Skip to content

T1057 Process Discovery

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

In Windows environments, adversaries could obtain details on running processes using the Tasklist utility via cmd or Get-Process via PowerShell. Information about processes can also be extracted from the output of Native API calls such as CreateToolhelp32Snapshot. In Mac and Linux, this is accomplished with the ps command. Adversaries may also opt to enumerate processes via /proc.

On network devices, Network Device CLI commands such as show processes can be used to display current running processes.21

Item Value
ID T1057
Sub-techniques
Tactics TA0007
Platforms Linux, Network, Windows, macOS
Version 1.3
Created 31 May 2017
Last Modified 12 April 2023

Procedure Examples

ID Name Description
S0065 4H RAT 4H RAT has the capability to obtain a listing of running processes (including loaded modules).201
S0045 ADVSTORESHELL ADVSTORESHELL can list running processes.37
S0331 Agent Tesla Agent Tesla can list the current running processes on the system.79
G0138 Andariel Andariel has used tasklist to enumerate processes and find a specific string.251
S0622 AppleSeed AppleSeed can enumerate the current process on a compromised host.185
G0006 APT1 APT1 gathered a list of running processes on the system using tasklist /v.252
G0007 APT28 An APT28 loader Trojan will enumerate the victim’s processes searching for explorer.exe if its current process does not have necessary permissions.202
G0022 APT3 APT3 has a tool that can list out currently running processes.243244
G0067 APT37 APT37‘s Freenki malware lists running processes using the Microsoft Windows API.263
G0082 APT38 APT38 leveraged Sysmon to understand the processes, services in the organization.248
S0456 Aria-body Aria-body has the ability to enumerate loaded modules for a process.187.
S0373 Astaroth Astaroth searches for different processes on the system.109
S0640 Avaddon Avaddon has collected information about running processes.58
S0473 Avenger Avenger has the ability to use Tasklist to identify running processes.148
S1053 AvosLocker AvosLocker has discovered system processes by calling RmGetList.178
S0344 Azorult Azorult can collect a list of running processes by calling CreateToolhelp32Snapshot.6970
S0638 Babuk Babuk has the ability to check running processes on a targeted system.223224225
S0414 BabyShark BabyShark has executed the tasklist command.31
S0093 Backdoor.Oldrea Backdoor.Oldrea collects information about running processes.43
S0031 BACKSPACE BACKSPACE may collect information about running processes.217
S0606 Bad Rabbit Bad Rabbit can enumerate all running processes to compare hashes.53
S0239 Bankshot Bankshot identifies processes and collects the process ids.123
S0534 Bazar Bazar can identity the current process on a compromised host.50
S0127 BBSRAT BBSRAT can list running processes.152
S0017 BISCUIT BISCUIT has a command to enumerate running processes and identify their owners.230
S0268 Bisonal Bisonal can obtain a list of running processes on the victim’s machine.105106107
S0069 BLACKCOFFEE BLACKCOFFEE has the capability to discover processes.184
S0089 BlackEnergy BlackEnergy has gathered a process list by using Tasklist.exe.227228229
S0657 BLUELIGHT BLUELIGHT can collect process filenames and SID authority level.21
S0486 Bonadan Bonadan can use the ps command to discover other cryptocurrency miners active on the system.127
S0252 Brave Prince Brave Prince lists the running processes.36
S1063 Brute Ratel C4 Brute Ratel C4 can enumerate all processes and locate specific process IDs (PIDs).5
S1039 Bumblebee Bumblebee can identify processes associated with analytical tools.190189191
S0482 Bundlore Bundlore has used the ps command to list processes.177
C0015 C0015 During C0015, the threat actors used the tasklist /s command as well as taskmanager to obtain a list of running processes.279
S0693 CaddyWiper CaddyWiper can obtain a list of current processes.68
S0351 Cannon Cannon can obtain a list of processes running on the system.1718
S0030 Carbanak Carbanak lists running processes.237
S0484 Carberp Carberp has collected a list of running processes.149
S0335 Carbon Carbon can list the processes on the victim’s machine.219
S0348 Cardinal RAT Cardinal RAT contains watchdog functionality that ensures its process is always running, else spawns a new instance.173
S0572 Caterpillar WebShell Caterpillar WebShell can gather a list of processes running on the machine.93
S0674 CharmPower CharmPower has the ability to list running processes through the use of tasklist.206
S0144 ChChes ChChes collects its process identifier (PID) on the victim.174
G0114 Chimera Chimera has used tasklist to enumerate processes.256
S0660 Clambling Clambling can enumerate processes on a targeted system.139
S0611 Clop Clop can enumerate all processes on the victim’s machine.119
S0154 Cobalt Strike Cobalt Strike‘s Beacon payload can collect information on process details.117116118
S0244 Comnie Comnie uses the tasklist to view running processes on the victim’s machine.84
S0575 Conti Conti can enumerate through all open processes to search for any that have the string “sql” in their process name.16
S0115 Crimson Crimson contains a command to list processes.171170172
S0625 Cuba Cuba can enumerate processes running on a victim’s machine.138
S0687 Cyclops Blink Cyclops Blink can enumerate the process it is currently running under.168
S0497 Dacls Dacls can collect data on running and parent processes.85
S0334 DarkComet DarkComet can list active processes running on the victim’s machine.221
G0012 Darkhotel Darkhotel malware can collect a list of running processes on a system.266
S1066 DarkTortilla DarkTortilla can enumerate a list of running processes on a compromised system.86
G0009 Deep Panda Deep Panda uses the Microsoft Tasklist utility to list processes running on systems.272
S0021 Derusbi Derusbi collects current and parent process IDs.142143
S0659 Diavol Diavol has used CreateToolhelp32Snapshot, Process32First, and Process32Next API calls to enumerate the running processes in the system.199
S0600 Doki Doki has searched for the current process’s PID.90
S0695 Donut Donut includes subprojects that enumerate and identify information about Process Injection candidates.10
S0472 down_new down_new has the ability to list running processes on a compromised host.148
S0694 DRATzarus DRATzarus can enumerate and examine running processes to determine if a debugger is present.207
S0567 Dtrack Dtrack’s dropper can list all running processes.6061
S0038 Duqu The discovery modules used with Duqu can collect information on process details.162
S0062 DustySky DustySky collects information about running processes from victims.194195
G1006 Earth Lusca Earth Lusca has used Tasklist to obtain information from a compromised host.250
S0605 EKANS EKANS looks for processes from a hard-coded list.232233234
S0081 Elise Elise enumerates processes via the tasklist command.25
S0064 ELMER ELMER is capable of performing process listings.73
S0367 Emotet Emotet has been observed enumerating local processes.196
S0363 Empire Empire can find information about processes running on local and remote systems.87
S0091 Epic Epic uses the tasklist /v command to obtain a list of processes.132133
S0396 EvilBunny EvilBunny has used EnumProcesses() to identify how many process are running in the environment.48
S0512 FatDuke FatDuke can list running processes on the localhost.34
S0267 FELIXROOT FELIXROOT collects a list of running processes.91
S0355 Final1stspy Final1stspy obtains a list of running processes.203
S0182 FinFisher FinFisher checks its parent process for indications that it is running in a sandbox setup.6667
S0696 Flagpro Flagpro has been used to run the tasklist command on a compromised system.63
S0661 FoggyWeb FoggyWeb‘s loader can enumerate all Common Language Runtimes (CLRs) and running Application Domains in the compromised AD FS server’s Microsoft.IdentityServer.ServiceHost.exe process.62
