved June 17, 2021. ↩↩

  126. Kohler, A. and Lopez, C. (2024, April 30). Malware: Cuckoo Behaves Like Cross Between Infostealer and Spyware. Retrieved August 20, 2024. ↩

  127. FireEye Labs/FireEye Threat Intelligence. (2015, May 14). Hiding in Plain Sight: FireEye and Microsoft Expose Obfuscation Tactic. Retrieved November 17, 2024. ↩

  128. Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021. ↩

  129. Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017. ↩↩

  130. Schwarz, D., Sopko J. (2018, March 08). Donot Team Leverages New Modular Malware Framework in South Asia. Retrieved June 11, 2018. ↩

  131. Symntec Threat Hunter Team. (2022, November 12). Billbug: State-sponsored Actor Targets Cert Authority, Government Agencies in Multiple Asian Countries. Retrieved March 15, 2025. ↩

  132. Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021. ↩

  133. Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018. ↩

  134. Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020. ↩

  135. Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing LNK. Retrieved April 24, 2017. ↩

  136. Seongsu Park. (2024, November 4). From Pyongyang to Your Payroll: The Rise of North Korean Remote Workers in the West. Retrieved October 17, 2025. ↩

  137. Unit 42. (2023, November 21). Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors. Retrieved October 17, 2025. ↩

  138. Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017. ↩

  139. Hawley, S. et al. (2023, February 2). Turla: A Galaxy of Opportunity. Retrieved May 15, 2023. ↩

  140. Raggi, M. Schwarz, D.. (2019, August 1). LookBack Malware Targets the United States Utilities Sector with Phishing Attacks Impersonating Engineering Licensing Boards. Retrieved February 25, 2021. ↩

  141. ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016. ↩

  142. Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021. ↩↩

  143. Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019. ↩

  144. Halcyon RISE Team. (2024, October 24). New Qilin.B Ransomware Variant Boasts Enhanced Encryption and Defense Evasion. Retrieved September 26, 2025. ↩

  145. Health Sector Cybersecurity Coordination Center. (2024, June 18). Qilin, aka Agenda Ransomware. Retrieved September 26, 2025. ↩

  146. Magdy, S. et al. (2022, August 25). New Golang Ransomware Agenda Customizes Attacks. Retrieved September 26, 2025. ↩

  147. SentinelOne. (2022, November 30). Agenda (Qilin). Retrieved September 26, 2025. ↩

  148. Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018. ↩

  149. Morrow, D. (2021, April 15). The rise of QakBot. Retrieved September 27, 2021. ↩

  150. Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021. ↩

  151. Cybereason Nocturnus. (2020, July 16). A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES. Retrieved November 18, 2020. ↩

  152. Falcone, R. and Miller-Osborn, J.. (2016, January 24). Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists. Retrieved February 10, 2016. ↩

  153. Maniath, S. and Kadam P. (2019, March 19). Dissecting a NETWIRE Phishing Campaign’s Usage of Process Hollowing. Retrieved January 7, 2021. ↩

  154. Mamedov, O. Sinitsyn, F. Ivanov, A.. (2017, October 24). Bad Rabbit ransomware. Retrieved January 28, 2021. ↩

  155. Crowdstrike Global Intelligence Team. (2014, June 9). CrowdStrike Intelligence Report: Putter Panda. Retrieved January 22, 2016. ↩

  156. Karmi, D. (2020, January 4). A Look Into Konni 2019 Campaign. Retrieved April 28, 2020. ↩

  157. Threat Intelligence Team. (2021, August 23). New variant of Konni malware used in campaign targetting Russia. Retrieved January 5, 2022. ↩

  158. Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020. ↩

  159. Chen, Joey. (2022, June 9). Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years. Retrieved July 14, 2022. ↩

  160. Gilbert Sison, Rheniel Ramos, Jay Yaneza, Alfredo Oliveira. (2018, January 15). KillDisk Variant Hits Latin American Financial Groups. Retrieved January 12, 2021. ↩

  161. FBI. (2022, February 4). Indicators of Compromise Associated with LockBit 2.0 Ransomware. Retrieved January 24, 2025. ↩

  162. SentinelOne. (n.d.). LockBit 2.0: In-Depth Analysis, Detection, Mitigation, and Removal. Retrieved January 24, 2025. ↩

  163. Winters, R. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016. ↩

  164. Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019. ↩↩

  165. Christopher So. (2022, December 20). Raspberry Robin Malware Targets Telecom, Governments. Retrieved May 17, 2024. ↩

