APT Notes

This is a repository for various publicly-available documents and notes related to APT, sorted by year. For malware sample hashes, please see the individual reports.

Data repo makes it easier for automation
To add new reports, please create a new issue
For more information, see the new README

2023

2022

2021

2020

Aug 26 - Transparent Tribe: Evolution analysis, part 2
Aug 20 - Transparent Tribe: Evolution analysis, part 1
Mar 25 - This Is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits

2019

Dec 18 - Untangling Legion Loader's Hornet Nest of Malware
Nov 05 - DarkUniverse - the mysterious APT framework 27
Oct 31 - Calypso APT: new group attacking state institutions
Oct 19 - Operation Ghost
Oct 14 - Huge Fan of Your Work: TURBINE PANDA C919 Passenger Jet
Oct 07 - The Kittens Are Back in Town 2
Oct 03 - AVIVORE - Hunting Global Aerospace through the Supply Chain
Sep 18 - Tortoiseshell Group Targets IT Providers in Saudi Arabia in Probable Supply Chain Attacks
Aug 19 - GAME OVER: Detecting and Stopping an APT41 Operation
Aug 12 - Recent Cloud Atlas activity
Aug 07 - APT41: A Dual Espionage and Cyber Crime Operation
Aug 07 - APT41: A Dual Espionage and Cyber Crime Operation
Jul 18 - Hard Pass: Declining APT34's Invite to Join Their Professional Network
Jul 09 - Sea Turtle keeps on swimming, finds new victims, DNS hijacking techniques
Jun 25 - Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers
Jun 20 - Waterbug: Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments
Apr 25 - CARBANAK Week Part Four: The CARBANAK Desktop Video Player
Apr 24 - CARBANAK Week Part Three: Behind the CARBANAK Backdoor
Apr 23 - CARBANAK Week Part Two: Continuing the CARBANAK Source Code Analysis
Apr 22 - CARBANAK Week Part One: A Rare Occurrence
Apr 17 - DNS Hijacking Abuses Trust In Core Internet Service
Apr 02 - OceanLotus APT Group Leveraging Steganography
Mar 25 - Pat Bear (APT-C-37)
Feb 27 - A Peek into BRONZE UNION's Toolbox
Feb 20 - Attacks Of The Lazarus Cybercriminal Group Attended To Organizations In Russia
Jan 30 - Chafer used Remexi malware to spy on Iran-based foreign diplomatic entities

2018

Dec 13 - Shamoon 3 Targets Oil and Gas Organization
Dec 12 - https://securingtomorrow.mcafee.com/blogs/other-blogs/mcafee-labs/operation-sharpshooter-targets-global-defense-critical-infrastructure/
Oct 17 - Operation Oceansalt Delivers Wave After Wave
Sep 07 - Domestic Kitten: An Iranian Surveillance Operation
Aug 30 - Two Birds, One STONE PANDA
Aug 22 - OPERATION "Rocket Man"
Aug 20 - Russian Army Exhibition Decoy Leads to New BISKVIT Malware
Jul 10 - APT Trends Report Q2 2018
Jun 19 - Olympic Destroyer is still alive
Jun 13 - LuckyMouse hits national data center to organize country-level waterholing campaign
May 22 - The destruction of APT3
May 09 - Iran's Hacker Hierarchy Exposed
May 04 - Burning Umbrella
Apr 23 - Energetic Bear/Crouching Yeti: attacks on servers
Apr 20 - Follow The Money: Dissecting the Operations of the Cyber Crime Group FIN
Apr 05 - M-TRENDS2018
Mar 28 - Lazarus Group Targets More Cryptocurrency Exchanges and FinTech Companies
Mar 10 - APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS
Mar 08 - Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant
Mar 01 - Industrial Control System Threats
Feb 20 - APT37 (Reaper): The Overlooked North Korean Actor
Jan 18 - Turla group update Neuron malware
Jan 18 - Dark Caracal Cyber-espionage at a Global Scale
Jan 12 - Update on Pawn Storm: New Targets and Politically Motivated Campaigns