S0503 FrameworkPOS FrameworkPOS can enumerate and exclude selected processes on a compromised host to speed execution of memory scraping.33
C0001 Frankenstein During Frankenstein, the threat actors used Empire to obtain a list of all running processes.7
S0277 FruitFly FruitFly has the ability to list processes on the system.40
S1044 FunnyDream FunnyDream has the ability to discover processes, including Bka.exe and BkavUtil.exe.9
C0007 FunnyDream During FunnyDream, the threat actors used Tasklist on targeted systems.9
S0410 Fysbis Fysbis can collect information about running processes.120
G0047 Gamaredon Group Gamaredon Group has used tools to enumerate processes on target hosts including Process Explorer.241242
S0666 Gelsemium Gelsemium can enumerate running processes.126
S0049 GeminiDuke GeminiDuke collects information on running processes and environment variables from the victim.39
S0460 Get2 Get2 has the ability to identify running processes on an infected host.124
S0032 gh0st RAT gh0st RAT has the capability to list processes.182
S0249 Gold Dragon Gold Dragon checks the running processes on the victim’s machine.36
S0477 Goopy Goopy has checked for the Google Updater process to ensure Goopy was loaded properly.145
S0531 Grandoreiro Grandoreiro can identify installed security tools based on process names.218
S0237 GravityRAT GravityRAT lists the running processes on the system.188
G0125 HAFNIUM HAFNIUM has used tasklist to enumerate processes.270
S0151 HALFBAKED HALFBAKED can obtain information about running processes on the victim.98
S0617 HELLOKITTY HELLOKITTY can search for specific processes to terminate.56
S0170 Helminth Helminth has used Tasklist to get information on processes.202
G1001 HEXANE HEXANE has enumerated processes on targeted systems.257
S1027 Heyoka Backdoor Heyoka Backdoor can gather process information.89
G0126 Higaisa Higaisa’s shellcode attempted to find the process ID of the current process.245
S0431 HotCroissant HotCroissant has the ability to list running processes on the infected host.167
S0203 Hydraq Hydraq creates a backdoor through which remote attackers can monitor processes.158159
S0278 iKitten iKitten lists the current processes running.40
S0434 Imminent Monitor Imminent Monitor has a “Process Watcher” feature to monitor processes in case the client ever crashes or gets closed.12
G0100 Inception Inception has used a reconnaissance module to identify active processes and other associated loaded modules.255
S1072 Industroyer2 Industroyer2 has the ability to cyclically enumerate running processes such as PServiceControl.exe, PService_PDD.exe, and other targets supplied through a hardcoded configuration.140
S0260 InvisiMole InvisiMole can obtain a list of running processes.150151
S0581 IronNetInjector IronNetInjector can identify processes via C# methods such as GetProcessesByName and running Tasklist with the Python os.popen function.4
S0015 Ixeshe Ixeshe can list running processes.88
S0528 Javali Javali can monitor processes for open browsers and custom banking applications.57
S0044 JHUHUGIT JHUHUGIT obtains a list of running processes on the victim.8081
S0201 JPIN JPIN can list running processes.65
S0283 jRAT jRAT can query and kill system processes.28
S0088 Kasidet Kasidet has the ability to search for a given process name in processes currently running in the system.186
S0265 Kazuar Kazuar obtains a list of running processes through WMI querying and the ps command.222
G0004 Ke3chang Ke3chang performs process discovery using tasklist commands.267268
S0271 KEYMARBLE KEYMARBLE can obtain a list of running processes on the system.101
S0607 KillDisk KillDisk has called GetCurrentProcess.216
G0094 Kimsuky Kimsuky can gather a list of all processes running on a victim’s machine.277
S0599 Kinsing Kinsing has used ps to list processes.141
S0162 Komplex The OsInfo function in Komplex collects a running process list.24
S0356 KONNI KONNI has used the command cmd /c tasklist to get a snapshot of the current processes on the target machine.204205
S0236 Kwampirs Kwampirs collects a list of running services with the command tasklist /v.45
G0032 Lazarus Group Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by Lazarus Group also gathers process times.25925826119885260
S0211 Linfo Linfo creates a backdoor through which remote attackers can retrieve a list of running processes.157
S0681 Lizar Lizar has a plugin designed to obtain a list of processes.4241
S0582 LookBack LookBack can list running processes.130
S0451 LoudMiner LoudMiner used the ps command to monitor the running processes on the system.121
S0532 Lucifer Lucifer can identify the process that owns remote connections.102
S0409 Machete Machete has a component to check for running processes to look for web browsers.179
S1016 MacMa MacMa can enumerate running processes.175
S1048 macOS.OSAMiner macOS.OSAMiner has used ps ax | grep <name> | grep -v grep | ... and ps ax | grep -E... to conduct process discovery.46
S1060 Mafalda Mafalda can enumerate running processes on a machine.19
G0059 Magic Hound Magic Hound malware can list running processes.276
S0652 MarkiRAT MarkiRAT can search for different processes on a system.32
S0449 Maze Maze has gathered all of the running system processes.125
S1059 metaMain metaMain can enumerate the processes that run on the platform.1920
S0455 Metamorfo Metamorfo has performed process name checks and has monitored applications.87
S0688 Meteor Meteor can check if a specific process is running, such as Kaspersky’s avp.exe.240
S0079 MobileOrder MobileOrder has a command to upload information about all running processes to its C2 server.59
G0021 Molerats Molerats actors obtained a list of active processes on the victim and sent them to C2 servers.194
S0149 MoonWind MoonWind has a command to return a list of running processes.164
S0256 Mosquito Mosquito runs tasklist to obtain running processes.26
G0069 MuddyWater MuddyWater has used malware to obtain a list of running processes on the system.264265
G0129 Mustang Panda Mustang Panda has used tasklist /v to determine active process information.269
S0247 NavRAT NavRAT uses tasklist /v to check running processes.52
S0630 Nebulae Nebulae can enumerate processes on a target system.55
S0034 NETEAGLE NETEAGLE can send process listings over the C2 channel.217
S0198 NETWIRE NETWIRE can discover processes on compromised hosts.64
S0385 njRAT njRAT can search a list of running processes for Tr.exe.236
S0644 ObliqueRAT ObliqueRAT can check for blocklisted process names on a compromised host.215
S0346 OceanSalt OceanSalt can collect the name and ID for every process running on the system.154
G0049 OilRig OilRig has run tasklist on a victim’s machine.275
C0012 Operation CuckooBees During Operation CuckooBees, the threat actors used the tasklist command as part of their advanced reconnaissance.278
C0006 Operation Honeybee During Operation Honeybee, the threat actors obtained a list of running processes on a victim machine using cmd /c tasklist > %temp%\temp.ini.281
C0014 Operation Wocao During Operation Wocao, the threat actors used tasklist to collect a list of running processes on an infected system.280
S0229 Orz Orz can gather a process list from the victim.51
S1017 OutSteel OutSteel can identify running processes on a compromised host.165
S0626 P8RAT P8RAT can check for specific processes associated with virtual environments.92
S0664 Pandora Pandora can monitor processes on a compromised host.49
S0208 Pasam Pasam creates a backdoor through which remote attackers can retrieve lists of running processes.128
S1050 PcShare PcShare can obtain a list of running processes on a compromised host.9
S0517 Pillowmint Pillowmint can iterate through running processes every six seconds collecting a list of processes to capture from later.200
S0501 PipeMon PipeMon can iterate over the running processes to find a suitable injection target.54
S0254 PLAINTEE PLAINTEE performs the tasklist command to list running processes.214
S0435 PLEAD PLEAD has the ability to list processes on the compromised host.22
