1. Home
  2. Techniques
  3. Enterprise
  4. Process Discovery

Process Discovery

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

In Windows environments, adversaries could obtain details on running processes using the Tasklist utility via cmd or Get-Process via PowerShell. Information about processes can also be extracted from the output of Native API calls such as CreateToolhelp32Snapshot. In Mac and Linux, this is accomplished with the ps command. Adversaries may also opt to enumerate processes via /proc.

ID: T1057
Sub-techniques:  No sub-techniques
ⓘ
Tactic: Discovery
ⓘ
Platforms: Linux, Windows, macOS
ⓘ
System Requirements: Administrator, SYSTEM may provide better process ownership details
ⓘ
Permissions Required: Administrator, SYSTEM, User
ⓘ
CAPEC ID: CAPEC-573
Version: 1.2
Created: 31 May 2017
Last Modified: 26 March 2020

Procedure Examples

ID Name Description
S0065 4H RAT

4H RAT has the capability to obtain a listing of running processes (including loaded modules).[1]
S0045 ADVSTORESHELL

ADVSTORESHELL can list running processes.[2]
S0331 Agent Tesla

Agent Tesla can list the current running processes on the system.[3]
G0138 Andariel

Andariel has used tasklist to enumerate processes and find a specific string.[4]
S0622 AppleSeed

AppleSeed can enumerate the current process on a compromised host.[5]
G0006 APT1

APT1 gathered a list of running processes on the system using tasklist /v.[6]
G0007 APT28

An APT28 loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions.[7]
G0016 APT29

APT29 has used multiple command-line utilities to enumerate running processes.[8][9][10]
G0022 APT3

APT3 has a tool that can list out currently running processes.[11][12]
G0067 APT37

APT37's Freenki malware lists running processes using the Microsoft Windows API.[13]
G0082 APT38

APT38 leveraged Sysmon to understand the processes, services in the organization.[14]
S0456 Aria-body

Aria-body has the ability to enumerate loaded modules for a process.[15].
S0373 Astaroth

Astaroth searches for different processes on the system.[16]
S0640 Avaddon

Avaddon has collected information about running processes.[17]
S0473 Avenger

Avenger has the ability to use Tasklist to identify running processes.[18]
S0344 Azorult

Azorult can collect a list of running processes by calling CreateToolhelp32Snapshot.[19][20]
S0638 Babuk

Babuk has the ability to check running processes on a targeted system.[21][22][23]
S0414 BabyShark

BabyShark has executed the tasklist command.[24]

S0093 Backdoor.Oldrea

Backdoor.Oldrea collects information about running processes.[25]
S0031 BACKSPACE

BACKSPACE may collect information about running processes.[26]
S0606 Bad Rabbit

Bad Rabbit can enumerate all running processes to compare hashes.[27]
S0239 Bankshot

Bankshot identifies processes and collects the process ids.[28]
S0534 Bazar

Bazar can identity the current process on a compromised host.[29]
S0127 BBSRAT

BBSRAT can list running processes.[30]
S0017 BISCUIT

BISCUIT has a command to enumerate running processes and identify their owners.[31]
S0268 Bisonal

Bisonal can obtain a list of running processes on the victim’s machine.[32][33][34]
S0069 BLACKCOFFEE

BLACKCOFFEE has the capability to discover processes.[35]
S0089 BlackEnergy

BlackEnergy has gathered a process list by using Tasklist.exe.[36][37][38]
S0657 BLUELIGHT

BLUELIGHT can collect process filenames and SID authority level.[39]
S0486 Bonadan

Bonadan can use the ps command to discover other cryptocurrency miners active on the system.[40]
S0252 Brave Prince

Brave Prince lists the running processes.[41]
S0482 Bundlore

Bundlore has used the ps command to list processes.[42]
S0693 CaddyWiper

CaddyWiper can obtain a list of current processes.[43]
S0351 Cannon

Cannon can obtain a list of processes running on the system.[44][45]
S0030 Carbanak

Carbanak lists running processes.[46]
S0484 Carberp

Carberp has collected a list of running processes.[47]
S0335 Carbon

Carbon can list the processes on the victim’s machine.[48]
S0348 Cardinal RAT

Cardinal RAT contains watchdog functionality that ensures its process is always running, else spawns a new instance.[49]
S0572 Caterpillar WebShell

Caterpillar WebShell can gather a list of processes running on the machine.[50]

S0674 CharmPower

CharmPower has the ability to list running processes through the use of tasklist.[51]
S0144 ChChes

ChChes collects its process identifier (PID) on the victim.[52]
G0114 Chimera

Chimera has used tasklist to enumerate processes.[53]
S0660 Clambling

Clambling can enumerate processes on a targeted system.[54]
S0611 Clop

Clop can enumerate all processes on the victim's machine.[55]
S0154 Cobalt Strike

Cobalt Strike's Beacon payload can collect information on process details.[56][57][58]
S0244 Comnie

Comnie uses the tasklist to view running processes on the victim’s machine.[59]
S0575 Conti

Conti can enumerate through all open processes to search for any that have the string "sql" in their process name.[60]
S0115 Crimson

Crimson contains a command to list processes.[61][62]

S0625 Cuba

Cuba can enumerate processes running on a victim's machine.[63]
S0687 Cyclops Blink

Cyclops Blink can enumerate the process it is currently running under.[64]
S0497 Dacls

Dacls can collect data on running and parent processes.[65]
S0334 DarkComet

DarkComet can list active processes running on the victim’s machine.[66]
G0012 Darkhotel

Darkhotel malware can collect a list of running processes on a system.[67]
G0009 Deep Panda

Deep Panda uses the Microsoft Tasklist utility to list processes running on systems.[68]
S0021 Derusbi

Derusbi collects current and parent process IDs.[69][70]
S0659 Diavol

Diavol has used CreateToolhelp32Snapshot, Process32First, and Process32Next API calls to enumerate the running processes in the system.[71]
S0600 Doki