2017

Dec 19 - North Korea Bitten by Bitcoin Bug
Dec 14 - Attackers Deploy New ICS Attack Framework "TRITON" and Cause Operational Disruption to Critical Infrastructure
Dec 14 - TRISIS Malware
Dec 05 - Charming Kitten: CSV Data
Dec 05 - Charming Kitten: Iranian Cyber Espionage Against Human Rights Activists
Nov 30 - Inside the Response of a Unique CARBANAK Intrusion
Nov 22 - Turla group using Neuron and Nautilus tools alongside Snake malware
Nov 22 - The Carbanak/Fin7 syndicate
Nov 08 - OilRig Deploys "ALMA Communicator" - DNS Tunneling Trojan
Nov 07 - Threat Group APT28 Slips Office Malware into Doc Citing NYC Terror Attack
Nov 06 - OceanLotus Blossoms: Mass Digital Surveillance and Attacks Targeting ASEAN
Nov 06 - ChessMaster's New Strategy: Evolving Tools and Tactics
Nov 02 - The KeyBoys are back in town
Oct 27 - Investigation: WannaCry cyber attack and the NHS
Oct 27 - Tracking Subaat: Targeted Phishing Attack Leads to Threat Actor's Repository
Oct 26 - Remote Control Interloper: Analyzing New Chinese htpRAT Attacks Against ASEAN
Oct 24 - Iranian Threat Agent Greenbug Impersonates Israeli High-Tech and Cyber Security Companies
Oct 22 - Cyber Conflict Decoy Document Used In Real Cyber Conflict
Oct 16 - BlackOasis APT and new targeted attacks leveraging zero-day exploit
Oct 16 - Taiwan Heist: Lazarus Tools And Ransomware
Oct 02 - Evidence Aurora Operation Still Active: Supply Chain Attack Through CCleaner part2
Sep 28 - Threat Actors Target Government of Belarus Using CMSTAR Trojan
Sep 20 - Evidence Aurora Operation Still Active: Supply Chain Attack Through CCleaner
Sep 12 - CVE-2017-8759: Zero-Day Used in the Wild to Distribute FINSPY
Sep 06 - Dragonfly: Western energy sector targeted by sophisticated attack group
Aug 30 - Gazing at Gazer
Aug 30 - Introducing WhiteBear
Aug 18 - Russian Bank Offices Hit with Broad Phishing Wave
Jul 27 - ChessMaster Makes its Move: A Look into the Campaign's Cyberespionage Arsenal
Jul 25 - Operation Wilted Tulip
Jul 18 - Cyberattacks Against Ukrainian ICS
Jul 18 - Inexsmar: An unusual DarkHotel campaig
Jul 05 - An intrusion campaign targeting Chinese language news sites
Jun 30 - TeleBots are back: supply-chain attacks against Ukraine
Jun 30 - From BlackEnergy to ExPetr
Jun 23 - Bronze Butler
Jun 15 - North Korea Is Not Crazy
Jun 14 - KASPERAGENT Malware Campaign resurfaces in May Election
Jun 12 - CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations
Jun 12 - WIN32/INDUSTROYER A new threat for industrial control systems
Jun 07 - PLATINUM continues to evolve, find ways to maintain invisibility
Jun 06 - Privileges and Credentials: Phished at the Request of Counsel
May 25 - TAINTED LEAKS Disinformation and Phishing With a Russian Nexus
May 24 - Operation Cobalt Kitty Threat Actor Profile & IOC
May 24 - Operation Cobalt Kitty: A large-scale APT in Asia carried out by the OceanLotus Group
May 17 - Recorded Future Research Concludes Chinese Ministry of State Security Behind APT3
May 14 - Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations
May 11 - Cyber Attack Impersonating Identity Of Indian Think Tank To Target Central Bureau Of Investigation (cbi) And Possibly Indian Army Officials
Apr 27 - APT Targets Financial Analysts with CVE-2017-0199
Apr 10 - Longhorn: Tools used by cyberespionage group
Apr 07 - The Blockbuster Sequel
Apr 03 - Lazarus Under The Hood
Apr 03 - Operation Cloud Hopper
Mar 30 - Carbon Paper: Peering into Turla second stage backdoor
Mar 28 - Dimnie: Hiding in Plain Sight
Mar 27 - APT29 Domain Fronting With TOR
Mar 14 - Operation Electric Powder - Who is targeting Israel Electric Company?
Mar 07 - FIN7 Spear Phishing Campaign Targets Personnel Involved in SEC Filings
Mar 06 - From Shamoon to StoneDrill
Feb 27 - The Deception Project: A New Japanese-Centric Threat
Feb 27 - The Gamaredon Group Toolset Evolution
Feb 23 - Dissecting the APT28 Mac OS X Payload
Feb 22 - Spear Phishing Techniques Used in Attacks Targeting the Mongolian Government
Feb 21 - Additional Insights on Shamoon2
Feb 20 - Lazarus' False Flag Malware
Feb 17 - ChChes - Malware that Communicates with C&C Servers Using Cookie Headers
Feb 16 - Breaking The Weakest Link Of The Strongest Chain
Feb 16 - ViperRAT: The mobile APT targeting the Israeli Defense Force that should be on your radar
Feb 15 - Operation Bugdrop: Cyberx Discovers Large-Scale Cyber-Reconnaissance Operation Targeting Ukrainian Organizations
Feb 15 - The Full Shamoon: How the Devastating Malware Was Inserted Into Networks
Feb 15 - Iranian PupyRAT Bites Middle Eastern Organizations
Feb 15 - Magic Hound Campaign Attacks Saudi Targets
Feb 12 - Lazarus & Watering-Hole Attacks
Feb 10 - Cyber Attack Targeting Indian Navy's Submarine And Warship Manufacturer
Feb 10 - Enhanced Analysis of GRIZZLY STEPPE Activity
Feb 03 - KingSlayer A Supply chain attack
Feb 03 - Several Polish banks hacked, information stolen by unknown attackers
Feb 02 - Nile Phish: Large-Scale Phishing Campaign Targeting Egyptian Civil Society
Jan 19 - URI Terror Attack & Kashmir Protest Themed Spear Phishing Emails Targeting Indian Embassies And Indian Ministry Of External Affairs
Jan 15 - Bear Spotting Vol. 1: Russian Nation State Targeting of Government and Military Interests
Jan 14 - A Pretty Dope Story About Bears: Early Indicators of Continued World Anti-Doping Agency (WADA) Targeting
Jan 11 - At the Center of the Storm: Russia's APT28 Strategically Evolves its Cyber Operations
Jan 05 - Foreign Cyber Threats to the United States
Jan 05 - Mm Core In-Memory Backdoor Returns As Bigboss And Sillygoose
Jan 05 - DragonOK Updates Toolset and Targets Multiple Geographic Regions
Jan 05 - Iranian Threat Agent OilRig Delivers Digitally Signed Malware, Impersonates University of Oxford
Jan 01 - The Digital Plagiarist Campaign: TelePorting the Carbanak Crew to a New Dimension