S0013 PlugX PlugX has a module to list the processes running on a machine.163
S0428 PoetRAT PoetRAT has the ability to list all running processes.103
S0216 POORAIM POORAIM can enumerate processes.108
G0033 Poseidon Group After compromising a victim, Poseidon Group lists all running processes.271
S0139 PowerDuke PowerDuke has a command to list the victim’s processes.74
S0441 PowerShower PowerShower has the ability to deploy a reconnaissance module to retrieve a list of the active processes.137
S0194 PowerSploit PowerSploit‘s Get-ProcessTokenPrivilege Privesc-PowerUp module can enumerate privileges for a given process.1314
S0393 PowerStallion PowerStallion has been used to monitor process lists.180
S0223 POWERSTATS POWERSTATS has used get_tasklist to discover processes on the compromised host.181
S0184 POWRUNER POWRUNER may collect process information by running tasklist on a victim.131
S0238 Proxysvc Proxysvc lists processes running on the system.198
S0192 Pupy Pupy can list the running processes and get the process ID and parent process’s ID.6
S0650 QakBot QakBot has the ability to check running processes.99
S0629 RainyDay RainyDay can enumerate processes on a target system.55
S0458 Ramsay Ramsay can gather a list of running processes by using Tasklist.100
S0241 RATANKBA RATANKBA lists the system’s processes.2930
S0662 RCSession RCSession can identify processes based on PID.71
S0125 Remsec Remsec can obtain a process list from the victim.129
S0448 Rising Sun Rising Sun can enumerate all running processes and process information on an infected machine.161
G0106 Rocke Rocke can detect a running process’s PID on the infected machine.254
S0270 RogueRobin RogueRobin checks the running processes for evidence it may be running in a sandbox environment. It specifically enumerates processes for Wireshark and Sysinternals.147
S0240 ROKRAT ROKRAT can list the current running processes on the system.7677
S1073 Royal Royal can use GetCurrentProcess to enumerate processes.75
S0148 RTM RTM can obtain information about process integrity levels.38
S0446 Ryuk Ryuk has called CreateToolhelp32Snapshot to enumerate all running processes.238
S1018 Saint Bot Saint Bot has enumerated running processes on a compromised host to determine if it is running under the process name dfrgui.exe.165
S0461 SDBbot SDBbot can enumerate a list of running processes on a compromised machine.209
S0345 Seasalt Seasalt has a command to perform a process listing.230
S0596 ShadowPad ShadowPad has collected the PID of a malicious process.213
S0445 ShimRatReporter ShimRatReporter listed all running processes on the machine.15
S0063 SHOTPUT SHOTPUT has a command to obtain a process listing.210
G0121 Sidewinder Sidewinder has used tools to identify running processes on the victim’s machine.253
S0692 SILENTTRINITY SILENTTRINITY can enumerate processes, including properties to determine if they have the Common Language Runtime (CLR) loaded.3
S0468 Skidmap Skidmap has monitored critical processes to ensure resiliency.83
S0533 SLOTHFULMEDIA SLOTHFULMEDIA has enumerated processes by ID, name, or privileges.239
S0273 Socksbot Socksbot can list all running processes.27
S0627 SodaMaster SodaMaster can search a list of running processes.92
C0024 SolarWinds Compromise During the SolarWinds Compromise, APT29 used multiple command-line utilities to enumerate running processes.282284283
S0615 SombRAT SombRAT can use the getprocesslist command to enumerate processes on a compromised host.15556156
S0516 SoreFang SoreFang can enumerate processes on a victim machine through use of Tasklist.134
G0038 Stealth Falcon Stealth Falcon malware gathers a list of running processes.249
S0142 StreamEx StreamEx has the ability to enumerate processes.35
S0491 StrongPity StrongPity can determine if a user is logged in by checking to see if explorer.exe is running.160
S0559 SUNBURST SUNBURST collected a list of process names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.112
S0562 SUNSPOT SUNSPOT monitored running processes for instances of MsBuild.exe by hashing the name of each running process and comparing it to the corresponding value 0x53D525. It also extracted command-line arguments and individual arguments from the running MsBuild.exe process to identify the directory path of the Orion software Visual Studio solution.144
S1064 SVCReady SVCReady can collect a list of running processes from an infected host.96
S0018 Sykipot Sykipot may gather a list of running processes by running tasklist /v.166
S0242 SynAck SynAck enumerates all running processes.211212
S0464 SYSCON SYSCON has the ability to use Tasklist to list running processes.208
S0663 SysUpdate SysUpdate can collect information about running processes.82
S0011 Taidoor Taidoor can use GetCurrentProcessId for process discovery.104
S0586 TAINTEDSCRIBE TAINTEDSCRIBE can execute ProcessList for process discovery.235
S0467 TajMahal TajMahal has the ability to identify running processes and associated plugins on an infected host.72
S0057 Tasklist Tasklist can be used to discover processes running on a system.11
G0139 TeamTNT TeamTNT has searched for rival malware and removes it if found.247 TeamTNT has also searched for running processes containing the strings aliyun or liyun to identify machines running Alibaba Cloud Security tools.246
S0595 ThiefQuest ThiefQuest obtains a list of running processes using the function kill_unwanted.47
S0266 TrickBot TrickBot uses module networkDll for process list discovery.192193
S0094 Trojan.Karagany Trojan.Karagany can use Tasklist to collect a list of running tasks.43169
G0081 Tropic Trooper Tropic Trooper is capable of enumerating the running processes on the system using pslist.274122
S0436 TSCookie TSCookie has the ability to list processes on the infected host.176
G0010 Turla Turla surveys a system upon check-in to discover running processes using the tasklist /v command.132 Turla RPC backdoors have also enumerated processes associated with specific open ports or named pipes.180
S0333 UBoatRAT UBoatRAT can list running processes on the system.153
S0386 Ursnif Ursnif has gathered information about running processes.9495
S0452 USBferry USBferry can use tasklist to gather information about the process running on the infected system.122
S0476 Valak Valak has the ability to enumerate running processes on a compromised host.23
S0257 VERMIN VERMIN can get a list of the processes and running tasks on the system.220
S0180 Volgmer Volgmer can gather a list of processes.183
S0670 WarzoneRAT WarzoneRAT can obtain a list of processes on a compromised host.97
S0579 Waterbear Waterbear can identify the process for a specific security product.226
G0112 Windshift Windshift has used malware to enumerate active processes.262
S0219 WINERACK WINERACK can enumerate processes.108
S0059 WinMM WinMM sets a WH_CBT Windows hook to collect information on process creation.110
S0141 Winnti for Windows Winnti for Windows can check if the explorer.exe process is responsible for calling its install function.78
G0044 Winnti Group Winnti Group looked for a specific process running on infected servers.273
S1065 Woody RAT Woody RAT can call NtQuerySystemProcessInformation with SystemProcessInformation to enumerate all running processes, including associated information such as PID, parent PID, image name, and owner.231
S0161 XAgentOSX XAgentOSX contains the getProcessList function to run ps aux to get running processes.135
S0248 yty yty gets an output of running processes using the tasklist command.146
S0251 Zebrocy Zebrocy uses the tasklist and wmic process get Capture, ExecutablePath commands to gather the processes running on the system.1711318114115
S0330 Zeus Panda Zeus Panda checks for running processes on the victim’s machine.111
S0672 Zox Zox has the ability to list processes.197
S0412 ZxShell ZxShell has a command, ps, to obtain a listing of processes on the system.136
S1013 ZxxZ ZxxZ has created a snapshot of running processes using CreateToolhelp32Snapshot.44