Doki has searched for the current process’s PID.[72]
S0695 Donut

Donut includes subprojects that enumerate and identify information about Process Injection candidates.[73]

S0472 down_new

down_new has the ability to list running processes on a compromised host.[18]
S0694 DRATzarus

DRATzarus can enumerate and examine running processes to determine if a debugger is present.[74]
S0567 Dtrack

Dtrack’s dropper can list all running processes.[75][76]
S0038 Duqu

The discovery modules used with Duqu can collect information on process details.[77]
S0062 DustySky

DustySky collects information about running processes from victims.[78][79]
S0605 EKANS

EKANS looks for processes from a hard-coded list.[80][81][82]
S0081 Elise

Elise enumerates processes via the tasklist command.[83]
S0064 ELMER

ELMER is capable of performing process listings.[84]
S0367 Emotet

Emotet has been observed enumerating local processes.[85]
S0363 Empire

Empire can find information about processes running on local and remote systems.[86]
S0091 Epic

Epic uses the tasklist /v command to obtain a list of processes.[87][88]
S0396 EvilBunny

EvilBunny has used EnumProcesses() to identify how many process are running in the environment.[89]
S0512 FatDuke

FatDuke can list running processes on the localhost.[90]
S0267 FELIXROOT

FELIXROOT collects a list of running processes.[91]
S0355 Final1stspy

Final1stspy obtains a list of running processes.[92]
S0182 FinFisher

FinFisher checks its parent process for indications that it is running in a sandbox setup.[93][94]
S0696 Flagpro

Flagpro has been used to run the tasklist command on a compromised system.[95]
S0661 FoggyWeb

FoggyWeb's loader can enumerate all Common Language Runtimes (CLRs) and running Application Domains in the compromised AD FS server's Microsoft.IdentityServer.ServiceHost.exe process.[96]
S0503 FrameworkPOS

FrameworkPOS can enumerate and exclude selected processes on a compromised host to speed execution of memory scraping.[97]
G0101 Frankenstein

Frankenstein has enumerated hosts, looking to obtain a list of all currently running processes.[98]
S0277 FruitFly

FruitFly has the ability to list processes on the system.[99]
S0410 Fysbis

Fysbis can collect information about running processes.[100]

G0047 Gamaredon Group

Gamaredon Group has used tools to enumerate processes on target hosts including Process Explorer.[101][102]
S0666 Gelsemium

Gelsemium can enumerate running processes.[103]
S0049 GeminiDuke

GeminiDuke collects information on running processes and environment variables from the victim.[104]
S0460 Get2

Get2 has the ability to identify running processes on an infected host.[105]
S0032 gh0st RAT

gh0st RAT has the capability to list processes.[106]
S0249 Gold Dragon

Gold Dragon checks the running processes on the victim’s machine.[41]
S0477 Goopy

Goopy has checked for the Google Updater process to ensure Goopy was loaded properly.[107]
S0531 Grandoreiro

Grandoreiro can identify installed security tools based on process names.[108]
S0237 GravityRAT

GravityRAT lists the running processes on the system.[109]
S0151 HALFBAKED

HALFBAKED can obtain information about running processes on the victim.[110]
S0617 HELLOKITTY

HELLOKITTY can search for specific processes to terminate.[111]
S0170 Helminth

Helminth has used Tasklist to get information on processes.[7]
G0126 Higaisa

Higaisa’s shellcode attempted to find the process ID of the current process.[112]
G0072 Honeybee

Honeybee gathers a list of processes using the tasklist command and then is sent back to the control server.[113]
S0431 HotCroissant

HotCroissant has the ability to list running processes on the infected host.[114]
S0203 Hydraq

Hydraq creates a backdoor through which remote attackers can monitor processes.[115][116]
S0278 iKitten

iKitten lists the current processes running.[99]
S0434 Imminent Monitor

Imminent Monitor has a "Process Watcher" feature to monitor processes in case the client ever crashes or gets closed.[117]
G0100 Inception

Inception has used a reconnaissance module to identify active processes and other associated loaded modules.[118]
S0260 InvisiMole

InvisiMole can obtain a list of running processes.[119][120]
S0581 IronNetInjector

IronNetInjector can identify processes via C# methods such as GetProcessesByName and running Tasklist with the Python os.popen function.[121]
S0015 Ixeshe

Ixeshe can list running processes.[122]
S0528 Javali

Javali can monitor processes for open browsers and custom banking applications.[123]
S0044 JHUHUGIT

JHUHUGIT obtains a list of running processes on the victim.[124][125]
S0201 JPIN

JPIN can list running processes.[126]
S0283 jRAT

jRAT can query and kill system processes.[127]
S0088 Kasidet

Kasidet has the ability to search for a given process name in processes currently running in the system.[128]
S0265 Kazuar

Kazuar obtains a list of running processes through WMI querying and the ps command.[129]
G0004 Ke3chang

Ke3chang performs process discovery using tasklist commands.[130][131]
S0271 KEYMARBLE

KEYMARBLE can obtain a list of running processes on the system.[132]
S0607 KillDisk

KillDisk has called GetCurrentProcess.[133]
G0094 Kimsuky

Kimsuky can gather a list of all processes running on a victim's machine.[134]
S0599 Kinsing

Kinsing has used ps to list processes.[135]
S0162 Komplex

The OsInfo function in Komplex collects a running process list.[136]
S0356 KONNI

KONNI has used the command cmd /c tasklist to get a snapshot of the current processes on the target machine.[137][138]
S0236 Kwampirs

Kwampirs collects a list of running services with the command tasklist /v.[139]
G0032 Lazarus Group

Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by Lazarus Group also gathers process times.[140][141][142][143][65][144]
S0211 Linfo

Linfo creates a backdoor through which remote attackers can retrieve a list of running processes.[145]
S0681 Lizar

Lizar has a plugin designed to obtain a list of processes.[146][147]
S0582 LookBack

LookBack can list running processes.[148]
S0451 LoudMiner

LoudMiner used the ps command to monitor the running processes on the system.[149]