2016

Dec 29 - GRIZZLY STEPPE - Russian Malicious Cyber Activity
Dec 28 - Bear Hunting Season: Tracking APT28
Dec 22 - Use of Fancy Bear Android Malware tracking of Ukrainian Artillery Units
Dec 21 - Danger Close: Fancy Bear Tracking of Ukrainian Field Artillery Units
Dec 15 - Let It Ride: The Sofacy Group's DealersChoice Attacks Continue
Dec 14 - PROMETHIUM and NEODYMIUM: Parallel zero-day attacks targeting individuals in Europe
Nov 30 - Malware Actors Using Nic Cyber Security Themed Spear Phishing To Target Indian Government Organizations
Nov 17 - It's Parliamentary: KeyBoy and the targeting of the Tibetan Community
Nov 14 - New Carbanak / Anunak Attack Methodology
Nov 09 - PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs
Nov 03 - When The Lights Went Out: Ukraine Cybersecurity Threat Briefing
Oct 27 - BLACKGEAR Espionage Campaign Evolves, Adds Japan To Target List
Oct 27 - En Route with Sednit Part 3: A Mysterious Downloader
Oct 26 - BITTER: A Targeted attack against Pakistan
Oct 26 - Moonlight - Targeted attacks in the Middle East
Oct 25 - Houdini's Magic Reappearance
Oct 25 - En Route with Sednit Part 2: Observing the Comings and Goings
Oct 20 - En Route with Sednit Part 1: Approaching the Target
Oct 05 - Apt Reports And Opsec Evolution, Or: These Are Not The Apt Reports You Are Looking For
Oct 05 - Wave your false flags! Deception tactics muddying attribution in targeted attacks
Oct 03 - On the StrongPity Waterhole Attacks Targeting Italian and Belgian Encryption Users
Sep 28 - Belling the BEAR
Sep 26 - Sofacy's Komplex OS X Trojan
Sep 18 - Hunting Libyan Scorpions
Sep 06 - Buckeye cyberespionage group shifts gaze from US to Hong Kong
Aug 24 - The Million Dollar Dissident: NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender
Aug 13 - Visa Alert and Update on the Oracle Breach
Aug 08 - Carbanak Oracle Breach
Aug 08 - The ProjectSauron APT
Aug 07 - Strider: Cyberespionage group turns eye of Sauron on targets
Aug 06 - Moonsoon - Analysis of an APT Campaign
Aug 03 - Operation Manul
Jul 25 - Patchwork cyberespionage group expands targets from governments to wide range of industries
Jul 08 - The Dropping Elephant - aggressive cyber-espionage in the Asian region
Jul 07 - NetTraveler APT Targets Russian, European Interests
Jul 07 - Unveiling Patchwork the Copy Paste APT
Jul 01 - Espionage toolkit targeting Central and Eastern Europe uncovered
Jul 01 - Pacifier APT
Jun 30 - Asruex: Malware Infecting through Shortcut Files
Jun 28 - Prince of Persia Game Over
Jun 26 - Threat Group-4127 Targets Google Accounts
Jun 23 - Tracking Elirks Variants in Japan: Similarities to Previous Attacks
Jun 21 - Visiting The Bear Den A Journey in the Land of (Cyber-)Espionage
Jun 20 - Red Line Drawn: China Recalculates Its Use Of Cyber Espionage
Jun 20 - Findings from Analysis of DNC Intrusion Malware
Jun 20 - Reverse-engineering DUBNIUM's Flash-targeting exploit
Jun 17 - Operation Daybreak
Jun 17 - Flash zero-day exploit deployed by the ScarCruft APT Group
Jun 16 - Threat Group 4127 Targets Hillary Clinton Presidential Campaign
Jun 16 - Threat Group-4127 Targets Hillary Clinton Presidential Campaign
Jun 14 - Group5: Syria and the Iranian Connection
Jun 14 - New Sofacy Attacks Against US Government Agency
Jun 09 - Reverse-engineering DUBNIUM
Jun 09 - Operation DustySky Part 2 Indicators
Jun 09 - Operation DustySky Part 2
Jun 04 - Bears in the Midst: Intrusion into the Democratic National Committee
Jun 03 - Apt Group Sends Spear Phishing Emails To Indian Government Officials
Jun 03 - APT Group Sends Spear Phishing Emails to Indian Government Officials
Jun 02 - IRONGATE ICS Malware: Nothing to See Here...Masking Malicious Activity on SCADA Systems
May 29 - Stealth Falcon
May 27 - IXESHE Derivative IHEATE Targets Users in America
May 26 - SWIFT attackers' malware linked to more financial attacks
May 25 - CVE-2015-2545: overview of current threats
May 24 - New Wekby Attacks Use DNS Requests As Command and Control Mechanism
May 23 - Operation Ke3chang Resurfaces With New TidePool Malware
May 23 - APT Case RUAG Technical Report
May 23 - Targeted Attacks against Banks in the Middle East
May 20 - Attacks on SWIFT Banking System Benefit From Insider Knowledge
May 18 - Operation C-Major Actors Also Used Android BlackBerry Mobile Spyware Against Targets
May 17 - Indian organizations targeted in Suckfly attacks
May 17 - Operation Groundbait:Analysis of a surveillance toolkit
May 17 - Mofang: A politically motivated information stealing adversary
May 06 - Exploring CVE-2015-2545 and its users
May 02 - Prince of Persia: Infy Malware Active In Decade of Targeted Attacks
May 02 - Turbo Twist: Two 64-bit Derusbi Strains Converge
Apr 26 - PLATINUM Targeted attacks in South and Southeast Asia
Apr 25 - Two Bytes to $951M
Apr 22 - The Ghost Dragon
Apr 21 - Looking Into a Cyber-Attack Facilitator in the Netherlands (Appendix)
Apr 21 - Looking Into a Cyber-Attack Facilitator in the Netherlands
Apr 18 - Between Hong Kong and Burma: Tracking UP007 and SLServer Espionage Campaign
Apr 13 - The Four Element Sword Engagement
Mar 29 - Taiwan targeted with new cyberespionage back door Trojan
Mar 17 - Taiwan Presidential Election: A Case Study on Thematic Targeting
Mar 15 - Suckfly: Revealing the secret life of your code signing certificates
Mar 10 - Shifting Tactics Tracking Changes In Years Long Espionage Campaign Against Tibetans
Mar 01 - Operation Transparent Tribe
Feb 24 - FROM SEOUL TO SONY: THE HISTORY OF THE DARKSEOUL GROUP AND THE SONY INTRUSION MALWARE DESTOVER
Feb 24 - Operation Blockbuster
Feb 23 - Operation Duststorm
Feb 12 - A Look Into Fysbis: Sofacy's Linux Backdoor
Feb 09 - Poseidon Group
Feb 08 - Know Your Enemies 2.0: A Primer on Advanced Persistent Threat Groups
Feb 08 - Attack On French Diplomat Linked To Operation Lotus Blossom
Feb 04 - T9000: Advanced Modular Backdoor Uses Complex Anti Analysis Techniques
Feb 03 - Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It To Evolve
Jan 28 - BlackEnergy APT Attacks in Ukraine employ spearphishing with Word documents
Jan 24 - Scarlet Mimic
Jan 20 - New wave of cyberattacks against Ukrainian power industry
Jan 14 - RESEARCH SPOTLIGHT: NEEDLES IN A HAYSTACK
Jan 11 - Uncovering the Seven Pointed Dagger
Jan 07 - Operation Dusty Sky (indicators)
Jan 07 - Operation Dusty Sky
Jan 03 - BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry

