1. Home
  2. Techniques
  3. Enterprise
  4. Indicator Removal on Host
  5. File Deletion

Indicator Removal on Host: File Deletion

ID Name
T1070.001 Clear Windows Event Logs
T1070.002 Clear Linux or Mac System Logs
T1070.003 Clear Command History
T1070.004 File Deletion
T1070.005 Network Share Connection Removal
T1070.006 Timestomp

Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well.[1] Examples of built-in Command and Scripting Interpreter functions include del on Windows and rm or unlink on Linux and macOS.

ID: T1070.004
Sub-technique of:  T1070
ⓘ
Tactic: Defense Evasion
ⓘ
Platforms: Linux, Windows, macOS
ⓘ
Defense Bypassed: Host forensic analysis
Contributors: Walker Johnson
Version: 1.1
Created: 31 January 2020
Last Modified: 16 April 2022

Procedure Examples

ID Name Description
S0045 ADVSTORESHELL

ADVSTORESHELL can delete files and directories.[2]
S0504 Anchor

Anchor can self delete its dropper after the malware is successfully deployed.[3]
S0584 AppleJeus

AppleJeus has deleted the MSI file after installation.[4]
S0622 AppleSeed

AppleSeed can delete files from a compromised host after they are exfiltrated.[5]
G0026 APT18

APT18 actors deleted tools and batch files from victim systems.[6]
G0007 APT28

APT28 has intentionally deleted computer files to cover their tracks, including with use of the program CCleaner.[7]
G0016 APT29

APT29 routinely removed their tools, including custom backdoors, once remote access was achieved. APT29 has also used SDelete to remove artifacts from victims.[8][9]
G0022 APT3

APT3 has a tool that can delete files.[10]
G0050 APT32

APT32's macOS backdoor can receive a "delete" command.[11]
G0082 APT38

APT38 has used a utility called CLOSESHAVE that can securely delete a file from the system. They have also removed malware, tools, or other non-native files used during the intrusion to reduce their footprint or as part of the post-intrusion cleanup process.[12][13]
G0087 APT39

APT39 has used malware to delete files after they are deployed on a compromised host.[14]
G0096 APT41

APT41 deleted files from the system.[15]

G0143 Aquatic Panda

Aquatic Panda has deleted malicious executables from compromised machines.[16]
S0456 Aria-body

Aria-body has the ability to delete files and directories on compromised hosts.[17]
S0438 Attor

Attor’s plugin deletes the collected files and log files after exfiltration.[18]
S0347 AuditCred

AuditCred can delete files from the system.[19]
S0344 Azorult

Azorult can delete files from victim machines.[20]
S0414 BabyShark

BabyShark has cleaned up all files associated with the secondary payload execution.[21]
S0475 BackConfig

BackConfig has the ability to remove files and folders related to previous infections.[22]
S0093 Backdoor.Oldrea

Backdoor.Oldrea contains a cleanup module that removes traces of itself from the victim.[23]
S0234 Bandook

Bandook has a command to delete a file.[24]
S0239 Bankshot

Bankshot marks files to be deleted upon the next system reboot and uninstalls and removes itself from the system.[25]
S0534 Bazar

Bazar can delete its loader using a batch file in the Windows temporary folder.[26]
S0127 BBSRAT

BBSRAT can delete files and directories.[27]
S0268 Bisonal

Bisonal will delete its dropper and VBS scripts from the victim’s machine.[28][29][30]
S0069 BLACKCOFFEE

BLACKCOFFEE has the capability to delete files.[31]
S0520 BLINDINGCAN

BLINDINGCAN has deleted itself and associated artifacts from victim machines.[32]
S0657 BLUELIGHT

BLUELIGHT can uninstall itself.[33]
G0060 BRONZE BUTLER

The BRONZE BUTLER uploader or malware the uploader uses command to delete the RAR archives after they have been exfiltrated.[34]
S0274 Calisto

Calisto has the capability to use rm -rf to remove folders and files from the victim's machine.[35]
S0030 Carbanak