S0532 Lucifer

Lucifer can identify the process that owns remote connections.[150]
S0409 Machete

Machete has a component to check for running processes to look for web browsers.[151]

G0059 Magic Hound

Magic Hound malware can list running processes.[152]
S0652 MarkiRAT

MarkiRAT can search for different processes on a system.[153]
S0449 Maze

Maze has gathered all of the running system processes.[154]

S0455 Metamorfo

Metamorfo has performed process name checks and has monitored applications.[155]

S0688 Meteor

Meteor can check if a specific process is running, such as Kaspersky's avp.exe.[156]
S0079 MobileOrder

MobileOrder has a command to upload information about all running processes to its C2 server.[157]
G0021 Molerats

Molerats actors obtained a list of active processes on the victim and sent them to C2 servers.[78]
S0149 MoonWind

MoonWind has a command to return a list of running processes.[158]
S0256 Mosquito

Mosquito runs tasklist to obtain running processes.[159]
G0069 MuddyWater

MuddyWater has used malware to obtain a list of running processes on the system.[160][161]
G0129 Mustang Panda

Mustang Panda has used tasklist /v to determine active process information.[162]

S0247 NavRAT

NavRAT uses tasklist /v to check running processes.[163]
S0630 Nebulae

Nebulae can enumerate processes on a target system.[164]
S0034 NETEAGLE

NETEAGLE can send process listings over the C2 channel.[26]
S0198 NETWIRE

NETWIRE can discover processes on compromised hosts.[165]
S0385 njRAT

njRAT can search a list of running processes for Tr.exe.[166]
S0644 ObliqueRAT

ObliqueRAT can check for blocklisted process names on a compromised host.[167]
S0346 OceanSalt

OceanSalt can collect the name and ID for every process running on the system.[168]
G0049 OilRig

OilRig has run tasklist on a victim's machine.[169]
G0116 Operation Wocao

Operation Wocao has collected a list of running processes on the infected system.[170]
S0229 Orz

Orz can gather a process list from the victim.[171]
S0626 P8RAT

P8RAT can check for specific processes associated with virtual environments.[172]
S0664 Pandora

Pandora can monitor processes on a compromised host.[173]
S0208 Pasam

Pasam creates a backdoor through which remote attackers can retrieve lists of running processes.[174]
S0517 Pillowmint

Pillowmint can iterate through running processes every six seconds collecting a list of processes to capture from later.[175]

S0501 PipeMon

PipeMon can iterate over the running processes to find a suitable injection target.[176]
S0254 PLAINTEE

PLAINTEE performs the tasklist command to list running processes.[177]
S0435 PLEAD

PLEAD has the ability to list processes on the compromised host.[178]
S0013 PlugX

PlugX has a module to list the processes running on a machine.[179]
S0428 PoetRAT

PoetRAT has the ability to list all running processes.[180]
S0216 POORAIM

POORAIM can enumerate processes.[181]
G0033 Poseidon Group

After compromising a victim, Poseidon Group lists all running processes.[182]
S0139 PowerDuke

PowerDuke has a command to list the victim's processes.[183]
S0441 PowerShower

PowerShower has the ability to deploy a reconnaissance module to retrieve a list of the active processes.[184]
S0194 PowerSploit

PowerSploit's Get-ProcessTokenPrivilege Privesc-PowerUp module can enumerate privileges for a given process.[185][186]
S0393 PowerStallion

PowerStallion has been used to monitor process lists.[187]
S0223 POWERSTATS

POWERSTATS has used get_tasklist to discover processes on the compromised host.[188]
S0184 POWRUNER

POWRUNER may collect process information by running tasklist on a victim.[189]
S0238 Proxysvc

Proxysvc lists processes running on the system.[143]
S0192 Pupy

Pupy can list the running processes and get the process ID and parent process’s ID.[190]
S0650 QakBot

QakBot has the ability to check running processes.[191]
S0629 RainyDay

RainyDay can enumerate processes on a target system.[164]
S0458 Ramsay

Ramsay can gather a list of running processes by using Tasklist.[192]
S0241 RATANKBA

RATANKBA lists the system’s processes.[193][194]
S0662 RCSession

RCSession can identify processes based on PID.[195]
S0125 Remsec

Remsec can obtain a process list from the victim.[196]
S0448 Rising Sun

Rising Sun can enumerate all running processes and process information on an infected machine.[197]

G0106 Rocke

Rocke can detect a running process's PID on the infected machine.[198]

S0270 RogueRobin

RogueRobin checks the running processes for evidence it may be running in a sandbox environment. It specifically enumerates processes for Wireshark and Sysinternals.[199]
S0240 ROKRAT

ROKRAT can list the current running processes on the system.[200][201]
S0148 RTM

RTM can obtain information about process integrity levels.[202]
S0446 Ryuk

Ryuk has called CreateToolhelp32Snapshot to enumerate all running processes.[203]
S0345 Seasalt

Seasalt has a command to perform a process listing.[31]
S0596 ShadowPad

ShadowPad has collected the PID of a malicious process.[204]
S0445 ShimRatReporter

ShimRatReporter listed all running processes on the machine.[205]
S0063 SHOTPUT

SHOTPUT has a command to obtain a process listing.[206]
G0121 Sidewinder

Sidewinder has used tools to identify running processes on the victim's machine.[207]
S0692 SILENTTRINITY

SILENTTRINITY can enumerate processes, including properties to determine if they have the Common Language Runtime (CLR) loaded.[208]
S0468 Skidmap

Skidmap has monitored critical processes to ensure resiliency.[209]

S0533 SLOTHFULMEDIA

SLOTHFULMEDIA has enumerated processes by ID, name, or privileges.[210]

S0273 Socksbot

Socksbot can list all running processes.[211]
S0627 SodaMaster

SodaMaster can search a list of running processes.[172]
S0615 SombRAT

SombRAT can use the getprocesslist command to enumerate processes on a compromised host.[212][111][213]
S0516 SoreFang