2015

Dec 23 - ELISE: Security Through Obesity
Dec 22 - BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger
Dec 16 - Dissecting the Malware Involved in the INOCNATION Campaign
Dec 10 - Evolution of Cyber Threats in the Corporate Sector
Dec 07 - Iran-based attackers use back door threats to spy on Middle Eastern targets
Nov 23 - PEERING INTO GLASSRAT: A Zero Detection Trojan from China
Nov 16 - Microsoft Security Intelligence Report (Volume 19)
Nov 09 - Rocket Kitten: A Campaign With 9 Lives
Oct 15 - Pay No Attention to the Server Behind the Proxy: Mapping FinFisher's Continuing Proliferation
Oct 07 - Hacker Group Creates Network of Fake LinkedIn Profiles
Sep 17 - THE DUKES: 7 years of Russian cyberespionage
Sep 08 - Carbanak is packing new guns
Aug 10 - Darkhotel's attacks in 2015
Aug 05 - Threat Group-3390 Targets Organizations For Cyberespionage
Aug 04 - RSA Research Terracotta VPN: Enabler Of Advanced Threat Anonymity
Aug 03 - Cyber war in perspective: Russian aggression against Ukraine
Jul 31 - Operation Potao Express: Analysis Of A Cyber-Espionage Toolkit
Jul 28 - The Black Vine Cyberespionage Group
Jul 27 - Hammertoss: Stealthy Tactics Define A Russian Cyber Threat Group
Jul 22 - Duke APT Group's Latest Tools: Cloud Services And Linux Support
Jul 20 - China Hacks The Peace Palace: All Your Eez's Are Belong To Us
Jul 20 - Watering Hole Attack On Aerospace Firm Exploits CVE-2015-5122 To Install Isspace Backdoor
Jul 14 - Tracking Minidionis: Cozycar's New Ride Is Related To Seaduke
Jul 13 - "Forkmeiamfamous": Seaduke, Latest Weapon In The Duke Armory
Jul 09 - Butterfly: Corporate Spies Out For Financial Gain
Jul 08 - Wild Neutron _ Economic Espionage Threat Actor Returns With New Tricks
Jun 30 - Dino: The Latest Spying Malware From An Allegedly French Espionage Group Analyzed
Jun 24 - Unfin4Ished Business
Jun 22 - Games Are Over: Winnti Is Now Targeting Pharmaceutical Companies
Jun 16 - Operation Lotusblossom
Jun 15 - Target Attacks Against Tibetan And Hong Kong Groups Exploiting CVE-2014-4114
Jun 15 - The Naikon APT: Tracking Down Geo-Political Intelligence Across APAC, One Nation At A Time
Jun 11 - The Duqu 2.0 Technical Details
Jun 10 - Duqu 2.0: Reemergence of an aggressive cyberespionage threat
Jun 10 - Duqu 2.0: A Comparison To Duqu
Jun 04 - Blue Termite (Internet Watch)
Jun 03 - An Iranian Cyber-Attack Campaign Against Targets In The Middle East
May 29 - Oceanlotus
May 28 - Grabit And The Rats
May 27 - Analysis On APT-To-Be Attack That Focusing On China's Government Agency
May 26 - Dissecting Linux/Moose: The Analysis Of A Linux Router-Based Worm Hungry For Social Networks
May 21 - The Msnmm Campaigns: The Earliest Naikon APT Campaigns
May 19 - Operation Oil Tanker: The Phantom Menace
May 18 - Cmstar Downloader: Lurid And Enfal's New Cousin
May 14 - Operation Tropic Trooper: Relying On Tried-And-Tested Flaws To Infiltrate Secret Keepers
May 13 - Cylance Spear Team: A Threat Actor Resurfaces
May 10 - APT28 Targets Financial Markets: Zero Day Hashes Released
May 07 - Dissecting The Kraken
May 05 - Targeted Attack on France's TV5Monde
Apr 27 - Attacks Against Israeli & Palestinian Interests
Apr 26 - Operation Clandestine Wolf _ Adobe Flash Zero-Day In APT3 Phishing Campaign
Apr 22 - Cozyduke
Apr 21 - The Cozyduke APT
Apr 20 - Sofacy II_ Same Sofacy, Different Day
Apr 18 - Operation Russiandoll: Adobe & Windows ZeroDay Exploits Likely leveraged By Russia's APT28
Apr 15 - Hellsing Indicators Of Compromise
Apr 15 - The Chronicles Of The Hellsing APT: The Empire Strikes Back
Apr 12 - APT30 And The Mechanics Of A Long-Running Cyber Espionage Operation
Apr 08 - RSA Incident Response: An APT Case Study
Apr 07 - WINNTI Analysis
Mar 31 - Volatile Cedar Threat Intelligence And Research
Mar 19 - Operation Woolen-Goldfish When Kittens Go Phishing
Mar 11 - Inside The Equationdrug Espionage Platform
Mar 10 - Tibetan Uprising Day Malware Attacks
Feb 27 - The Anthem Hack: All Roads Lead To China
Feb 25 - Plugx Goes To The Registry (And India)
Feb 25 - Southeast Asia: An Evolving Cyber Threat Landscape
Feb 24 - Scanbox Ii
Feb 18 - Shooting Elephants
Feb 17 - The Desert Falcons Targeted Attacks
Feb 16 - Carbanak APT The Great Bank Robbery
Feb 16 - Equation Group: Questions And Answers
Feb 16 - Operation Arid Viper: Bypassing The Iron Dome
Feb 10 - Global Threat Intel Report
Feb 04 - Pawn Storm Update: Ios Espionage App Found
Feb 02 - Behind The Syrian Conflict's Digital Front Lines
Jan 29 - Backdoor.Winnti Attackers Have A Skeleton In Their Closet?
Jan 29 - Analysis Of A Recent Plugx Variant - P2P Plugx
Jan 22 - An Analysis Of Regin's Hopscotch And Legspin
Jan 22 - Scarab Attackers Took Aim At Select Russian Targets Since 2012
Jan 22 - The Waterbug Attack Group
Jan 20 - Reversing The Inception APT Malware
Jan 20 - Analysis Of Project Cobra
Jan 15 - Evolution Of Sophisticated Spyware: From Agent.Btz To Comrat
Jan 12 - Insight In To A Strategic Web Compromise And Attack Campaign Against Hong Kong Infrastructure
Jan 12 - Skeleton Key Malware Analysis