Carbanak has a command to delete files.[36]
S0348 Cardinal RAT

Cardinal RAT can uninstall itself, including deleting its executable.[37]
S0462 CARROTBAT

CARROTBAT has the ability to delete downloaded files from a compromised host.[38]
S0674 CharmPower

CharmPower can delete created files from a compromised system.[39]
S0107 Cherry Picker

Recent versions of Cherry Picker delete files and registry keys created by the malware.[40]
G0114 Chimera

Chimera has performed file deletion to evade detection.[41]

S0106 cmd

cmd can be used to delete files from the file system.[42]
G0080 Cobalt Group

Cobalt Group deleted the DLL dropper from the victim’s machine to cover their tracks.[43]
S0115 Crimson

Crimson has the ability to delete files from a compromised host.[44][45]

S0498 Cryptoistic

Cryptoistic has the ability delete files from a compromised host.[46]
S0527 CSPY Downloader

CSPY Downloader has the ability to self delete.[47]
S0625 Cuba

Cuba can use the command cmd.exe /c del to delete its artifacts from the system.[48]

S0673 DarkWatchman

DarkWatchman has been observed deleting its original launcher after installation.[49]
S0354 Denis

Denis has a command to delete files from the victim’s machine.[50][51]
S0021 Derusbi

Derusbi is capable of deleting files. It has been observed loading a Linux Kernel Module (LKM) and then deleting it from the hard disk as well as overwriting the data with null bytes.[52][53]
G0035 Dragonfly

Dragonfly has deleted many of its files used during operations as part of cleanup, including removing applications and deleting screenshots.[54]
S0502 Drovorub

Drovorub can delete specific files from a compromised host.[55]
S0567 Dtrack

Dtrack can remove its persistence and delete itself.[56]
S0062 DustySky

DustySky can delete files it creates from the infected system.[57]
S0593 ECCENTRICBANDWAGON

ECCENTRICBANDWAGON can delete log files generated from the malware stored at C:\windows\temp\tmp0207.[58]
S0081 Elise

Elise is capable of launching a remote shell on the host to delete itself.[59]
S0091 Epic

Epic has a command to delete a file from the machine.[60]
S0396 EvilBunny

EvilBunny has deleted the initial dropper after running through the environment checks.[61]
G0120 Evilnum

Evilnum has deleted files used during infection.[62]
S0401 Exaramel for Linux

Exaramel for Linux can uninstall its persistence mechanism and delete its configuration file.[63]
S0181 FALLCHILL

FALLCHILL can delete malware and associated artifacts from the victim.[64]
S0512 FatDuke

FatDuke can secure delete its DLL.[65]
S0267 FELIXROOT

FELIXROOT deletes the .LNK file from the startup directory as well as the dropper components.[66]
S0679 Ferocious

Ferocious can delete files from a compromised host.[67]
G0051 FIN10

FIN10 has used batch scripts and scheduled tasks to delete critical system files.[68]
G0053 FIN5

FIN5 uses SDelete to clean up the environment and attempt to prevent detection.[69]
G0037 FIN6

FIN6 has removed files from victim machines.[70]
G0061 FIN8

FIN8 has deleted tmp and prefetch files during post compromise cleanup activities.[71]
S0277 FruitFly

FruitFly will delete files on the system.[72]
S0410 Fysbis

Fysbis has the ability to delete files.[73]
G0047 Gamaredon Group

Gamaredon Group tools can delete files used during an operation.[74][75][76]
S0168 Gazer

Gazer has commands to delete files and persistence mechanisms from the victim.[77][78]
S0666 Gelsemium

Gelsemium can delete its dropper component from the targeted system.[79]
S0032 gh0st RAT

gh0st RAT has the capability to to delete files.[80][81]
S0249 Gold Dragon

Gold Dragon deletes one of its files, 2.hwp, from the endpoint after establishing persistence.[82]
S0493 GoldenSpy