SoreFang can enumerate processes on a victim machine through use of Tasklist.[214]
G0038 Stealth Falcon

Stealth Falcon malware gathers a list of running processes.[215]
S0142 StreamEx

StreamEx has the ability to enumerate processes.[216]
S0491 StrongPity

StrongPity can determine if a user is logged in by checking to see if explorer.exe is running.[217]
S0559 SUNBURST

SUNBURST collected a list of process names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.[218]
S0562 SUNSPOT

SUNSPOT monitored running processes for instances of MsBuild.exe by hashing the name of each running process and comparing it to the corresponding value 0x53D525. It also extracted command-line arguments and individual arguments from the running MsBuild.exe process to identify the directory path of the Orion software Visual Studio solution.[219]
S0018 Sykipot

Sykipot may gather a list of running processes by running tasklist /v.[220]
S0242 SynAck

SynAck enumerates all running processes.[221][222]
S0464 SYSCON

SYSCON has the ability to use Tasklist to list running processes.[223]
S0011 Taidoor

Taidoor can use GetCurrentProcessId for process discovery.[224]
S0586 TAINTEDSCRIBE

TAINTEDSCRIBE can execute ProcessList for process discovery.[225]
S0467 TajMahal

TajMahal has the ability to identify running processes and associated plugins on an infected host.[226]
S0057 Tasklist

Tasklist can be used to discover processes running on a system.[227]
G0139 TeamTNT

TeamTNT searches for rival malware and removes them if found.[228]
S0595 ThiefQuest

ThiefQuest obtains a list of running processes using the function kill_unwanted.[229]
S0266 TrickBot

TrickBot uses module networkDll for process list discovery.[230][231]
S0094 Trojan.Karagany

Trojan.Karagany can use Tasklist to collect a list of running tasks.[25][232]
G0081 Tropic Trooper

Tropic Trooper is capable of enumerating the running processes on the system using pslist.[233][234]
S0436 TSCookie

TSCookie has the ability to list processes on the infected host.[235]
G0010 Turla

Turla surveys a system upon check-in to discover running processes using the tasklist /v command.[87] Turla RPC backdoors have also enumerated processes associated with specific open ports or named pipes.[187]
S0333 UBoatRAT

UBoatRAT can list running processes on the system.[236]
S0386 Ursnif

Ursnif has gathered information about running processes.[237][238]
S0452 USBferry

USBferry can use tasklist to gather information about the process running on the infected system.[234]

S0476 Valak

Valak has the ability to enumerate running processes on a compromised host.[239]
S0257 VERMIN

VERMIN can get a list of the processes and running tasks on the system.[240]
S0180 Volgmer

Volgmer can gather a list of processes.[241]
S0670 WarzoneRAT

WarzoneRAT can obtain a list of processes on a compromised host.[242]
S0579 Waterbear

Waterbear can identify the process for a specific security product.[243]
G0112 Windshift

Windshift has used malware to enumerate active processes.[244]
S0219 WINERACK

WINERACK can enumerate processes.[181]
S0059 WinMM

WinMM sets a WH_CBT Windows hook to collect information on process creation.[245]
S0141 Winnti for Windows

Winnti for Windows can check if the explorer.exe process is responsible for calling its install function.[246]
G0044 Winnti Group

Winnti Group looked for a specific process running on infected servers.[247]
S0161 XAgentOSX

XAgentOSX contains the getProcessList function to run ps aux to get running processes.[248]
S0248 yty

yty gets an output of running processes using the tasklist command.[249]
S0251 Zebrocy

Zebrocy uses the tasklist and wmic process get Capture, ExecutablePath commands to gather the processes running on the system.[44][250][45][251][252]
S0330 Zeus Panda

Zeus Panda checks for running processes on the victim’s machine.[253]
S0672 Zox

Zox has the ability to list processes.[254]
S0412 ZxShell

ZxShell has a command, ps, to obtain a listing of processes on the system.[255]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

ID Data Source Data Component
DS0017 Command Command Execution
DS0009 Process OS API Execution
Process Creation

System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

Normal, benign system and network events that look like process discovery may be uncommon, depending on the environment and how they are used. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.