2014

Dec 22 - Anunak: Apt Against Financial Institutions
Dec 21 - Operation Poisoned Helmand
Dec 19 - Alert (Ta14-353A) Targeted Destructive Malware
Dec 18 - Malware Attack Targeting Syrian Isis Critics
Dec 17 - Wiper Malware _ A Detection Deep Dive
Dec 12 - Bots, Machines, And The Matrix
Dec 12 - Vinself Now With Steganography
Dec 10 - Cloud Atlas: Redoctober Apt Is Back In Style
Dec 10 - Vulnerability, Malicious Code Appeared In The Mbr Destruction Function Using Hangul File
Dec 10 - W32/Regin, Stage #1
Dec 10 - W64/Regin, Stage #1
Dec 09 - The Inception Framework: Cloud-Hosted Apt
Dec 08 - The 'Penquin' Turla
Dec 03 - Operation Cleaver: The Notepad Files
Dec 01 - Hacking The Street? Fin4 Likely Playing The Market
Nov 24 - I Am Ironman: Deep Panda Uses Sakula Malware To Target Organizations In Multiple Sectors
Nov 24 - The Regin Platform Nation-State Ownership Of Gsm Networks
Nov 24 - Secret Malware In European Union Attack Linked To U.S. And British Intelligence
Nov 23 - Regin: Top-Tier Espionage Tool Enables Stealthy Surveillance
Nov 21 - Operation Double Tap
Nov 20 - Evil Bunny: Suspect #4
Nov 14 - Derusbi (Server Variant) Analysis
Nov 14 - Onionduke: Apt Attacks Via The Tor Network - F-Secure Weblog : News From The Lab
Nov 14 - Roaming Tiger
Nov 13 - Operation Cloudyomega: Ichitaro Zero-Day And Ongoing Cyberespionage Campaign Targeting Japan
Nov 12 - Korplug Military Targeted Attacks: Afghanistan & Tajikistan
Nov 11 - The Uroburos Case: New Sophisticated Rat Identified
Nov 10 - The Darkhotel APT A Story of Unusual Hospitality v1.1
Nov 10 - The Darkhotel Apt A Story Of Unusual Hospitality v1.0
Nov 10 - Darkhotel Indicators Of Compromise
Nov 03 - Be2 Custom Plugins, Router Abuse, And Target Profiles
Nov 03 - Operation Poisoned Handover: Unveiling Ties Between Apt Activity In Hong Kong's Pro-Democracy Movement
Oct 31 - Operation Toohash How Targeted Attacks Work
Oct 30 - The Rotten Tomato Campaign
Oct 28 - Apt28: A Window Into Russia's Cyber Espionage Operations
Oct 28 - Threat Spotlight: Group 72, Opening The Zxshell
Oct 27 - Full Disclosure Of Havex Trojans
Oct 27 - Micro-Targeted Malvertising Via Real-Time Ad Bidding
Oct 27 - Scanbox Framework: Who's Affected, And Who's Using It?
Oct 24 - Operation SMN
Oct 24 - Leouncia And Orcarat
Oct 23 - Modified Binaries Tor
Oct 23 - Operation Pawn Storm Using Decoys To Evade Detection
Oct 22 - Tactical Intelligence Bulletin Sofacy Phishing
Oct 20 - Orcarat - A Whale Of A Tale
Oct 14 - Threat Spotlight: Group 72
Oct 14 - Hikit Analysis
Oct 14 - Russian Cyber Espionage Campaign - Sandworm Team
Oct 14 - Zoxpng Analysis
Oct 09 - Democracy In Hong Kong Under Attack
Oct 03 - New Indicators Of Compromise For Apt Group Nitro Uncovered
Sep 26 - Aided Frame, Aided Direction (Because It's A Redirect)
Sep 26 - Blackenergy & Quedagh: The Convergence Of Crimeware And Apt Attacks
Sep 19 - Recent Watering Hole Attacks Attributed To Apt Group Th3Bug Using Poison Ivy
Sep 18 - Cosmicduke Cosmu With A Twist Of Miniduke