  166. Patrick Schläpfer . (2024, April 10). Raspberry Robin Now Spreading Through Windows Script Files. Retrieved May 17, 2024. ↩

  167. Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021. ↩

  168. Bingham, J. (2013, February 11). Cross-Platform Frutas RAT Builder and Back Door. Retrieved April 23, 2019. ↩

  169. Kujawa, A. (2018, March 27). You dirty RAT! Part 1: DarkComet. Retrieved November 6, 2018. ↩

  170. GReAT. (2019, April 10). Project TajMahal – a sophisticated new APT framework. Retrieved October 14, 2019. ↩

  171. Mundo, A. (2019, August 1). Clop Ransomware. Retrieved May 10, 2021. ↩

  172. Secureworks Counter Threat Unit Research Team. (2022, August 17). DarkTortilla Malware Analysis. Retrieved November 3, 2022. ↩

  173. Yagi, J. (2014, August 24). Trojan.Volgmer. Retrieved July 16, 2018. ↩

  174. Daniel Kapellmann Zafra, Raymond Leong, Chris Sistrunk, Ken Proska, Corey Hildebrandt, Keith Lunden, Nathan Brubaker. (2022, April 25). INDUSTROYER.V2: Old Malware Learns New Tricks. Retrieved March 30, 2023. ↩

  175. Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021. ↩

  176. Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016. ↩

  177. N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022. ↩

  178. Lei, C., et al. (2018, January 24). Lazarus Campaign Targeting Cryptocurrencies Reveals Remote Controller Tool, an Evolved RATANKBA, and More. Retrieved May 22, 2018. ↩

  179. Trend Micro. (2017, February 27). RATANKBA: Delving into Large-scale Watering Holes against Enterprises. Retrieved May 22, 2018. ↩

  180. Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024. ↩

  181. Trustwave SpiderLabs. (2020, June 22). Pillowmint: FIN7’s Monkey Thief . Retrieved July 27, 2020. ↩

  182. Sherstobitoff, R., Malhotra, A., et. al.. (2018, December 18). Operation Sharpshooter Campaign Targets Global Defense, Critical Infrastructure. Retrieved May 14, 2020. ↩

  183. Adi Zeligson & Rotem Kerner. (2018, November 13). Enter The DarkGate - New Cryptocurrency Mining and Ransomware Campaign. Retrieved February 9, 2024. ↩

  184. McGraw, T. (2024, December 4). Black Basta Ransomware Campaign Drops Zbot, DarkGate, and Custom Malware. Retrieved December 9, 2024. ↩

  185. Remillano, A., Urbanec, J. (2019, September 19). Skidmap Linux Malware Uses Rootkit Capabilities to Hide Cryptocurrency-Mining Payload. Retrieved June 4, 2020. ↩

  186. Antiy CERT. (2020, April 20). Analysis of Ramsay components of Darkhotel’s infiltration and isolation network. Retrieved March 24, 2021. ↩

  187. Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024. ↩

  188. Tartare, M. et al. (2020, May 21). No “Game over” for the Winnti Group. Retrieved August 24, 2020. ↩

  189. M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022. ↩

  190. Ash, B., et al. (2018, June 26). RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families. Retrieved July 2, 2018. ↩

  191. Zhou, R. (2012, May 15). Backdoor.Linfo. Retrieved February 23, 2018. ↩

  192. Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021. ↩

  193. ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018. ↩

  194. FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021. ↩

  195. Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26). Sofacy’s ‘Komplex’ OS X Trojan. Retrieved July 8, 2017. ↩

  196. Boutin, J. (2020, October 12). ESET takes part in global operation to disrupt Trickbot. Retrieved March 15, 2021. ↩

  197. Tudorica, R., Maximciuc, A., Vatamanu, C. (2020, March 18). New TrickBot Module Bruteforces RDP Connections, Targets Select Telecommunication Services in US and Hong Kong. Retrieved March 15, 2021. ↩

  198. Cash, D., Grunzweig, J., Meltzer, M., Adair, S., Lancaster, T. (2021, August 17). North Korean APT InkySquid Infects Victims Using Browser Exploits. Retrieved September 30, 2021. ↩

  199. Sherstobitoff, R., Malhotra, A. (2018, October 18). ‘Operation Oceansalt’ Attacks South Korea, U.S., and Canada With Source Code From Chinese Hacker Group. Retrieved November 30, 2018. ↩