References

  1. Crowdstrike Global Intelligence Team. (2014, June 9). CrowdStrike Intelligence Report: Putter Panda. Retrieved January 22, 2016.
  2. ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.
  3. Zhang, X. (2017, June 28). In-Depth Analysis of A New Variant of .NET Malware AgentTesla. Retrieved November 5, 2018.
  4. Park, S. (2021, June 15). Andariel evolves to target South Korea with ransomware. Retrieved September 29, 2021.
  5. Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021.
  6. Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.
  7. Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017.
  8. Cash, D. et al. (2020, December 14). Dark Halo Leverages SolarWinds Compromise to Breach Organizations. Retrieved December 29, 2020.
  9. MSTIC, CDOC, 365 Defender Research Team. (2021, January 20). Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop . Retrieved January 22, 2021.
  10. CrowdStrike. (2022, January 27). Early Bird Catches the Wormhole: Observations from the StellarParticle Campaign. Retrieved February 7, 2022.
  11. Chen, X., Scott, M., Caselden, D.. (2014, April 26). New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks. Retrieved January 14, 2016.
  12. Yates, M. (2017, June 18). APT3 Uncovered: The code evolution of Pirpi. Retrieved September 28, 2017.
  13. Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.
  14. FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 6, 2018.
  15. CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.
  16. Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.
  17. Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.
  18. Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.
  19. Yan, T., et al. (2018, November 21). New Wine in Old Bottle: New Azorult Variant Found in FindMyName Campaign using Fallout Exploit Kit. Retrieved November 29, 2018.
  20. Proofpoint. (2018, July 30). New version of AZORult stealer improves loading features, spreads alongside ransomware in new campaign. Retrieved November 29, 2018.
  21. Sogeti. (2021, March). Babuk Ransomware. Retrieved August 11, 2021.
  22. Mundo, A. et al. (2021, February). Technical Analysis of Babuk Ransomware. Retrieved August 11, 2021.
  23. Centero, R. et al. (2021, February 5). New in Ransomware: Seth-Locker, Babuk Locker, Maoloa, TeslaCrypt, and CobraLocker. Retrieved August 11, 2021.
  24. Unit 42. (2019, February 22). New BabyShark Malware Targets U.S. National Security Think Tanks. Retrieved October 7, 2019.
  25. Symantec Security Response. (2014, July 7). Dragonfly: Cyberespionage Attacks Against Energy Suppliers. Retrieved April 8, 2016.
  26. FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved May 1, 2015.
  27. Mamedov, O. Sinitsyn, F. Ivanov, A.. (2017, October 24). Bad Rabbit ransomware. Retrieved January 28, 2021.
  28. Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.
  29. Cybereason Nocturnus. (2020, July 16). A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES. Retrieved November 18, 2020.
  30. Lee, B. Grunzweig, J. (2015, December 22). BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger. Retrieved August 19, 2016.
  31. Mandiant. (n.d.). Appendix C (Digital) - The Malware Arsenal. Retrieved July 18, 2016.
  32. Hayashi, K., Ray, V. (2018, July 31). Bisonal Malware Used in Attacks Against Russia and South Korea. Retrieved August 7, 2018.
  33. Zykov, K. (2020, August 13). CactusPete APT group’s updated Bisonal backdoor. Retrieved May 5, 2021.
  34. Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022.
  35. FireEye Labs/FireEye Threat Intelligence. (2015, May 14). Hiding in Plain Sight: FireEye and Microsoft Expose Obfuscation Tactic. Retrieved January 22, 2016.
  36. F-Secure Labs. (2014). BlackEnergy & Quedagh: The convergence of crimeware and APT attacks. Retrieved March 24, 2016.
  37. Baumgartner, K. and Garnaeva, M.. (2014, November 3). BE2 custom plugins, router abuse, and target profiles. Retrieved March 24, 2016.
  38. Cherepanov, A.. (2016, January 3). BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry . Retrieved June 10, 2020.
  39. Cash, D., Grunzweig, J., Meltzer, M., Adair, S., Lancaster, T. (2021, August 17). North Korean APT InkySquid Infects Victims Using Browser Exploits. Retrieved September 30, 2021.
  40. Dumont, R., M.Léveillé, M., Porcher, H. (2018, December 1). THE DARK SIDE OF THE FORSSHE A landscape of OpenSSH backdoors. Retrieved July 16, 2020.
  41. Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018.
  42. Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.
  43. Threat Intelligence Team. (2022, March 18). Double header: IsaacWiper and CaddyWiper . Retrieved April 11, 2022.
  44. Falcone, R., Lee, B. (2018, November 20). Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan. Retrieved November 26, 2018.
  45. Lee, B., Falcone, R. (2018, December 12). Dear Joohn: The Sofacy Group’s Global Campaign. Retrieved April 19, 2019.
  46. Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018.
  47. Trusteer Fraud Prevention Center. (2010, October 7). Carberp Under the Hood of Carberp: Malware & Configuration Analysis. Retrieved July 15, 2020.
  48. ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.
  49. Grunzweig, J.. (2017, April 20). Cardinal RAT Active for Over Two Years. Retrieved December 8, 2018.
  50. ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021.
  51. Check Point. (2022, January 11). APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit. Retrieved January 24, 2022.
  52. Miller-Osborn, J. and Grunzweig, J.. (2017, February 16). menuPass Returns with New Malware and New Attacks Against Japanese Academics and Organizations. Retrieved March 1, 2017.
  53. Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved January 19, 2021.
  54. Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.
  55. Mundo, A. (2019, August 1). Clop Ransomware. Retrieved May 10, 2021.
  56. Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017.
  57. Mavis, N. (2020, September 21). The Art and Science of Detecting Cobalt Strike. Retrieved April 6, 2021.
  58. Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021.
  59. Grunzweig, J. (2018, January 31). Comnie Continues to Target Organizations in East Asia. Retrieved June 7, 2018.
  60. Baskin, B. (2020, July 8). TAU Threat Discovery: Conti Ransomware. Retrieved February 17, 2021.
  61. Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.
  62. Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.
  63. Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.
  64. NCSC. (2022, February 23). Cyclops Blink Malware Analysis Report. Retrieved March 3, 2022.