GoldenSpy's uninstaller can delete registry entries, files and folders, and finally itself once these tasks have been completed.[83]
S0531 Grandoreiro

Grandoreiro can delete .LNK files created in the Startup folder.[84]
S0690 Green Lambert

Green Lambert can delete the original executable after initial installation in addition to unused functions.[85][86]

S0342 GreyEnergy

GreyEnergy can securely delete a file by hooking into the DeleteFileA and DeleteFileW functions in the Windows API.[87]
S0632 GrimAgent

GrimAgent can delete old binaries on a compromised host.[88]
G0043 Group5

Malware used by Group5 is capable of remotely deleting files from victims.[89]
S0561 GuLoader

GuLoader can delete its executable from the AppData\Local\Temp directory on the compromised host.[90]
S0151 HALFBAKED

HALFBAKED can delete a specified file.[91]
S0499 Hancitor

Hancitor has deleted files using the VBA kill function.[92]
S0391 HAWKBALL

HAWKBALL has the ability to delete files.[93]

S0697 HermeticWiper

HermeticWiper has the ability to overwrite its own file with random bites.[94][95]
S0087 Hi-Zor

Hi-Zor deletes its RAT installer file as it executes its DLL payload file.[96]
S0601 Hildegard

Hildegard has deleted scripts after execution.[97]

G0072 Honeybee

Honeybee removes batch files to reduce fingerprint on the system as well as deletes the CAB file that gets encoded upon infection.[98]
S0431 HotCroissant

HotCroissant has the ability to clean up installed files, delete files, and delete itself from the victim’s machine.[99]
S0070 HTTPBrowser

HTTPBrowser deletes its original installer file once installation is complete.[100]
S0203 Hydraq

Hydraq creates a backdoor through which remote attackers can delete files.[101][102]
S0398 HyperBro

HyperBro has the ability to delete a specified file.[103]
S0434 Imminent Monitor

Imminent Monitor has deleted files related to its dynamic debugger feature.[104]
S0259 InnaputRAT

InnaputRAT has a command to delete files.[105]
S0260 InvisiMole

InvisiMole has deleted files and directories including XML and files successfully uploaded to C2 servers.[106][107]
S0015 Ixeshe

Ixeshe has a command to delete a file from the machine.[108]
S0044 JHUHUGIT

The JHUHUGIT dropper can delete itself from the victim. Another JHUHUGIT variant has the capability to delete specified files.[109][110]
S0201 JPIN

JPIN's installer/uninstaller component deletes itself if it encounters a version of Windows earlier than Windows XP or identifies security-related processes running.[111]
S0283 jRAT

jRAT has a function to delete files from the victim’s machine.[112]
S0265 Kazuar

Kazuar can delete files.[113]
S0271 KEYMARBLE

KEYMARBLE has the capability to delete files off the victim’s machine.[114]
S0607 KillDisk

KillDisk has the ability to quit and delete itself.[115]
G0094 Kimsuky

Kimsuky has deleted the exfiltrated data on disk after transmission. Kimsuky has also used an instrumentor script to terminate browser processes running on an infected system and then delete the cookie files on disk.[116][117][118]
S0437 Kivars

Kivars has the ability to uninstall malware from the infected host.[119]
S0162 Komplex

The Komplex trojan supports file deletion.[120]
S0356 KONNI

KONNI can delete files.[121]
G0032 Lazarus Group

Lazarus Group malware has deleted files in various ways, including "suicide scripts" to delete malware binaries from the victim. Lazarus Group also uses secure file deletion to delete files from the victim.[122][123]
S0395 LightNeuron

LightNeuron has a function to delete files.[124]
S0211 Linfo

Linfo creates a backdoor through which remote attackers can delete files.[125]
S0513 LiteDuke

LiteDuke can securely delete files by first writing random data to the file.[65]
S0372 LockerGoga

LockerGoga has been observed deleting its original launcher after execution.[126]
S0447 Lokibot