Detection

ID Data Source Data Component
DS0017 Command Command Execution
DS0009 Process OS API Execution

References

  1. Cisco. (2022, August 16). show processes - . Retrieved July 13, 2022. ↩

  2. US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020. ↩

  3. Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022. ↩

  4. Reichel, D. (2021, February 19). IronNetInjector: Turla’s New Malware Loading Tool. Retrieved February 24, 2021. ↩

  5. Harbison, M. and Renals, P. (2022, July 5). When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors. Retrieved February 1, 2023. ↩

  6. Nicolas Verdier. (n.d.). Retrieved January 29, 2018. ↩

  7. Adamitis, D. et al. (2019, June 4). It’s alive: Threat actors cobble together open-source pieces into monstrous Frankenstein campaign. Retrieved May 11, 2020. ↩↩

  8. Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016. ↩

  9. Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022. ↩↩↩

  10. TheWover. (2019, May 9). donut. Retrieved March 25, 2022. ↩

  11. Microsoft. (n.d.). Tasklist. Retrieved December 23, 2015. ↩

  12. Unit 42. (2019, December 2). Imminent Monitor – a RAT Down Under. Retrieved May 5, 2020. ↩

  13. PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018. ↩

  14. PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018. ↩

  15. Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020. ↩

  16. Baskin, B. (2020, July 8). TAU Threat Discovery: Conti Ransomware. Retrieved February 17, 2021. ↩

  17. Falcone, R., Lee, B. (2018, November 20). Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan. Retrieved November 26, 2018. ↩↩

  18. Lee, B., Falcone, R. (2018, December 12). Dear Joohn: The Sofacy Group’s Global Campaign. Retrieved April 19, 2019. ↩↩

  19. Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023. ↩↩

  20. SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023. ↩

  21. Cash, D., Grunzweig, J., Meltzer, M., Adair, S., Lancaster, T. (2021, August 17). North Korean APT InkySquid Infects Victims Using Browser Exploits. Retrieved September 30, 2021. ↩

  22. Bermejo, L., et al. (2017, June 22). Following the Trail of BlackTech’s Cyber Espionage Campaigns. Retrieved May 5, 2020. ↩

  23. Salem, E. et al. (2020, May 28). VALAK: MORE THAN MEETS THE EYE . Retrieved June 19, 2020. ↩

  24. Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26). Sofacy’s ‘Komplex’ OS X Trojan. Retrieved July 8, 2017. ↩

  25. Accenture Security. (2018, January 27). DRAGONFISH DELIVERS NEW FORM OF ELISE MALWARE TARGETING ASEAN DEFENCE MINISTERS’ MEETING AND ASSOCIATES. Retrieved November 14, 2018. ↩

  26. ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018. ↩

  27. Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018. ↩

  28. Bingham, J. (2013, February 11). Cross-Platform Frutas RAT Builder and Back Door. Retrieved April 23, 2019. ↩

  29. Lei, C., et al. (2018, January 24). Lazarus Campaign Targeting Cryptocurrencies Reveals Remote Controller Tool, an Evolved RATANKBA, and More. Retrieved May 22, 2018. ↩

  30. Trend Micro. (2017, February 27). RATANKBA: Delving into Large-scale Watering Holes against Enterprises. Retrieved May 22, 2018. ↩

  31. Unit 42. (2019, February 22). New BabyShark Malware Targets U.S. National Security Think Tanks. Retrieved October 7, 2019. ↩

  32. GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021. ↩

  33. Kremez, V. (2019, September 19). FIN6 “FrameworkPOS”: Point-of-Sale Malware Analysis & Internals. Retrieved September 8, 2020. ↩