  65. Mabutas, G. (2020, May 11). New MacOS Dacls RAT Backdoor Shows Lazarus’ Multi-Platform Attack Capability. Retrieved August 10, 2020.
  66. Kujawa, A. (2018, March 27). You dirty RAT! Part 1: DarkComet. Retrieved November 6, 2018.
  67. Kaspersky Lab's Global Research & Analysis Team. (2015, August 10). Darkhotel's attacks in 2015. Retrieved November 2, 2018.
  68. Alperovitch, D. (2014, July 7). Deep in Thought: Chinese Targeting of National Security Think Tanks. Retrieved November 12, 2014.
  69. Fidelis Cybersecurity. (2016, February 29). The Turbo Campaign, Featuring Derusbi for 64-bit Linux. Retrieved March 2, 2016.
  70. FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.
  71. Neeamni, D., Rubinfeld, A.. (2021, July 1). Diavol - A New Ransomware Used By Wizard Spider?. Retrieved November 12, 2021.
  72. Fishbein, N., Kajiloti, M.. (2020, July 28). Watch Your Containers: Doki Infecting Docker Servers in the Cloud. Retrieved March 30, 2021.
  73. TheWover. (2019, May 9). donut. Retrieved March 25, 2022.
  74. ClearSky Research Team. (2020, August 13). Operation 'Dream Job' Widespread North Korean Espionage Campaign. Retrieved December 20, 2021.
  75. Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.
  76. Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.
  77. Symantec Security Response. (2011, November). W32.Duqu: The precursor to the next Stuxnet. Retrieved September 17, 2015.
  78. ClearSky. (2016, January 7). Operation DustySky. Retrieved January 8, 2016.
  79. GReAT. (2019, April 10). Gaza Cybergang Group1, operation SneakyPastes. Retrieved May 13, 2020.
  80. Dragos. (2020, February 3). EKANS Ransomware and ICS Operations. Retrieved February 9, 2021.
  81. Zafra, D., et al. (2020, February 24). Ransomware Against the Machine: How Adversaries are Learning to Disrupt Industrial Production by Targeting IT and OT. Retrieved March 2, 2021.
  82. Singleton, C. and Kiefer, C. (2020, September 28). Ransomware 2020: Attack Trends Affecting Organizations Worldwide. Retrieved September 20, 2021.
  83. Accenture Security. (2018, January 27). DRAGONFISH DELIVERS NEW FORM OF ELISE MALWARE TARGETING ASEAN DEFENCE MINISTERS’ MEETING AND ASSOCIATES. Retrieved November 14, 2018.
  84. Winters, R.. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016.
  85. ASEC. (2017). ASEC REPORT VOL.88. Retrieved April 16, 2019.
  86. Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.
  87. Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.
  88. Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.
  89. Marschalek, M.. (2014, December 16). EvilBunny: Malware Instrumented By Lua. Retrieved June 28, 2019.
  90. Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.
  91. Cherepanov, A. (2018, October). GREYENERGY A successor to BlackEnergy. Retrieved November 15, 2018.
  92. Grunzweig, J. (2018, October 01). NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT. Retrieved November 5, 2018.
  93. FinFisher. (n.d.). Retrieved December 20, 2017.
  94. Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.
  95. Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.
  96. Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.
  97. Kremez, V. (2019, September 19). FIN6 “FrameworkPOS”: Point-of-Sale Malware Analysis & Internals. Retrieved September 8, 2020.
  98. Adamitis, D. et al. (2019, June 4). It's alive: Threat actors cobble together open-source pieces into monstrous Frankenstein campaign. Retrieved May 11, 2020.
  99. Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.
  100. Doctor Web. (2014, November 21). Linux.BackDoor.Fysbis.1. Retrieved December 7, 2017.
  101. Symantec. (2022, January 31). Shuckworm Continues Cyber-Espionage Attacks Against Ukraine. Retrieved February 17, 2022.
  102. Unit 42. (2022, February 3). Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine. Retrieved February 21, 2022.
  103. Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.
  104. F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015.
  105. Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.
  106. FireEye Threat Intelligence. (2015, July 13). Demonstrating Hustle, Chinese APT Groups Quickly Use Zero-Day Vulnerability (CVE-2015-5119) Following Hacking Team Leak. Retrieved January 25, 2016.
  107. Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.
  108. ESET. (2020, April 28). Grandoreiro: How engorged can an EXE get?. Retrieved November 13, 2020.
  109. Mercer, W., Rascagneres, P. (2018, April 26). GravityRAT - The Two-Year Evolution Of An APT Targeting India. Retrieved May 16, 2018.
  110. Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing LNK. Retrieved April 24, 2017.
  111. McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.
  112. Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.
  113. Sherstobitoff, R. (2018, March 02). McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups. Retrieved May 16, 2018.
  114. Knight, S.. (2020, April 16). VMware Carbon Black TAU Threat Analysis: The Evolution of Lazarus. Retrieved May 1, 2020.
  115. Symantec Security Response. (2010, January 18). The Trojan.Hydraq Incident. Retrieved February 20, 2018.
  116. Lelli, A. (2010, January 11). Trojan.Hydraq. Retrieved February 20, 2018.
  117. Unit 42. (2019, December 2). Imminent Monitor – a RAT Down Under. Retrieved May 5, 2020.
  118. Symantec. (2018, March 14). Inception Framework: Alive and Well, and Hiding Behind Proxies. Retrieved May 8, 2020.
  119. Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.
  120. Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.
  121. Reichel, D. (2021, February 19). IronNetInjector: Turla’s New Malware Loading Tool. Retrieved February 24, 2021.
  122. Sancho, D., et al. (2012, May 22). IXESHE An APT Campaign. Retrieved June 7, 2019.
  123. GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.
  124. ESET. (2016, October). En Route with Sednit - Part 1: Approaching the Target. Retrieved November 8, 2016.
  125. Lee, B, et al. (2018, February 28). Sofacy Attacks Multiple Government Entities. Retrieved March 15, 2018.
  126. Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
  127. Bingham, J. (2013, February 11). Cross-Platform Frutas RAT Builder and Back Door. Retrieved April 23, 2019.
  128. Yadav, A., et al. (2016, January 29). Malicious Office files dropping Kasidet and Dridex. Retrieved March 24, 2016.
  1. Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.
  2. Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.
  3. Smallridge, R. (2018, March 10). APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS. Retrieved April 4, 2018.