Lokibot will delete its dropped files after bypassing UAC.[127]
S0582 LookBack

LookBack removes itself after execution and can delete files on the system.[128]
S0451 LoudMiner

LoudMiner deleted installation files after completion.[129]
S0409 Machete

Once a file is uploaded, Machete will delete it from the machine.[130]

S0282 MacSpy

MacSpy deletes any temporary files it creates[131]
G0059 Magic Hound

Magic Hound has deleted and overwrote files to cover tracks.[132][133]
G0045 menuPass

A menuPass macro deletes files after it has decoded and decompressed them.[134][135]
S0443 MESSAGETAP

Once loaded into memory, MESSAGETAP deletes the keyword_parm.txt and parm.txt configuration files from disk. [136]
S0455 Metamorfo

Metamorfo has deleted itself from the system after execution.[137][138]
S0688 Meteor

Meteor will delete the folder containing malicious scripts if it detects the hostname as PIS-APP, PIS-MOB, WSUSPROXY, or PIS-DB.[139]
S0083 Misdat

Misdat is capable of deleting the backdoor file.[140]
S0149 MoonWind

MoonWind can delete itself or specified files.[141]
S0284 More_eggs

More_eggs can remove itself from a system.[43][142]
S0256 Mosquito

Mosquito deletes files using DeleteFileW API call.[143]
S0233 MURKYTOP

MURKYTOP has the capability to delete local files.[53]
G0129 Mustang Panda

Mustang Panda will delete their tools and files, and kill processes after their objectives are reached.[144]
S0228 NanHaiShu

NanHaiShu launches a script to delete their original decoy file to cover tracks.[145]
S0630 Nebulae

Nebulae has the ability to delete files and directories.[146]
S0385 njRAT

njRAT is capable of deleting files.[147][148]
S0353 NOKKI

NOKKI can delete files to cover tracks.[149]
S0346 OceanSalt

OceanSalt can delete files from the system.[150]
G0049 OilRig

OilRig has deleted files associated with their payload after execution.[151][152]
S0439 Okrum

Okrum's backdoor deletes files after they have been successfully uploaded to C2 servers.[153]
S0264 OopsIE

OopsIE has the capability to delete files and scripts from the victim's machine.[154]
G0116 Operation Wocao

Operation Wocao has deleted logs and executable files used during an intrusion.[155]
S0352 OSX_OCEANLOTUS.D

OSX_OCEANLOTUS.D has a command to delete a file from the system. OSX_OCEANLOTUS.D deletes the app bundle and dropper after execution.[156][157]
S0598 P.A.S. Webshell

P.A.S. Webshell can delete scripts from a subdirectory of /tmp after they are run.[63]
S0208 Pasam

Pasam creates a backdoor through which remote attackers can delete files.[158]
G0040 Patchwork

Patchwork removed certain files and replaced them so they could not be retrieved.[159]
S0556 Pay2Key

Pay2Key can remove its log file from disk.[160]
S0587 Penquin

Penquin can delete downloaded executables after running them.[161]
S0517 Pillowmint

Pillowmint has deleted the filepath %APPDATA%\Intel\devmonsrv.exe.[162]
S0435 PLEAD

PLEAD has the ability to delete files on the compromised host.[119]
S0067 pngdowner

pngdowner deletes content from C2 communications that was saved to the user's temporary directory.[163]
S0428 PoetRAT

PoetRAT has the ability to overwrite scripts and delete itself if a sandbox environment is detected.[164]
S0453 Pony

Pony has used scripts to delete itself after execution.[165]

S0139 PowerDuke

PowerDuke has a command to write random data across a file and delete it.[166]
S0441 PowerShower

PowerShower has the ability to remove all files created during the dropper process.[167]
S0223 POWERSTATS

POWERSTATS can delete all files on the C:\, D:\, E:\ and, F:\ drives using PowerShell Remove-Item commands.[168]
S0113 Prikormka

After encrypting its own log files, the log encryption module in Prikormka deletes the original, unencrypted files from the host.[169]
S0654 ProLock