  34. Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020. ↩

  35. Cylance SPEAR Team. (2017, February 9). Shell Crew Variants Continue to Fly Under Big AV’s Radar. Retrieved February 15, 2017. ↩

  36. Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018. ↩↩

  37. ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016. ↩

  38. Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017. ↩

  39. F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015. ↩

  40. Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018. ↩↩

  41. BI.ZONE Cyber Threats Research Team. (2021, May 13). From pentest to APT attack: cybercriminal group FIN7 disguises its malware as an ethical hacker’s toolkit. Retrieved February 2, 2022. ↩

  42. Seals, T. (2021, May 14). FIN7 Backdoor Masquerades as Ethical Hacking Tool. Retrieved February 2, 2022. ↩

  43. Symantec Security Response. (2014, June 30). Dragonfly: Cyberespionage Attacks Against Energy Suppliers. Retrieved April 8, 2016. ↩↩

  44. Raghuprasad, C . (2022, May 11). Bitter APT adds Bangladesh to their targets. Retrieved June 1, 2022. ↩

  45. Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018. ↩

  46. Phil Stokes. (2021, January 11). FADE DEAD | Adventures in Reversing Malicious Run-Only AppleScripts. Retrieved September 29, 2022. ↩

  47. Patrick Wardle. (2020, June 29). OSX.EvilQuest Uncovered part i: infection, persistence, and more!. Retrieved March 18, 2021. ↩

  48. Marschalek, M.. (2014, December 16). EvilBunny: Malware Instrumented By Lua. Retrieved June 28, 2019. ↩

  49. Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021. ↩

  50. Cybereason Nocturnus. (2020, July 16). A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES. Retrieved November 18, 2020. ↩

  51. Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018. ↩

  52. Mamedov, O. Sinitsyn, F. Ivanov, A.. (2017, October 24). Bad Rabbit ransomware. Retrieved January 28, 2021. ↩

  53. Tartare, M. et al. (2020, May 21). No “Game over” for the Winnti Group. Retrieved August 24, 2020. ↩

  54. Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021. ↩↩

  55. McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021. ↩↩

  56. GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020. ↩

  57. Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021. ↩

  58. Falcone, R. and Miller-Osborn, J.. (2016, January 24). Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists. Retrieved February 10, 2016. ↩

  59. Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021. ↩

  60. Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021. ↩

  61. Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021. ↩

  62. Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022. ↩

  63. Maniath, S. and Kadam P. (2019, March 19). Dissecting a NETWIRE Phishing Campaign’s Usage of Process Hollowing. Retrieved January 7, 2021. ↩

  64. Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018. ↩

  65. FinFisher. (n.d.). Retrieved December 20, 2017. ↩

  66. Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018. ↩

  67. Threat Intelligence Team. (2022, March 18). Double header: IsaacWiper and CaddyWiper . Retrieved April 11, 2022. ↩

  68. Yan, T., et al. (2018, November 21). New Wine in Old Bottle: New Azorult Variant Found in FindMyName Campaign using Fallout Exploit Kit. Retrieved November 29, 2018. ↩

  69. Proofpoint. (2018, July 30). New version of AZORult stealer improves loading features, spreads alongside ransomware in new campaign. Retrieved November 29, 2018. ↩

  70. Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021. ↩

  71. GReAT. (2019, April 10). Project TajMahal – a sophisticated new APT framework. Retrieved October 14, 2019. ↩

  72. Winters, R. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016. ↩

  73. Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017. ↩

  74. Cybereason Global SOC and Cybereason Security Research Teams. (2022, December 14). Royal Rumble: Analysis of Royal Ransomware. Retrieved March 30, 2023. ↩

  75. Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018. ↩

  76. Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020. ↩

  77. Novetta Threat Research Group. (2015, April 7). Winnti Analysis. Retrieved February 8, 2017. ↩

  78. Zhang, X. (2017, June 28). In-Depth Analysis of A New Variant of .NET Malware AgentTesla. Retrieved November 5, 2018. ↩

  79. ESET. (2016, October). En Route with Sednit - Part 1: Approaching the Target. Retrieved November 8, 2016. ↩

  80. Lee, B, et al. (2018, February 28). Sofacy Attacks Multiple Government Entities. Retrieved March 15, 2018. ↩

  81. Daniel Lunghi. (2023, March 1). Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting. Retrieved March 20, 2023. ↩

  82. Remillano, A., Urbanec, J. (2019, September 19). Skidmap Linux Malware Uses Rootkit Capabilities to Hide Cryptocurrency-Mining Payload. Retrieved June 4, 2020. ↩

  83. Grunzweig, J. (2018, January 31). Comnie Continues to Target Organizations in East Asia. Retrieved June 7, 2018. ↩

  84. Mabutas, G. (2020, May 11). New MacOS Dacls RAT Backdoor Shows Lazarus’ Multi-Platform Attack Capability. Retrieved August 10, 2020. ↩↩

  85. Secureworks Counter Threat Unit Research Team. (2022, August 17). DarkTortilla Malware Analysis. Retrieved November 3, 2022. ↩

  86. Erlich, C. (2020, April 3). The Avast Abuser: Metamorfo Banking Malware Hides By Abusing Avast Executable. Retrieved May 26, 2020. ↩

  87. Sancho, D., et al. (2012, May 22). IXESHE An APT Campaign. Retrieved June 7, 2019. ↩

  88. Chen, Joey. (2022, June 9). Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years. Retrieved July 14, 2022. ↩

  89. Fishbein, N., Kajiloti, M.. (2020, July 28). Watch Your Containers: Doki Infecting Docker Servers in the Cloud. Retrieved March 30, 2021. ↩

  90. Cherepanov, A. (2018, October). GREYENERGY A successor to BlackEnergy. Retrieved November 15, 2018. ↩

  91. GREAT. (2021, March 30). APT10: sophisticated multi-layered loader Ecipekac discovered in A41APT campaign. Retrieved June 17, 2021. ↩↩

  92. ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021. ↩

  93. Caragay, R. (2015, March 26). URSNIF: The Multifaceted Malware. Retrieved June 5, 2019. ↩

  94. Sioting, S. (2013, June 15). BKDR_URSNIF.SM. Retrieved June 5, 2019. ↩

  95. Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022. ↩

  96. Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021. ↩

  97. Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing LNK. Retrieved April 24, 2017. ↩

  98. Morrow, D. (2021, April 15). The rise of QakBot. Retrieved September 27, 2021. ↩

  99. Antiy CERT. (2020, April 20). Analysis of Ramsay components of Darkhotel’s infiltration and isolation network. Retrieved March 24, 2021. ↩