  4. US-CERT. (2018, August 09). MAR-10135536-17 – North Korean Trojan: KEYMARBLE. Retrieved August 16, 2018.
  5. Gilbert Sison, Rheniel Ramos, Jay Yaneza, Alfredo Oliveira. (2018, January 15). KillDisk Variant Hits Latin American Financial Groups. Retrieved January 12, 2021.
  6. An, J and Malhotra, A. (2021, November 10). North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets. Retrieved December 29, 2021.
  7. Singer, G. (2020, April 3). Threat Alert: Kinsing Malware Attacks Targeting Container Environments. Retrieved April 1, 2021.
  8. Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26). Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.
  9. Karmi, D. (2020, January 4). A Look Into Konni 2019 Campaign. Retrieved April 28, 2020.
  10. Threat Intelligence Team. (2021, August 23). New variant of Konni malware used in campaign targetting Russia. Retrieved January 5, 2022.
  11. Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.
  12. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.
  13. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Loaders, Installers and Uninstallers Report. Retrieved March 2, 2016.
  14. Sherstobitoff, R. (2018, February 12). Lazarus Resurfaces, Targets Global Banks and Bitcoin Users. Retrieved February 19, 2018.
  15. Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.
  16. Saini, A. and Hossein, J. (2022, January 27). North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign. Retrieved January 27, 2022.
  17. Zhou, R. (2012, May 15). Backdoor.Linfo. Retrieved February 23, 2018.
  18. Seals, T.. (2021, May 14). FIN7 Backdoor Masquerades as Ethical Hacking Tool. Retrieved February 2, 2022.
  19. BI.ZONE Cyber Threats Research Team. (2021, May 13). From pentest to APT attack: cybercriminal group FIN7 disguises its malware as an ethical hacker’s toolkit. Retrieved February 2, 2022.
  20. Raggi, M. Schwarz, D.. (2019, August 1). LookBack Malware Targets the United States Utilities Sector with Phishing Attacks Impersonating Engineering Licensing Boards. Retrieved February 25, 2021.
  21. Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.
  22. Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.
  23. ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019.
  24. Lee, B. and Falcone, R. (2017, February 15). Magic Hound Campaign Attacks Saudi Targets. Retrieved December 27, 2017.
  25. GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.
  26. Mundo, A. (2020, March 26). Ransomware Maze. Retrieved May 18, 2020.
  27. Erlich, C. (2020, April 3). The Avast Abuser: Metamorfo Banking Malware Hides By Abusing Avast Executable. Retrieved May 26, 2020.
  28. Check Point Research Team. (2021, August 14). Indra - Hackers Behind Recent Attacks on Iran. Retrieved February 17, 2022.
  29. Falcone, R. and Miller-Osborn, J.. (2016, January 24). Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists. Retrieved February 10, 2016.
  30. Miller-Osborn, J. and Grunzweig, J.. (2017, March 30). Trochilus and New MoonWind RATs Used In Attack Against Thai Organizations. Retrieved March 30, 2017.
  31. ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.
  32. Kaspersky Lab's Global Research & Analysis Team. (2018, October 10). MuddyWater expands operations. Retrieved November 2, 2018.
  33. ClearSky. (2019, June). Iranian APT group ‘MuddyWater’ Adds Exploits to Their Arsenal. Retrieved May 14, 2020.
  34. Hamzeloofard, S. (2020, January 31). New wave of PlugX targets Hong Kong | Avira Blog. Retrieved April 13, 2021.
  35. Mercer, W., Rascagneres, P. (2018, May 31). NavRAT Uses US-North Korea Summit As Decoy For Attacks In South Korea. Retrieved June 11, 2018.
  36. Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.
  37. Maniath, S. and Kadam P. (2019, March 19). Dissecting a NETWIRE Phishing Campaign's Usage of Process Hollowing. Retrieved January 7, 2021.
  38. Pascual, C. (2018, November 27). AutoIt-Compiled Worm Affecting Removable Media Delivers Fileless Version of BLADABINDI/njRAT Backdoor. Retrieved June 4, 2019.
  39. Malhotra, A. (2021, March 2). ObliqueRAT returns with new campaign using hijacked websites. Retrieved September 2, 2021.
  40. Sherstobitoff, R., Malhotra, A. (2018, October 18). ‘Operation Oceansalt’ Attacks South Korea, U.S., and Canada With Source Code From Chinese Hacker Group. Retrieved November 30, 2018.
  41. Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.
  42. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.
  43. Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.
  44. GREAT. (2021, March 30). APT10: sophisticated multi-layered loader Ecipekac discovered in A41APT campaign. Retrieved June 17, 2021.
  45. Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.
  46. Mullaney, C. & Honda, H. (2012, May 4). Trojan.Pasam. Retrieved February 22, 2018.
  47. Trustwave SpiderLabs. (2020, June 22). Pillowmint: FIN7’s Monkey Thief . Retrieved July 27, 2020.
  48. Tartare, M. et al. (2020, May 21). No “Game over” for the Winnti Group. Retrieved August 24, 2020.
  49. Ash, B., et al. (2018, June 26). RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families. Retrieved July 2, 2018.
  50. Bermejo, L., et al. (2017, June 22). Following the Trail of BlackTech’s Cyber Espionage Campaigns. Retrieved May 5, 2020.
  51. Computer Incident Response Center Luxembourg. (2013, March 29). Analysis of a PlugX variant. Retrieved November 5, 2018.
  52. Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.
  53. FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved March 1, 2018.
  54. Kaspersky Lab's Global Research and Analysis Team. (2016, February 9). Poseidon Group: a Targeted Attack Boutique specializing in global cyber-espionage. Retrieved March 16, 2016.
  55. Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
  56. GReAT. (2019, August 12). Recent Cloud Atlas activity. Retrieved May 8, 2020.
  57. PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.
  58. PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.
  59. Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.
  60. Lunghi, D. and Horejsi, J.. (2019, June 10). MuddyWater Resurfaces, Uses Multi-Stage Backdoor POWERSTATS V3 and New Post-Exploitation Tools. Retrieved May 14, 2020.
  61. Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017.
  62. Nicolas Verdier. (n.d.). Retrieved January 29, 2018.
  63. Morrow, D. (2021, April 15). The rise of QakBot. Retrieved September 27, 2021.
  64. Antiy CERT. (2020, April 20). Analysis of Ramsay components of Darkhotel's infiltration and isolation network. Retrieved March 24, 2021.