Sep 10 - Operation Quantum Entanglement
Sep 08 - Targeted Threat Index: Characterizing And Quantifying Politically-Motivated Targeted Malware
Sep 08 - When Governments Hack Opponents: A Look At Actors And Technology
Sep 04 - Analysis Of Chinese Mitm On Google
Sep 04 - Forced To Adapt: Xslcmd Backdoor Now On Os X
Sep 03 - Darwin's Favorite Apt Group
Aug 29 - Connecting The Dots: Syrian Malware Team Uses Blackworm For Attacks
Aug 28 - Scanbox: A Reconnaissance Framework Used With Watering Hole Attacks
Aug 27 - Profiling An Enigma: The Mystery Of North Korea's Cyber Threat Landscape
Aug 27 - Nettraveler Apt Gets A Makeover For 10Th Birthday
Aug 20 - El Machete
Aug 07 - The Epic Turla Operation: Solving Some Of The Mysteries Of Snake/Uroboros
Aug 06 - Operation Poisoned Hurricane
Aug 05 - Operation Arachnophobia Caught In The Spider's Web
Aug 04 - Sidewinder Targeted Attack Against Android In The Golden Age Of Ad Libraries
Aug 04 - Gholee Protective Edge Themed Spear Phishing Campaign
Aug 01 - Syrian Malware, The Ever-Evolving Threat
Jul 31 - Energetic Bear _ Crouching Yeti
Jul 31 - Crouching Yeti: Appendixes
Jul 20 - Sayad (Flying Kitten) Infostealer: Is This The Work Of The Iranian Ajax Security Team?
Jul 11 - The Eye Of The Tiger (Pitty Tiger)
Jul 10 - Tr-25 Analysis - Turla / PNet / Snake/ Uroburos
Jun 30 - Dragonfly: Cyberespionage Attacks Against Energy Suppliers
Jun 20 - #9 Blitzanalysis: Embassy Of Greece Beijing - Compromise
Jun 10 - Snake In The Grass: Python-based Malware Used For Targeted Attacks
Jun 10 - Anatomy Of The Attack: Zombie Zero
Jun 09 - Putter Panda
Jun 06 - Illuminating The Etumbot Apt Backdoor
May 21 - Rat In A Jar: A Phishing Campaign Using Unrecom
May 20 - Miniduke Still Duking It Out
May 13 - Cat Scratch Fever: Crowdstrike Tracks Newly Reported Iranian Actor As Flying Kitten
May 13 - Operation Saffron Rose
Apr 26 - New Zero-Day Exploit Targeting Internet Explorer Versions 9 Through 11 Identified In Targeted Attacks
Mar 08 - Suspected Russian Spyware Turla Targets Europe, United States
Mar 07 - Snake Campaign & Cyber Espionage Toolkit
Mar 06 - The Siesta Campaign: A New Cybercrime Operation Awakens
Feb 28 - Uroburos Highly Complex Espionage Software With Russian Roots
Feb 25 - The French Connection: French Aerospace-Focused CVE-2014-0322 Attack Shares Similarities with 2012 Capstone Turbine Activity
Feb 23 - Gathering In The Middle East, Operation Stteam
Feb 20 - Mo' Shells Mo' Problems - Deep Panda Web Shells
Feb 20 - Operation Greedywonk: Multiple Economic And Foreign Policy Sites Compromised, Serving Up Flash Zero-Day Exploit
Feb 19 - The Monju Incident
Feb 19 - Xtremerat: Nuisance Or Threat?
Feb 13 - Operation Snowman: Deputydog Actor Compromises Us Veterans Of Foreign Wars Website
Feb 11 - Unveiling Careto - The Masked Apt
Jan 31 - Intruder File Report- Sneakernet Trojan
Jan 21 - Emerging Threat Profile Shell_Crew
Jan 15 - New Cdto: A Sneakernet Trojan Solution
Jan 13 - Targeted Attacks Against The Energy Sector