  200. FireEye Threat Intelligence. (2015, July 13). Demonstrating Hustle, Chinese APT Groups Quickly Use Zero-Day Vulnerability (CVE-2015-5119) Following Hacking Team Leak. Retrieved January 25, 2016. ↩

  201. Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023. ↩

  202. Knight, S.. (2020, April 16). VMware Carbon Black TAU Threat Analysis: The Evolution of Lazarus. Retrieved May 1, 2020. ↩

  203. Check Point. (2022, January 11). APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit. Retrieved January 24, 2022. ↩

  204. Symantec Security Response. (2010, January 18). The Trojan.Hydraq Incident. Retrieved February 20, 2018. ↩

  205. Lelli, A. (2010, January 11). Trojan.Hydraq. Retrieved February 20, 2018. ↩

  206. CISA et al. (2024, August 29). #StopRansomware: RansomHub Ransomware. Retrieved March 17, 2025. ↩

  207. Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020. ↩

  208. ClearSky Research Team. (2020, August 13). Operation ‘Dream Job’ Widespread North Korean Espionage Campaign. Retrieved December 20, 2021. ↩

  209. Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014. ↩

  210. ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024. ↩

  211. GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021. ↩

  212. Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018. ↩

  213. Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021. ↩

  214. Threat Hunter Team. (2023, April 20). Daggerfly: APT Actor Targets Telecoms Company in Africa. Retrieved July 25, 2024. ↩

  215. Zemah, Y. (2024, December 2). Threat Assessment: Howling Scorpius (Akira Ransomware). Retrieved January 8, 2025. ↩

  216. McCabe, A. (2020, January 23). The Fractured Statue Campaign: U.S. Government Agency Targeted in Spear-Phishing Attacks. Retrieved June 2, 2020. ↩

  217. Kremez, V. (2019, September 19). FIN6 “FrameworkPOS”: Point-of-Sale Malware Analysis & Internals. Retrieved September 8, 2020. ↩

  218. Lee, B. Grunzweig, J. (2015, December 22). BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger. Retrieved August 19, 2016. ↩

  219. Robert Falcone. (2017, February 14). XAgentOSX: Sofacy’s Xagent macOS Tool. Retrieved July 12, 2017. ↩

  220. Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022. ↩↩

  221. Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021. ↩

  222. Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021. ↩

  223. Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024. ↩

  224. Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024. ↩↩

  225. Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020. ↩↩

  226. Secureworks. (n.d.). GOLD PRELUDE . Retrieved March 22, 2024. ↩

  227. Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018. ↩

  228. Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022. ↩

  229. Merriman, K. and Trouerbach, P. (2022, April 28). This isn’t Optimus Prime’s Bumblebee but it’s Still Transforming. Retrieved August 22, 2022. ↩

  230. Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022. ↩

  231. Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021. ↩

  232. Falcone, R., et al. (2018, July 27). New Threat Actor Group DarkHydrus Targets Middle East Government. Retrieved August 2, 2018. ↩

  233. CISA et al. (2023, June 14). UNDERSTANDING RANSOMWARE THREAT ACTORS: LOCKBIT. Retrieved February 5, 2025. ↩

  234. Walter, J. (2022, July 21). LockBit 3.0 Update | Unpicking the Ransomware’s Latest Anti-Analysis and Evasion Techniques. Retrieved February 5, 2025. ↩

  235. Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018. ↩↩

  236. Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023. ↩

  237. Mundo, A. (2020, March 26). Ransomware Maze. Retrieved May 18, 2020. ↩

  238. Malhotra, A. (2021, March 2). ObliqueRAT returns with new campaign using hijacked websites. Retrieved September 2, 2021. ↩

  239. Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022. ↩

  240. Unit 42. (2024, April 12). Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400 . Retrieved January 15, 2025. ↩

  241. Patrick Wardle. (2020, June 29). OSX.EvilQuest Uncovered part i: infection, persistence, and more!. Retrieved March 18, 2021. ↩

  242. Falcone, R. and Wartell, R.. (2015, July 27). Observations on CVE-2015-3113, Prior Zero-Days and the Pirpi Payload. Retrieved January 22, 2016. ↩

  243. DHS/CISA, Cyber National Mission Force. (2020, October 1). Malware Analysis Report (MAR) MAR-10303705-1.v1 – Remote Access Trojan: SLOTHFULMEDIA. Retrieved October 2, 2020. ↩