ProLock can remove files containing its payload after they are executed.[170]
S0279 Proton

Proton removes all files in the /tmp directory.[72]
S0238 Proxysvc

Proxysvc can delete files indicated by the attacker and remove itself from disk using a batch file.[123]
S0147 Pteranodon

Pteranodon can delete files that may interfere with it executing. It also can delete temporary files and itself after the initial script executes.[171]
S0196 PUNCHBUGGY

PUNCHBUGGY can delete files written to disk.[71][172]
S0583 Pysa

Pysa has deleted batch files after execution. [173]

S0650 QakBot

QakBot can delete folders and files including overwriting its executable with legitimate programs.[174][175][176][170]
S0269 QUADAGENT

QUADAGENT has a command to delete its Registry key and scheduled task.[177]
S0629 RainyDay

RainyDay has the ability to uninstall itself by deleting its service and files.[146]
S0662 RCSession

RCSession can remove files from a targeted system.[178]
S0495 RDAT

RDAT can issue SOAP requests to delete already processed C2 emails. RDAT can also delete itself from the infected system.[179]

S0416 RDFSNIFFER

RDFSNIFFER has the capability of deleting local files.[180]
S0172 Reaver

Reaver deletes the original dropped file from the victim.[181]
S0153 RedLeaves

RedLeaves can delete specified files.[182]
S0125 Remsec

Remsec is capable of deleting files on the victim. It also securely removes itself after collecting and exfiltrating data.[183][184][185]
S0496 REvil

REvil can mark its binary code for deletion after reboot.[186]
S0448 Rising Sun

Rising Sun can delete files specified by the C2.[187]

G0106 Rocke

Rocke has deleted files on infected machines.[188]

S0240 ROKRAT

ROKRAT can request to delete files.[189]

S0148 RTM

RTM can delete all files created during its execution.[190][191]
S0253 RunningRAT

RunningRAT contains code to delete files from the victim’s machine.[82]
S0074 Sakula

Some Sakula samples use cmd.exe to delete temporary files.[192]
S0370 SamSam

SamSam has been seen deleting its own files and payloads to make analysis of the attack more difficult.[193]
G0034 Sandworm Team

Sandworm Team has used backdoors that can delete files used in an attack from an infected system.[115][194]
S0461 SDBbot

SDBbot has the ability to delete files from a compromised host.[195]
S0195 SDelete

SDelete deletes data in a way that makes it unrecoverable.[1]
S0053 SeaDuke

SeaDuke can securely delete files, including deleting itself from the victim.[196]
S0345 Seasalt

Seasalt has a command to delete a specified file.[197]
S0382 ServHelper

ServHelper has a module to delete itself from the infected machine.[198][199]
S0444 ShimRat

ShimRat can uninstall itself from compromised hosts, as well create and modify directories, delete, move, copy, and rename files.[200]
S0589 Sibot

Sibot will delete itself if a certain server response is received.[201]
G0091 Silence

Silence has deleted artifacts, including scheduled tasks, communicates files from the C2 and other logs.[202][203]

S0692 SILENTTRINITY

SILENTTRINITY can remove files from the compromised host.[204]
S0533 SLOTHFULMEDIA

SLOTHFULMEDIA has deleted itself and the 'index.dat' file on a compromised machine to remove recent Internet history from the system.[205]
S0615 SombRAT

SombRAT has the ability to run cancel or closeanddeletestorage to remove all files from storage and delete the storage temp file on a compromised host.[206]
S0374 SpeakUp

SpeakUp deletes files to remove evidence on the machine. [207]
S0390 SQLRat

SQLRat has used been observed deleting scripts once used.[208]

S0380 StoneDrill

StoneDrill has been observed deleting the temporary files once they fulfill their task.[209]

S0491 StrongPity

StrongPity can delete previously exfiltrated files from the compromised host.[210][211]
S0603 Stuxnet