2013

Dec 31 - Energy At Risk: A Study Of It Security In The Energy And Natural Resources Industry
Dec 20 - Etso Apt Attacks Analysis
Dec 11 - Operation Ke3Chang Targeted Attacks Against Ministries Of Foreign Affairs
Dec 02 - "Njrat", The Saga Continues
Nov 11 - Supply Chain Analysis: From Quartermaster To Sunshopfireeye
Oct 24 - Evasive Tactics: Terminator Rat
Oct 24 - Fakem Rat: Malware Disguised As Windows Messenger And Yahoo! Messenger
Sep 30 - World War C: Understanding Nation-State Motives Behind Today's Advanced Cyber Attacks
Sep 19 - 2Q Report On Targeted Attack Campaigns
Sep 17 - Hidden Lynx: Professional Hackers For Hire
Sep 13 - Operation Deputydog: Zero-Day (Cve-2013-3893) Attack Against Japanese Targets
Sep 11 - The "Kimsuky" Operation: A North Korean Apt?
Sep 10 - Operation Ephemeral Hydra: Ie Zero-Day Linked To Deputydog Uses Diskless Method
Aug 23 - Operation Molerats
Aug 21 - Poison Ivy: Assessing Damage And Extracting Intelligence
Aug 19 - Byebye Shell And The Targeting Of Pakistan
Aug 12 - Survival Of The Fittest: New York Times Attackers Evolve Quickly
Aug 07 - The Little Malware That Could: Detecting And Defeating The China Chopper Web Shell
Aug 02 - Where There Is Smoke, There Is Fire: South Asian Cyber Espionage Heats Up
Aug 02 - Surtr: Malware Family Targeting The Tibetan Community
Aug 01 - Inside Report _ Apt Attacks On Indian Cyber Space
Aug 01 - Operation Hangover - Unveiling An Indian Cyberattack Infrastructure (Appendix)
Jul 31 - Secrets Of The Comfoo Masters
Jul 15 - The Plugx Malware Revisited: Introducing Smoaler
Jul 09 - Dark Seoul Cyber Attack: Could It Be Worse?
Jul 01 - Hunting The Shadows: In Depth Analysis Of Escalated Apt Attacks
Jun 28 - Njrat Uncovered
Jun 21 - A Call To Harm: New Malware Attacks Target The Syrian Opposition
Jun 18 - Trojan.Apt.Seinup Hitting Asean
Jun 07 - Keyboy, Targeted Attacks Against Vietnam And India
Jun 04 - The Nettraveler (Aka Travnet)
Jun 01 - Crude Faux: An Analysis Of Cyber Conflict Within The Oil & Gas Industries
Jun 01 - The Chinese Malware Complexes: The Maudi Surveillance Operation
May 30 - Analysis Of A Stage 3 Miniduke Sample
May 20 - Operation Hangover |Executive Summary
May 20 - Operation Hangover - Unveiling An Indian Cyberattack Infrastructure
May 03 - Deep Panda
Apr 17 - The Mutter Backdoor: Operation Beebus with New Targets
Apr 13 - Winnti: More Than Just A Game
Apr 03 - A Closer Look At Miniduke
Apr 01 - Trojan.Apt.Banechant: In-Memory Trojan That Observes For Multiple Mouse Clicks
Mar 28 - Analysis Of A Plugx Variant (Plugx Version 7.0)
Mar 27 - Apt1: Technical Backstage
Mar 20 - Dissecting Operation Troy: Cyberespionage In South Korea
Mar 20 - The Teamspy Story - Abusing Teamviewer In Cyberespionage Campaigns
Mar 17 - Safe A Targeted Threat
Mar 13 - You Only Click Twice: Finfisher's Global Proliferation
Feb 27 - Miniduke: Indicators
Feb 27 - The Miniduke Mystery: Pdf 0-Day Government Spy Assembler 0X29A Micro Backdoor
Feb 26 - Stuxnet 0.5: The Missing Link
Feb 22 - Comment Crew: Indicators Of Compromise
Feb 18 - Apt1 Exposing One Of China's Cyber Espionage Units
Feb 12 - Targeted Cyber Attacks: Examples And Challenges Ahead
Feb 03 - Command And Control In The Fifth Domain
Feb 01 - Operation Beebus
Jan 18 - Operation Red October
Jan 14 - The Icefog Apt: A Tale Of Cloak And Three Daggers
Jan 14 - "Red October" Diplomatic Cyber Attacks Investigation
Jan 14 - The "Red October" Campaign - An Advanced Cyber Espionage Network Targeting Diplomatic And Government Agencies