  244. Sogeti. (2021, March). Babuk Ransomware. Retrieved August 11, 2021. ↩

  245. Mundo, A. et al. (2021, February). Technical Analysis of Babuk Ransomware. Retrieved August 11, 2021. ↩

  246. Centero, R. et al. (2021, February 5). New in Ransomware: Seth-Locker, Babuk Locker, Maoloa, TeslaCrypt, and CobraLocker. Retrieved August 11, 2021. ↩

  247. CISA, FBI, DOD. (2021, August). MAR-10292089-1.v2 – Chinese Remote Access Trojan: TAIDOOR. Retrieved August 24, 2021. ↩

  248. Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022. ↩

  249. Max Kersten & Alexandre Mundo. (2023, November 29). Akira Ransomware. Retrieved April 4, 2024. ↩

  250. Pascual, C. (2018, November 27). AutoIt-Compiled Worm Affecting Removable Media Delivers Fileless Version of BLADABINDI/njRAT Backdoor. Retrieved June 4, 2019. ↩

  251. Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018. ↩

  252. FinFisher. (n.d.). Retrieved September 12, 2024. ↩

  253. Su, V. et al. (2019, December 11). Waterbear Returns, Uses API Hooking to Evade Security. Retrieved February 22, 2021. ↩

  254. Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018. ↩

  255. Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018. ↩

  256. Alex Turing, Hui Wang. (2021, April 28). RotaJakiro: A long live secret backdoor with 0 VT detection. Retrieved June 14, 2023. ↩

  257. FBI et al. (2023, May 9). Hunting Russian Intelligence “Snake” Malware. Retrieved June 8, 2023. ↩

  258. Bermejo, L., et al. (2017, June 22). Following the Trail of BlackTech’s Cyber Espionage Campaigns. Retrieved May 5, 2020. ↩

  259. Mercer, W. et al. (2020, June 29). PROMETHIUM extends global reach with StrongPity3 APT. Retrieved July 20, 2020. ↩

  260. Singer, G. (2020, April 3). Threat Alert: Kinsing Malware Attacks Targeting Container Environments. Retrieved April 1, 2021. ↩

  261. Marschalek, M.. (2014, December 16). EvilBunny: Malware Instrumented By Lua. Retrieved June 28, 2019. ↩

  262. Hayashi, K. (2017, November 28). UBoatRAT Navigates East Asia. Retrieved January 12, 2018. ↩

  263. ASEC. (2017). ASEC REPORT VOL.88. Retrieved April 16, 2019. ↩

  264. ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018. ↩

  265. BI.ZONE Cyber Threats Research Team. (2021, May 13). From pentest to APT attack: cybercriminal group FIN7 disguises its malware as an ethical hacker’s toolkit. Retrieved February 2, 2022. ↩

  266. Seals, T. (2021, May 14). FIN7 Backdoor Masquerades as Ethical Hacking Tool. Retrieved February 2, 2022. ↩

  267. Erlich, C. (2020, April 3). The Avast Abuser: Metamorfo Banking Malware Hides By Abusing Avast Executable. Retrieved May 26, 2020. ↩

  268. Baskin, B. (2020, July 8). TAU Threat Discovery: Conti Ransomware. Retrieved February 17, 2021. ↩

  269. Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018. ↩

  270. Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020. ↩

  271. Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018. ↩

  272. Mavis, N. (2020, September 21). The Art and Science of Detecting Cobalt Strike. Retrieved September 12, 2024. ↩

  273. Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017. ↩

  274. Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021. ↩

  275. Grunzweig, J.. (2017, April 20). Cardinal RAT Active for Over Two Years. Retrieved December 8, 2018. ↩

  276. Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2. Retrieved September 12, 2025. ↩

  277. Threat Intelligence Team. (2022, March 18). Double header: IsaacWiper and CaddyWiper . Retrieved April 11, 2022. ↩

  278. Fidelis Cybersecurity. (2016, February 29). The Turbo Campaign, Featuring Derusbi for 64-bit Linux. Retrieved March 2, 2016. ↩

  279. FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018. ↩

  280. Check Point Research Team. (2021, August 14). Indra - Hackers Behind Recent Attacks on Iran. Retrieved February 17, 2022. ↩

  281. Cybereason Global SOC and Cybereason Security Research Teams. (2022, December 14). Royal Rumble: Analysis of Royal Ransomware. Retrieved March 30, 2023. ↩