  100. US-CERT. (2018, August 09). MAR-10135536-17 – North Korean Trojan: KEYMARBLE. Retrieved August 16, 2018. ↩

  101. Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020. ↩

  102. Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020. ↩

  103. CISA, FBI, DOD. (2021, August). MAR-10292089-1.v2 – Chinese Remote Access Trojan: TAIDOOR. Retrieved August 24, 2021. ↩

  104. Hayashi, K., Ray, V. (2018, July 31). Bisonal Malware Used in Attacks Against Russia and South Korea. Retrieved August 7, 2018. ↩

  105. Zykov, K. (2020, August 13). CactusPete APT group’s updated Bisonal backdoor. Retrieved May 5, 2021. ↩

  106. Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022. ↩

  107. FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved March 1, 2018. ↩↩

  108. Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019. ↩

  109. Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved April 10, 2019. ↩

  110. Ebach, L. (2017, June 22). Analysis Results of Zeus.Variant.Panda. Retrieved November 5, 2018. ↩

  111. FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021. ↩

  112. ESET. (2018, November 20). Sednit: What’s going on with Zebrocy?. Retrieved February 12, 2019. ↩

  113. ESET Research. (2019, May 22). A journey to Zebrocy land. Retrieved June 20, 2019. ↩

  114. Accenture Security. (2018, November 29). SNAKEMACKEREL. Retrieved April 15, 2019. ↩

  115. Mavis, N. (2020, September 21). The Art and Science of Detecting Cobalt Strike. Retrieved April 6, 2021. ↩

  116. Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017. ↩

  117. Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021. ↩

  118. Mundo, A. (2019, August 1). Clop Ransomware. Retrieved May 10, 2021. ↩

  119. Doctor Web. (2014, November 21). Linux.BackDoor.Fysbis.1. Retrieved December 7, 2017. ↩

  120. Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020. ↩

  121. Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020. ↩↩

  122. Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018. ↩

  123. Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020. ↩

  124. Mundo, A. (2020, March 26). Ransomware Maze. Retrieved May 18, 2020. ↩

  125. Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021. ↩

  126. Dumont, R., M.Léveillé, M., Porcher, H. (2018, December 1). THE DARK SIDE OF THE FORSSHE A landscape of OpenSSH backdoors. Retrieved July 16, 2020. ↩

  127. Mullaney, C. & Honda, H. (2012, May 4). Trojan.Pasam. Retrieved February 22, 2018. ↩

  128. Kaspersky Lab’s Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016. ↩

  129. Raggi, M. Schwarz, D.. (2019, August 1). LookBack Malware Targets the United States Utilities Sector with Phishing Attacks Impersonating Engineering Licensing Boards. Retrieved February 25, 2021. ↩

  130. Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017. ↩

  131. Kaspersky Lab’s Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014. ↩↩

  132. Kaspersky Lab’s Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018. ↩

  133. CISA. (2020, July 16). MAR-10296782-1.v1 – SOREFANG. Retrieved September 29, 2020. ↩

  134. Robert Falcone. (2017, February 14). XAgentOSX: Sofacy’s Xagent macOS Tool. Retrieved July 12, 2017. ↩

  135. Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019. ↩

  136. GReAT. (2019, August 12). Recent Cloud Atlas activity. Retrieved May 8, 2020. ↩

  137. Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021. ↩

  138. Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021. ↩

  139. Daniel Kapellmann Zafra, Raymond Leong, Chris Sistrunk, Ken Proska, Corey Hildebrandt, Keith Lunden, Nathan Brubaker. (2022, April 25). INDUSTROYER.V2: Old Malware Learns New Tricks. Retrieved March 30, 2023. ↩

  140. Singer, G. (2020, April 3). Threat Alert: Kinsing Malware Attacks Targeting Container Environments. Retrieved April 1, 2021. ↩

  141. Fidelis Cybersecurity. (2016, February 29). The Turbo Campaign, Featuring Derusbi for 64-bit Linux. Retrieved March 2, 2016. ↩

  142. FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018. ↩

  143. CrowdStrike Intelligence Team. (2021, January 11). SUNSPOT: An Implant in the Build Process. Retrieved January 11, 2021. ↩

  144. Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018. ↩

  145. Schwarz, D., Sopko J. (2018, March 08). Donot Team Leverages New Modular Malware Framework in South Asia. Retrieved June 11, 2018. ↩

  146. Falcone, R., et al. (2018, July 27). New Threat Actor Group DarkHydrus Targets Middle East Government. Retrieved August 2, 2018. ↩

  147. Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020. ↩↩

  148. Trusteer Fraud Prevention Center. (2010, October 7). Carberp Under the Hood of Carberp: Malware & Configuration Analysis. Retrieved July 15, 2020. ↩

  149. Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018. ↩

  150. Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020. ↩

  151. Lee, B. Grunzweig, J. (2015, December 22). BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger. Retrieved August 19, 2016. ↩

  152. Hayashi, K. (2017, November 28). UBoatRAT Navigates East Asia. Retrieved January 12, 2018. ↩

  153. Sherstobitoff, R., Malhotra, A. (2018, October 18). ‘Operation Oceansalt’ Attacks South Korea, U.S., and Canada With Source Code From Chinese Hacker Group. Retrieved November 30, 2018. ↩

  154. The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021. ↩

  155. CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021. ↩

  156. Zhou, R. (2012, May 15). Backdoor.Linfo. Retrieved February 23, 2018. ↩

  157. Symantec Security Response. (2010, January 18). The Trojan.Hydraq Incident. Retrieved February 20, 2018. ↩

  158. Lelli, A. (2010, January 11). Trojan.Hydraq. Retrieved February 20, 2018. ↩

  159. Mercer, W. et al. (2020, June 29). PROMETHIUM extends global reach with StrongPity3 APT. Retrieved July 20, 2020. ↩

  160. Sherstobitoff, R., Malhotra, A., et. al.. (2018, December 18). Operation Sharpshooter Campaign Targets Global Defense, Critical Infrastructure. Retrieved May 14, 2020. ↩

  161. Symantec Security Response. (2011, November). W32.Duqu: The precursor to the next Stuxnet. Retrieved September 17, 2015. ↩

  162. Computer Incident Response Center Luxembourg. (2013, March 29). Analysis of a PlugX variant. Retrieved November 5, 2018. ↩

  163. Miller-Osborn, J. and Grunzweig, J.. (2017, March 30). Trochilus and New MoonWind RATs Used In Attack Against Thai Organizations. Retrieved March 30, 2017. ↩