Stuxnet uses an RPC server that contains a routine for file deletion and also removes itself from the system through a DLL export by deleting specific files.[212]
S0559 SUNBURST

SUNBURST had a command to delete files.[8][213]
S0562 SUNSPOT

Following the successful injection of SUNBURST, SUNSPOT deleted a temporary file it created named InventoryManager.bk after restoring the original SolarWinds Orion source code to the software library.[214]
S0663 SysUpdate

SysUpdate can delete its configuration file from the targeted system.[215]
S0011 Taidoor

Taidoor can use DeleteFileA to remove files from infected hosts.[216]
S0586 TAINTEDSCRIBE

TAINTEDSCRIBE can delete files from a compromised host.[217]
S0164 TDTESS

TDTESS creates then deletes log files during installation of itself as a service.[218]
G0139 TeamTNT

TeamTNT uses a payload that removes itself after running.[219]
G0088 TEMP.Veles

TEMP.Veles routinely deleted tools, logs, and other files after they were finished with them.[220]
G0089 The White Company

The White Company has the ability to delete its malware entirely from the target system.[221]
G0027 Threat Group-3390

Threat Group-3390 has deleted existing logs and exfiltrated file archives from a victim.[222][223]
S0094 Trojan.Karagany

Trojan.Karagany has used plugins with a self-delete capability.[224]
G0081 Tropic Trooper

Tropic Trooper has deleted dropper files on an infected system using command scripts.[225]

S0263 TYPEFRAME

TYPEFRAME can delete files off the system.[226]
S0386 Ursnif

Ursnif has deleted data staged in tmp files after exfiltration.[227]
S0136 USBStealer

USBStealer has several commands to delete files associated with the malware from the victim.[228]
S0442 VBShower

VBShower has attempted to complicate forensic analysis by deleting all the files contained in %APPDATA%..\Local\Temporary Internet Files\Content.Word and %APPDATA%..\Local Settings\Temporary Internet Files\Content.Word\.[229]
S0257 VERMIN

VERMIN can delete files on the victim’s machine.[230]
S0180 Volgmer

Volgmer can delete files and itself after infection to avoid analysis.[231]
S0689 WhisperGate

WhisperGate can delete tools from a compromised host after execution.[232]
S0155 WINDSHIELD

WINDSHIELD is capable of file deletion along with other file system interaction.[233]
S0466 WindTail

WindTail has the ability to receive and execute a self-delete command.[234]
S0176 Wingbird

Wingbird deletes its payload along with the payload's parent process after it finishes copying files.[235]
S0141 Winnti for Windows

Winnti for Windows can delete the DLLs for its various components from a compromised host.[236]
G0102 Wizard Spider

Wizard Spider has used file deletion to remove some modules and configurations from an infected host after use.[237]
S0161 XAgentOSX

XAgentOSX contains the deletFileFromPath function to delete a specified file using the NSFileManager:removeFileAtPath method.[238]
S0251 Zebrocy

Zebrocy has a command to delete files and directories.[239][240][241]
S0330 Zeus Panda

Zeus Panda has a command to delete a file. It also can uninstall scripts and delete files to cover its track.[242]
S0350 zwShell

zwShell has deleted itself after creating a service as well as deleted a temporary file when the system reboots.[243]
S0412 ZxShell

ZxShell can delete files from the system.[15][244]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

ID Data Source Data Component
DS0017 Command Command Execution
DS0022 File File Deletion

It may be uncommon for events related to benign command-line functions such as DEL or third-party utilities or tools to be found in an environment, depending on the user base and how systems are typically used. Monitoring for command-line deletion functions to correlate with binaries or other files that an adversary may drop and remove may lead to detection of malicious activity. Another good practice is monitoring for known deletion and secure deletion tools that are not already on systems within an enterprise network that an adversary could introduce. Some monitoring tools may collect command-line arguments, but may not capture DEL commands since DEL is a native function within cmd.exe.