  282. Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017. ↩

  283. Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022. ↩

  284. Phil Stokes. (2021, January 11). FADE DEAD | Adventures in Reversing Malicious Run-Only AppleScripts. Retrieved September 29, 2022. ↩

  285. Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024. ↩

  286. ClearSky. (2016, January 7). Operation DustySky. Retrieved January 8, 2016. ↩↩

  287. GReAT. (2019, April 10). Gaza Cybergang Group1, operation SneakyPastes. Retrieved May 13, 2020. ↩

  288. Yan, T., et al. (2018, November 21). New Wine in Old Bottle: New Azorult Variant Found in FindMyName Campaign using Fallout Exploit Kit. Retrieved November 29, 2018. ↩

  289. Proofpoint. (2018, July 30). New version of AZORult stealer improves loading features, spreads alongside ransomware in new campaign. Retrieved November 29, 2018. ↩

  290. Dumont, R., M.Léveillé, M., Porcher, H. (2018, December 1). THE DARK SIDE OF THE FORSSHE A landscape of OpenSSH backdoors. Retrieved July 16, 2020. ↩

  291. Lancaster, T., Cortes, J. (2018, January 29). VERMIN: Quasar RAT and Custom Malware Used In Ukraine. Retrieved July 5, 2018. ↩

  292. Splunk Threat Research Team , Teoderick Contreras. (2024, September 5). ShrinkLocker Malware: Abusing BitLocker to Lock Your Data. Retrieved December 7, 2024. ↩

  293. Trusteer Fraud Prevention Center. (2010, October 7). Carberp Under the Hood of Carberp: Malware & Configuration Analysis. Retrieved July 15, 2020. ↩

  294. Hasherezade. (2021, July 23). AvosLocker enters the ransomware scene, asks for partners. Retrieved January 11, 2023. ↩

  295. Fishbein, N., Kajiloti, M.. (2020, July 28). Watch Your Containers: Doki Infecting Docker Servers in the Cloud. Retrieved March 30, 2021. ↩

  296. Lunghi, D. and Horejsi, J.. (2019, June 10). MuddyWater Resurfaces, Uses Multi-Stage Backdoor POWERSTATS V3 and New Post-Exploitation Tools. Retrieved May 14, 2020. ↩

  297. The BlackBerry Research & Intelligence Team. (2020, October). BAHAMUT: Hack-for-Hire Masters of Phishing, Fake News, and Fake Apps. Retrieved February 8, 2021. ↩

  298. CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024. ↩

  299. Counter Threat Unit Research Team. (2023, May 24). Chinese Cyberespionage Group BRONZE SILHOUETTE Targets U.S. Government and Defense Organizations. Retrieved July 27, 2023. ↩

  300. Microsoft Threat Intelligence. (2023, May 24). Volt Typhoon targets US critical infrastructure with living-off-the-land techniques. Retrieved July 27, 2023. ↩

  301. Ray, V. (2016, November 22). Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy. Retrieved November 9, 2018. ↩

  302. Hegel, T. (2021, January 13). A Global Perspective of the SideWinder APT. Retrieved January 27, 2021. ↩

  303. Alperovitch, D. (2014, July 7). Deep in Thought: Chinese Targeting of National Security Think Tanks. Retrieved November 12, 2014. ↩

  304. Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016. ↩

  305. Eoin Miller. (2021, March 23). Defending Against the Zero Day: Analyzing Attacker Behavior Post-Exploitation of Microsoft Exchange. Retrieved October 27, 2022. ↩

  306. Kaspersky Lab’s Global Research & Analysis Team. (2015, August 10). Darkhotel’s attacks in 2015. Retrieved November 2, 2018. ↩

  307. Trend Micro Research. (2023, July 21). Ransomware Spotlight: Play. Retrieved September 24, 2024. ↩

  308. Marczak, B. and Scott-Railton, J.. (2016, May 29). Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents. Retrieved June 8, 2016. ↩

  309. Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022. ↩

  310. Fiser, D. Oliveira, A. (n.d.). Tracking the Activities of TeamTNT A Closer Look at a Cloud-Focused Malicious Actor Group. Retrieved September 22, 2021. ↩

  311. Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024. ↩

  312. Park, S. (2021, June 15). Andariel evolves to target South Korea with ransomware. Retrieved September 29, 2021. ↩

  313. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Loaders, Installers and Uninstallers Report. Retrieved November 17, 2024. ↩

  314. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016. ↩

  315. Saini, A. and Hossein, J. (2022, January 27). North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign. Retrieved January 27, 2022. ↩