  164. Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022. ↩↩

  165. Blasco, J. (2011, December 12). Another Sykipot sample likely targeting US federal agencies. Retrieved March 28, 2016. ↩

  166. Knight, S.. (2020, April 16). VMware Carbon Black TAU Threat Analysis: The Evolution of Lazarus. Retrieved May 1, 2020. ↩

  167. Secureworks. (2019, July 24). Updated Karagany Malware Targets Energy Sector. Retrieved August 12, 2020. ↩

  168. Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021. ↩

  169. Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016. ↩

  170. N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022. ↩

  171. Grunzweig, J.. (2017, April 20). Cardinal RAT Active for Over Two Years. Retrieved December 8, 2018. ↩

  172. M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022. ↩

  173. Tomonaga, S. (2018, March 6). Malware “TSCookie”. Retrieved May 6, 2020. ↩

  174. Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020. ↩

  175. Hasherezade. (2021, July 23). AvosLocker enters the ransomware scene, asks for partners. Retrieved January 11, 2023. ↩

  176. ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019. ↩

  177. Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019. ↩↩

  178. Lunghi, D. and Horejsi, J.. (2019, June 10). MuddyWater Resurfaces, Uses Multi-Stage Backdoor POWERSTATS V3 and New Post-Exploitation Tools. Retrieved May 14, 2020. ↩

  179. FireEye Threat Intelligence. (2015, July 13). Demonstrating Hustle, Chinese APT Groups Quickly Use Zero-Day Vulnerability (CVE-2015-5119) Following Hacking Team Leak. Retrieved January 25, 2016. ↩

  180. Yagi, J. (2014, August 24). Trojan.Volgmer. Retrieved July 16, 2018. ↩

  181. FireEye Labs/FireEye Threat Intelligence. (2015, May 14). Hiding in Plain Sight: FireEye and Microsoft Expose Obfuscation Tactic. Retrieved January 22, 2016. ↩

  182. Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021. ↩

  183. Yadav, A., et al. (2016, January 29). Malicious Office files dropping Kasidet and Dridex. Retrieved March 24, 2016. ↩

  184. CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020. ↩

  185. Mercer, W., Rascagneres, P. (2018, April 26). GravityRAT - The Two-Year Evolution Of An APT Targeting India. Retrieved May 16, 2018. ↩

  186. Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022. ↩

  187. Merriman, K. and Trouerbach, P. (2022, April 28). This isn’t Optimus Prime’s Bumblebee but it’s Still Transforming. Retrieved August 22, 2022. ↩

  188. Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022. ↩

  189. Boutin, J. (2020, October 12). ESET takes part in global operation to disrupt Trickbot. Retrieved March 15, 2021. ↩

  190. Tudorica, R., Maximciuc, A., Vatamanu, C. (2020, March 18). New TrickBot Module Bruteforces RDP Connections, Targets Select Telecommunication Services in US and Hong Kong. Retrieved March 15, 2021. ↩

  191. ClearSky. (2016, January 7). Operation DustySky. Retrieved January 8, 2016. ↩↩

  192. GReAT. (2019, April 10). Gaza Cybergang Group1, operation SneakyPastes. Retrieved May 13, 2020. ↩

  193. ASEC. (2017). ASEC REPORT VOL.88. Retrieved April 16, 2019. ↩

  194. Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014. ↩

  195. Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018. ↩↩

  196. Neeamni, D., Rubinfeld, A.. (2021, July 1). Diavol - A New Ransomware Used By Wizard Spider?. Retrieved November 12, 2021. ↩

  197. Trustwave SpiderLabs. (2020, June 22). Pillowmint: FIN7’s Monkey Thief . Retrieved July 27, 2020. ↩

  198. Crowdstrike Global Intelligence Team. (2014, June 9). CrowdStrike Intelligence Report: Putter Panda. Retrieved January 22, 2016. ↩

  199. Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017. ↩↩

  200. Grunzweig, J. (2018, October 01). NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT. Retrieved November 5, 2018. ↩

  201. Karmi, D. (2020, January 4). A Look Into Konni 2019 Campaign. Retrieved April 28, 2020. ↩

  202. Threat Intelligence Team. (2021, August 23). New variant of Konni malware used in campaign targetting Russia. Retrieved January 5, 2022. ↩

  203. Check Point. (2022, January 11). APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit. Retrieved January 24, 2022. ↩

  204. ClearSky Research Team. (2020, August 13). Operation ‘Dream Job’ Widespread North Korean Espionage Campaign. Retrieved December 20, 2021. ↩

  205. McCabe, A. (2020, January 23). The Fractured Statue Campaign: U.S. Government Agency Targeted in Spear-Phishing Attacks. Retrieved June 2, 2020. ↩

  206. Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022. ↩

  207. Falcone, R. and Wartell, R.. (2015, July 27). Observations on CVE-2015-3113, Prior Zero-Days and the Pirpi Payload. Retrieved January 22, 2016. ↩

  208. Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018. ↩

  209. Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018. ↩

  210. Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021. ↩

  211. Ash, B., et al. (2018, June 26). RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families. Retrieved July 2, 2018. ↩

  212. Malhotra, A. (2021, March 2). ObliqueRAT returns with new campaign using hijacked websites. Retrieved September 2, 2021. ↩

  213. Gilbert Sison, Rheniel Ramos, Jay Yaneza, Alfredo Oliveira. (2018, January 15). KillDisk Variant Hits Latin American Financial Groups. Retrieved January 12, 2021. ↩

  214. FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved May 1, 2015. ↩↩

  215. ESET. (2020, April 28). Grandoreiro: How engorged can an EXE get?. Retrieved November 13, 2020. ↩

  216. ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018. ↩

  217. Lancaster, T., Cortes, J. (2018, January 29). VERMIN: Quasar RAT and Custom Malware Used In Ukraine. Retrieved July 5, 2018. ↩

  218. Kujawa, A. (2018, March 27). You dirty RAT! Part 1: DarkComet. Retrieved November 6, 2018. ↩

  219. Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018. ↩

  220. Sogeti. (2021, March). Babuk Ransomware. Retrieved August 11, 2021. ↩

  221. Mundo, A. et al. (2021, February). Technical Analysis of Babuk Ransomware. Retrieved August 11, 2021. ↩

  222. Centero, R. et al. (2021, February 5). New in Ransomware: Seth-Locker, Babuk Locker, Maoloa, TeslaCrypt, and CobraLocker. Retrieved August 11, 2021. ↩

  223. Su, V. et al. (2019, December 11). Waterbear Returns, Uses API Hooking to Evade Security. Retrieved February 22, 2021. ↩