  65. Lei, C., et al. (2018, January 24). Lazarus Campaign Targeting Cryptocurrencies Reveals Remote Controller Tool, an Evolved RATANKBA, and More. Retrieved May 22, 2018.
  66. Trend Micro. (2017, February 27). RATANKBA: Delving into Large-scale Watering Holes against Enterprises. Retrieved May 22, 2018.
  67. Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.
  68. Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.
  69. Sherstobitoff, R., Malhotra, A., et. al.. (2018, December 18). Operation Sharpshooter Campaign Targets Global Defense, Critical Infrastructure. Retrieved May 14, 2020.
  70. Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With a New Malware Family Written in Golang. Retrieved April 24, 2019.
  71. Falcone, R., et al. (2018, July 27). New Threat Actor Group DarkHydrus Targets Middle East Government. Retrieved August 2, 2018.
  72. Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018.
  73. Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020.
  74. Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.
  75. Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020.
  76. Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.
  77. Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.
  78. Falcone, R. and Wartell, R.. (2015, July 27). Observations on CVE-2015-3113, Prior Zero-Days and the Pirpi Payload. Retrieved January 22, 2016.
  79. Hegel, T. (2021, January 13). A Global Perspective of the SideWinder APT. Retrieved January 27, 2021.
  80. Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022.
  81. Remillano, A., Urbanec, J. (2019, September 19). Skidmap Linux Malware Uses Rootkit Capabilities to Hide Cryptocurrency-Mining Payload. Retrieved June 4, 2020.
  82. DHS/CISA, Cyber National Mission Force. (2020, October 1). Malware Analysis Report (MAR) MAR-10303705-1.v1 – Remote Access Trojan: SLOTHFULMEDIA. Retrieved October 2, 2020.
  83. Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.
  84. The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.
  85. CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.
  86. CISA. (2020, July 16). MAR-10296782-1.v1 – SOREFANG. Retrieved September 29, 2020.
  87. Marczak, B. and Scott-Railton, J.. (2016, May 29). Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents. Retrieved June 8, 2016.
  88. Cylance SPEAR Team. (2017, February 9). Shell Crew Variants Continue to Fly Under Big AV’s Radar. Retrieved February 15, 2017.
  89. Mercer, W. et al. (2020, June 29). PROMETHIUM extends global reach with StrongPity3 APT. Retrieved July 20, 2020.
  90. FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.
  91. CrowdStrike Intelligence Team. (2021, January 11). SUNSPOT: An Implant in the Build Process. Retrieved January 11, 2021.
  92. Blasco, J. (2011, December 12). Another Sykipot sample likely targeting US federal agencies. Retrieved March 28, 2016.
  93. Ivanov, A. et al.. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
  94. Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.
  95. McCabe, A. (2020, January 23). The Fractured Statue Campaign: U.S. Government Agency Targeted in Spear-Phishing Attacks. Retrieved June 2, 2020.
  96. CISA, FBI, DOD. (2021, August). MAR-10292089-1.v2 – Chinese Remote Access Trojan: TAIDOOR. Retrieved August 24, 2021.
  97. USG. (2020, May 12). MAR-10288834-2.v1 – North Korean Trojan: TAINTEDSCRIBE. Retrieved March 5, 2021.
  98. GReAT. (2019, April 10). Project TajMahal – a sophisticated new APT framework. Retrieved October 14, 2019.
  99. Microsoft. (n.d.). Tasklist. Retrieved December 23, 2015.
  100. Fiser, D. Oliveira, A. (n.d.). Tracking the Activities of TeamTNT A Closer Look at a Cloud-Focused Malicious Actor Group. Retrieved September 22, 2021.
  101. Patrick Wardle. (2020, June 29). OSX.EvilQuest Uncovered part i: infection, persistence, and more!. Retrieved March 18, 2021.
  102. Boutin, J. (2020, October 12). ESET takes part in global operation to disrupt Trickbot. Retrieved March 15, 2021.
  103. Tudorica, R., Maximciuc, A., Vatamanu, C. (2020, March 18). New TrickBot Module Bruteforces RDP Connections, Targets Select Telecommunication Services in US and Hong Kong. Retrieved March 15, 2021.
  104. Secureworks. (2019, July 24). Updated Karagany Malware Targets Energy Sector. Retrieved August 12, 2020.
  105. Ray, V. (2016, November 22). Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy. Retrieved November 9, 2018.
  106. Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.
  107. Tomonaga, S.. (2018, March 6). Malware “TSCookie”. Retrieved May 6, 2020.
  108. Hayashi, K. (2017, November 28). UBoatRAT Navigates East Asia. Retrieved January 12, 2018.
  109. Caragay, R. (2015, March 26). URSNIF: The Multifaceted Malware. Retrieved June 5, 2019.
  110. Sioting, S. (2013, June 15). BKDR_URSNIF.SM. Retrieved June 5, 2019.
  111. Salem, E. et al. (2020, May 28). VALAK: MORE THAN MEETS THE EYE . Retrieved June 19, 2020.
  112. Lancaster, T., Cortes, J. (2018, January 29). VERMIN: Quasar RAT and Custom Malware Used In Ukraine. Retrieved July 5, 2018.
  113. Yagi, J. (2014, August 24). Trojan.Volgmer. Retrieved July 16, 2018.
  114. Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.
  115. Su, V. et al. (2019, December 11). Waterbear Returns, Uses API Hooking to Evade Security. Retrieved February 22, 2021.
  116. The BlackBerry Research & Intelligence Team. (2020, October). BAHAMUT: Hack-for-Hire Masters of Phishing, Fake News, and Fake Apps. Retrieved February 8, 2021.
  117. Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved April 10, 2019.
  118. Novetta Threat Research Group. (2015, April 7). Winnti Analysis. Retrieved February 8, 2017.
  119. Kaspersky Lab's Global Research and Analysis Team. (2013, April 11). Winnti. More than just a game. Retrieved February 8, 2017.
  120. Robert Falcone. (2017, February 14). XAgentOSX: Sofacy's Xagent macOS Tool. Retrieved July 12, 2017.
  121. Schwarz, D., Sopko J. (2018, March 08). Donot Team Leverages New Modular Malware Framework in South Asia. Retrieved June 11, 2018.
  122. ESET. (2018, November 20). Sednit: What’s going on with Zebrocy?. Retrieved February 12, 2019.
  123. ESET Research. (2019, May 22). A journey to Zebrocy land. Retrieved June 20, 2019.
  124. Accenture Security. (2018, November 29). SNAKEMACKEREL. Retrieved April 15, 2019.
  125. Ebach, L. (2017, June 22). Analysis Results of Zeus.Variant.Panda. Retrieved November 5, 2018.
  126. Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
  127. Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.