References

  1. Russinovich, M. (2016, July 4). SDelete v2.0. Retrieved February 8, 2018.
  2. ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.
  3. Dahan, A. et al. (2019, December 11). DROPPING ANCHOR: FROM A TRICKBOT INFECTION TO THE DISCOVERY OF THE ANCHOR MALWARE. Retrieved September 10, 2020.
  4. Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.
  5. Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021.
  6. Carvey, H.. (2014, September 2). Where you AT?: Indicators of lateral movement using at.exe on Windows 7 systems. Retrieved January 25, 2016.
  7. Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved September 13, 2018.
  8. FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.
  9. Dunwoody, M. and Carr, N.. (2016, September 27). No Easy Breach DerbyCon 2016. Retrieved October 4, 2016.
  10. Chen, X., Scott, M., Caselden, D.. (2014, April 26). New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks. Retrieved January 14, 2016.
  11. Dumont, R.. (2019, April 9). OceanLotus: macOS malware update. Retrieved April 15, 2019.
  12. FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 6, 2018.
  13. DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.
  14. FBI. (2020, September 17). Indicators of Compromise Associated with Rana Intelligence Computing, also known as Advanced Persistent Threat 39, Chafer, Cadelspy, Remexi, and ITG07. Retrieved December 10, 2020.
  15. Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.
  16. Wiley, B. et al. (2021, December 29). OverWatch Exposes AQUATIC PANDA in Possession of Log4Shell Exploit Tools During Hands-on Intrusion Attempt. Retrieved January 18, 2022.
  17. CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.
  18. Hromcova, Z. (2019, October). AT COMMANDS, TOR-BASED COMMUNICATIONS: MEET ATTOR, A FANTASY CREATURE AND ALSO A SPY PLATFORM. Retrieved May 6, 2020.
  19. Trend Micro. (2018, November 20). Lazarus Continues Heists, Mounts Attacks on Financial Organizations in Latin America. Retrieved December 3, 2018.
  20. Yan, T., et al. (2018, November 21). New Wine in Old Bottle: New Azorult Variant Found in FindMyName Campaign using Fallout Exploit Kit. Retrieved November 29, 2018.
  21. Lim, M.. (2019, April 26). BabyShark Malware Part Two – Attacks Continue Using KimJongRAT and PCRat . Retrieved October 7, 2019.
  22. Hinchliffe, A. and Falcone, R. (2020, May 11). Updated BackConfig Malware Targeting Government and Military Organizations in South Asia. Retrieved June 17, 2020.
  23. Symantec Security Response. (2014, July 7). Dragonfly: Cyberespionage Attacks Against Energy Suppliers. Retrieved April 8, 2016.
  24. Check Point. (2020, November 26). Bandook: Signed & Delivered. Retrieved May 31, 2021.
  25. Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.
  26. Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020.
  27. Lee, B. Grunzweig, J. (2015, December 22). BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger. Retrieved August 19, 2016.
  28. Hayashi, K., Ray, V. (2018, July 31). Bisonal Malware Used in Attacks Against Russia and South Korea. Retrieved August 7, 2018.
  29. Zykov, K. (2020, August 13). CactusPete APT group’s updated Bisonal backdoor. Retrieved May 5, 2021.
  30. Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022.
  31. FireEye Labs/FireEye Threat Intelligence. (2015, May 14). Hiding in Plain Sight: FireEye and Microsoft Expose Obfuscation Tactic. Retrieved January 22, 2016.
  32. US-CERT. (2020, August 19). MAR-10295134-1.v1 – North Korean Remote Access Trojan: BLINDINGCAN. Retrieved August 19, 2020.
  33. Cash, D., Grunzweig, J., Meltzer, M., Adair, S., Lancaster, T. (2021, August 17). North Korean APT InkySquid Infects Victims Using Browser Exploits. Retrieved September 30, 2021.
  34. Counter Threat Unit Research Team. (2017, October 12). BRONZE BUTLER Targets Japanese Enterprises. Retrieved January 4, 2018.