  224. F-Secure Labs. (2014). BlackEnergy & Quedagh: The convergence of crimeware and APT attacks. Retrieved March 24, 2016. ↩

  225. Baumgartner, K. and Garnaeva, M.. (2014, November 3). BE2 custom plugins, router abuse, and target profiles. Retrieved March 24, 2016. ↩

  226. Cherepanov, A.. (2016, January 3). BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry . Retrieved June 10, 2020. ↩

  227. Mandiant. (n.d.). Appendix C (Digital) - The Malware Arsenal. Retrieved July 18, 2016. ↩↩

  228. MalwareBytes Threat Intelligence Team. (2022, August 3). Woody RAT: A new feature-rich malware spotted in the wild. Retrieved December 6, 2022. ↩

  229. Dragos. (2020, February 3). EKANS Ransomware and ICS Operations. Retrieved February 9, 2021. ↩

  230. Zafra, D., et al. (2020, February 24). Ransomware Against the Machine: How Adversaries are Learning to Disrupt Industrial Production by Targeting IT and OT. Retrieved March 2, 2021. ↩

  231. USG. (2020, May 12). MAR-10288834-2.v1 – North Korean Trojan: TAINTEDSCRIBE. Retrieved March 5, 2021. ↩

  232. Pascual, C. (2018, November 27). AutoIt-Compiled Worm Affecting Removable Media Delivers Fileless Version of BLADABINDI/njRAT Backdoor. Retrieved June 4, 2019. ↩

  233. Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018. ↩

  234. Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020. ↩

  235. DHS/CISA, Cyber National Mission Force. (2020, October 1). Malware Analysis Report (MAR) MAR-10303705-1.v1 – Remote Access Trojan: SLOTHFULMEDIA. Retrieved October 2, 2020. ↩

  236. Check Point Research Team. (2021, August 14). Indra - Hackers Behind Recent Attacks on Iran. Retrieved February 17, 2022. ↩

  237. Symantec. (2022, January 31). Shuckworm Continues Cyber-Espionage Attacks Against Ukraine. Retrieved February 17, 2022. ↩

  238. Unit 42. (2022, February 3). Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine. Retrieved February 21, 2022. ↩

  239. Chen, X., Scott, M., Caselden, D.. (2014, April 26). New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks. Retrieved January 14, 2016. ↩

  240. Yates, M. (2017, June 18). APT3 Uncovered: The code evolution of Pirpi. Retrieved September 28, 2017. ↩

  241. Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021. ↩

  242. Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022. ↩

  243. Fiser, D. Oliveira, A. (n.d.). Tracking the Activities of TeamTNT A Closer Look at a Cloud-Focused Malicious Actor Group. Retrieved September 22, 2021. ↩

  244. FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 6, 2018. ↩

  245. Marczak, B. and Scott-Railton, J.. (2016, May 29). Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents. Retrieved June 8, 2016. ↩

  246. Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022. ↩

  247. Park, S. (2021, June 15). Andariel evolves to target South Korea with ransomware. Retrieved September 29, 2021. ↩

  248. Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016. ↩

  249. Hegel, T. (2021, January 13). A Global Perspective of the SideWinder APT. Retrieved January 27, 2021. ↩

  250. Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With a New Malware Family Written in Golang. Retrieved April 24, 2019. ↩

  251. Symantec. (2018, March 14). Inception Framework: Alive and Well, and Hiding Behind Proxies. Retrieved May 8, 2020. ↩

  252. Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved January 19, 2021. ↩

  253. Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022. ↩

  254. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Loaders, Installers and Uninstallers Report. Retrieved March 2, 2016. ↩

  255. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016. ↩

  256. Saini, A. and Hossein, J. (2022, January 27). North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign. Retrieved January 27, 2022. ↩

  257. Sherstobitoff, R. (2018, February 12). Lazarus Resurfaces, Targets Global Banks and Bitcoin Users. Retrieved February 19, 2018. ↩

  258. The BlackBerry Research & Intelligence Team. (2020, October). BAHAMUT: Hack-for-Hire Masters of Phishing, Fake News, and Fake Apps. Retrieved February 8, 2021. ↩

  259. Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018. ↩

  260. Kaspersky Lab’s Global Research & Analysis Team. (2018, October 10). MuddyWater expands operations. Retrieved November 2, 2018. ↩

  261. ClearSky. (2019, June). Iranian APT group ‘MuddyWater’ Adds Exploits to Their Arsenal. Retrieved May 14, 2020. ↩

  262. Kaspersky Lab’s Global Research & Analysis Team. (2015, August 10). Darkhotel’s attacks in 2015. Retrieved November 2, 2018. ↩

  263. Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014. ↩

  264. Smallridge, R. (2018, March 10). APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS. Retrieved April 4, 2018. ↩

  265. Hamzeloofard, S. (2020, January 31). New wave of PlugX targets Hong Kong | Avira Blog. Retrieved April 13, 2021. ↩

  266. Eoin Miller. (2021, March 23). Defending Against the Zero Day: Analyzing Attacker Behavior Post-Exploitation of Microsoft Exchange. Retrieved October 27, 2022. ↩

  267. Kaspersky Lab’s Global Research and Analysis Team. (2016, February 9). Poseidon Group: a Targeted Attack Boutique specializing in global cyber-espionage. Retrieved March 16, 2016. ↩

  268. Alperovitch, D. (2014, July 7). Deep in Thought: Chinese Targeting of National Security Think Tanks. Retrieved November 12, 2014. ↩

  269. Kaspersky Lab’s Global Research and Analysis Team. (2013, April 11). Winnti. More than just a game. Retrieved February 8, 2017. ↩

  270. Ray, V. (2016, November 22). Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy. Retrieved November 9, 2018. ↩

  271. Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017. ↩

  272. Lee, B. and Falcone, R. (2017, February 15). Magic Hound Campaign Attacks Saudi Targets. Retrieved December 27, 2017. ↩

  273. An, J and Malhotra, A. (2021, November 10). North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets. Retrieved December 29, 2021. ↩

  274. Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022. ↩

  275. DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022. ↩

  276. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020. ↩

  277. Sherstobitoff, R. (2018, March 02). McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups. Retrieved May 16, 2018. ↩

  278. Cash, D. et al. (2020, December 14). Dark Halo Leverages SolarWinds Compromise to Breach Organizations. Retrieved December 29, 2020. ↩

  279. CrowdStrike. (2022, January 27). Early Bird Catches the Wormhole: Observations from the StellarParticle Campaign. Retrieved February 7, 2022. ↩

  280. MSTIC, CDOC, 365 Defender Research Team. (2021, January 20). Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop . Retrieved January 22, 2021. ↩