2012

Nov 30 - The Many Faces Of Gh0St Rat: Plotting The Connections Between Malware Attacks
Nov 03 - Systematic Cyber Attacks Against Israeli And Palestinian Targets Going On For A Year
Nov 01 - Recovering From Shamoon
Nov 01 - "Wicked Rose" And The Ncph Hacking Group
Oct 27 - Trojan.Taidoor: Targeting Think Tanks
Sep 07 - Iexpl0Re Rat
Sep 06 - The Elderwood Project
Aug 18 - The Mirage Campaign
Aug 12 - The Voho Campaign: An In Depth Analysis
Aug 09 - Gauss: Abnormal Distribution
Jul 27 - The 'Madi' Infostealers - A Detailed Analysis
Jul 25 - From Bahrain With Love: Finfisher Spy Kit Exposed?
Jul 10 - Recent Observations In Tibet-Related Information Operations: Advanced Social Engineering For The Distribution Of Lurk Malware
Jun 13 - Pest Control: Taming The Rats
May 31 - Skywiper (A.K.A. Flame A.K.A. Flamer): A Complex Malware For Targeted Attacks
May 22 - Ixeshe An Apt Campaign
May 18 - Have I Got Newsforyou: Analysis Of Flamer C&C Server
Apr 16 - New Version Of Osx.Sabpub & Confirmed Mac Apt Attacks
Apr 03 - The Luckycat Hackers
Mar 26 - Luckycat Redux: Inside An Apt Campaign With Multiple Targets In India And Japan
Mar 13 - It'S Not The End Of The World: Darkcomet Misses By A Mile
Mar 12 - Crouching Tiger, Hidden Dragon, Stolen Data
Feb 29 - The Sin Digoo Affair
Jan 03 - The Heartbeat Apt Campaign

2011

Dec 28 - Stuxnet/Duqu: The Evolution Of Drivers
Dec 08 - Cyber-intruder sparks response, debate
Dec 08 - Palebot Trojan Harvests Palestinian Online Credentials
Oct 31 - The Nitro Attacks: Stealing Secrets From The Chemical Industry
Oct 26 - Duqu Trojan Questions And Answers
Oct 12 - Alleged Apt Intrusion Set: 1.Php Group
Sep 11 - Sk Hack By An Advanced Persistent Threat
Aug 22 - The Lurid Downloader
Aug 04 - Revealed: Operation Shady Rat
Aug 03 - Htran And The Advanced Persistent Threat
Aug 02 - Operation Shady Rat: Unprecedented Cyber-Espionage Campaign And Intellectual-Property Bonanza
Jun 01 - Advanced Persistent Threats: A Decade In Review
Apr 20 - Stuxnet Under The Microscope
Feb 18 - Night Dragon: Specific Protection Measures For Consideration
Feb 10 - Global Energy Cyberattacks: Night Dragon
Feb 01 - W32.Stuxnet Dossier

2010

Sep 03 - The Msupdater Trojan And Ongoing Targeted Attacks
Aug 24 - Defense official discloses cyberattack
Apr 06 - Shadows In The Cloud: Investigating Cyber Espionage 2.0
Mar 14 - In-Depth Analysis Of Hydraq: The Face Of Cyberwar Enemies Unfolds
Feb 24 - How Can I Tell If I Was Infected By Aurora?
Feb 10 - Operation Aurora
Jan 27 - Operation Aurora: Detect, Diagnose, Respond
Jan 20 - Combating Aurora
Jan 13 - The Command Structure Of The Aurora Botnet
Jan 01 - Case Study: Operation Aurora

2009

Mar 29 - Tracking Ghostnet: Investigating A Cyber Espionage Network
Jan 18 - Impact Of Alleged Russian Cyber Attack

2008

Nov 11 - Russian Cyberwar On Georgia
Oct 01 - How China Will Use Cyber Warfare

kbandla/APTnotes

Measured star growth

README.md

APT Notes

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

Explore related projects

codecrafters-io/build-your-own-x

public-apis/public-apis

morluto/rea

openclaw/openclaw