  316. Sherstobitoff, R. (2018, February 12). Lazarus Resurfaces, Targets Global Banks and Bitcoin Users. Retrieved February 19, 2018. ↩

  317. Microsoft Threat Intelligence. (2024, September 26). Storm-0501: Ransomware attacks expanding to hybrid cloud environments. Retrieved October 19, 2025. ↩

  318. Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022. ↩

  319. Hamzeloofard, S. (2020, January 31). New wave of PlugX targets Hong Kong | Avira Blog. Retrieved April 13, 2021. ↩

  320. Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024. ↩

  321. The BlackBerry Research and Intelligence Team. (2024, April 17). Threat Group FIN7 Targets the U.S. Automotive Industry. Retrieved May 1, 2025. ↩

  322. Kaspersky Lab’s Global Research & Analysis Team. (2018, October 10). MuddyWater expands operations. Retrieved November 2, 2018. ↩

  323. ClearSky. (2019, June). Iranian APT group ‘MuddyWater’ Adds Exploits to Their Arsenal. Retrieved May 14, 2020. ↩

  324. Alexander Marvi, Brad Slaybaugh, Ron Craft, and Rufus Brown. (2023, June 13). VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors. Retrieved March 26, 2025. ↩

  325. Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With a New Malware Family Written in Golang. Retrieved April 24, 2019. ↩

  326. Lee, B. and Falcone, R. (2017, February 15). Magic Hound Campaign Attacks Saudi Targets. Retrieved December 27, 2017. ↩

  327. Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018. ↩

  328. An, J and Malhotra, A. (2021, November 10). North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets. Retrieved December 29, 2021. ↩

  329. Den Iuzvyk, Tim Peck. (2025, February 13). Analyzing DEEP#DRIVE: North Korean Threat Actors Observed Exploiting Trusted Platforms for Targeted Attacks. Retrieved August 19, 2025. ↩

  330. Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021. ↩

  331. Kaspersky Lab’s Global Research and Analysis Team. (2016, February 9). Poseidon Group: a Targeted Attack Boutique specializing in global cyber-espionage. Retrieved March 16, 2016. ↩

  332. Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014. ↩

  333. Smallridge, R. (2018, March 10). APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS. Retrieved April 4, 2018. ↩

  334. Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022. ↩

  335. Symantec. (2018, March 14). Inception Framework: Alive and Well, and Hiding Behind Proxies. Retrieved May 8, 2020. ↩

  336. Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017. ↩

  337. Symantec Threat Hunter Team. (2023, October 19). Crambus: New Campaign Targets Middle Eastern Government. Retrieved November 27, 2024. ↩

  338. Chen, X., Scott, M., Caselden, D.. (2014, April 26). New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks. Retrieved January 14, 2016. ↩

  339. Yates, M. (2017, June 18). APT3 Uncovered: The code evolution of Pirpi. Retrieved September 28, 2017. ↩

  340. Symantec. (2022, January 31). Shuckworm Continues Cyber-Espionage Attacks Against Ukraine. Retrieved February 17, 2022. ↩

  341. Threat Hunter Team, Symantec and Carbon Black. (2025, April 10). Shuckworm Targets Foreign Military Mission Based in Ukraine. Retrieved July 23, 2025. ↩

  342. Unit 42. (2022, February 3). Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine. Retrieved February 21, 2022. ↩

  343. Kaspersky Lab’s Global Research and Analysis Team. (2013, April 11). Winnti. More than just a game. Retrieved February 8, 2017. ↩

  344. FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024. ↩

  345. Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025. ↩

  346. Cash, D. et al. (2020, December 14). Dark Halo Leverages SolarWinds Compromise to Breach Organizations. Retrieved December 29, 2020. ↩

  347. CrowdStrike. (2022, January 27). Early Bird Catches the Wormhole: Observations from the StellarParticle Campaign. Retrieved February 7, 2022. ↩

  348. MSTIC, CDOC, 365 Defender Research Team. (2021, January 20). Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop . Retrieved January 22, 2021. ↩

  349. Black Lotus Labs. (2023, December 13). Routers Roasting On An Open Firewall: The KV-Botnet Investigation. Retrieved June 10, 2024. ↩

  350. DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022. ↩

  351. Sherstobitoff, R. (2018, March 02). McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups. Retrieved May 16, 2018. ↩

  352. Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022. ↩

  353. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020. ↩