  35. Kuzin, M., Zelensky S. (2018, July 20). Calisto Trojan for macOS. Retrieved September 7, 2018.
  36. Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018.
  37. Grunzweig, J.. (2017, April 20). Cardinal RAT Active for Over Two Years. Retrieved December 8, 2018.
  38. Grunzweig, J. and Wilhoit, K. (2018, November 29). The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia. Retrieved June 2, 2020.
  39. Check Point. (2022, January 11). APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit. Retrieved January 24, 2022.
  40. Merritt, E.. (2015, November 16). Shining the Spotlight on Cherry Picker PoS Malware. Retrieved April 20, 2016.
  41. Cycraft. (2020, April 15). APT Group Chimera - APT Operation Skeleton key Targets Taiwan Semiconductor Vendors. Retrieved August 24, 2020.
  42. Microsoft. (n.d.). Del. Retrieved April 22, 2016.
  43. Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.
  44. Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.
  45. Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.
  46. Stokes, P. (2020, July 27). Four Distinct Families of Lazarus Malware Target Apple’s macOS Platform. Retrieved August 7, 2020.
  47. Dahan, A. et al. (2020, November 2). Back to the Future: Inside the Kimsuky KGH Spyware Suite. Retrieved November 6, 2020.
  48. Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.
  49. Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022.
  50. Dahan, A. (2017, May 24). OPERATION COBALT KITTY: A LARGE-SCALE APT IN ASIA CARRIED OUT BY THE OCEANLOTUS GROUP. Retrieved November 5, 2018.
  51. Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.
  52. Fidelis Cybersecurity. (2016, February 29). The Turbo Campaign, Featuring Derusbi for 64-bit Linux. Retrieved March 2, 2016.
  53. FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.
  54. US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.
  55. NSA/FBI. (2020, August). Russian GRU 85th GTsSS Deploys Previously Undisclosed Drovorub Malware. Retrieved August 25, 2020.
  56. Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.
  57. GReAT. (2019, April 10). Gaza Cybergang Group1, operation SneakyPastes. Retrieved May 13, 2020.
  58. Cybersecurity and Infrastructure Security Agency. (2020, August 26). MAR-10301706-1.v1 - North Korean Remote Access Tool: ECCENTRICBANDWAGON. Retrieved March 18, 2021.
  59. Accenture Security. (2018, January 27). DRAGONFISH DELIVERS NEW FORM OF ELISE MALWARE TARGETING ASEAN DEFENCE MINISTERS’ MEETING AND ASSOCIATES. Retrieved November 14, 2018.
  60. Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.
  61. Marschalek, M.. (2014, December 16). EvilBunny: Malware Instrumented By Lua. Retrieved June 28, 2019.
  62. Porolli, M. (2020, July 9). More evil: A deep look at Evilnum and its toolset. Retrieved January 22, 2021.
  63. ANSSI. (2021, January 27). SANDWORM INTRUSION SET CAMPAIGN TARGETING CENTREON SYSTEMS. Retrieved March 30, 2021.
  64. US-CERT. (2017, November 22). Alert (TA17-318A): HIDDEN COBRA – North Korean Remote Administration Tool: FALLCHILL. Retrieved December 7, 2017.
  65. Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.
  66. Patil, S. (2018, June 26). Microsoft Office Vulnerabilities Used to Distribute FELIXROOT Backdoor in Recent Campaign. Retrieved July 31, 2018.
  67. Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.
  68. FireEye iSIGHT Intelligence. (2017, June 16). FIN10: Anatomy of a Cyber Extortion Operation. Retrieved June 25, 2017.
  69. Bromiley, M. and Lewis, P. (2016, October 7). Attacking the Hospitality and Gaming Industries: Tracking an Attacker Around the World in 7 Years. Retrieved October 6, 2017.
  70. FireEye Threat Intelligence. (2016, April). Follow the Money: Dissecting the Operations of the Cyber Crime Group FIN6. Retrieved June 1, 2016.
  71. Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.
  72. Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.
  73. Doctor Web. (2014, November 21). Linux.BackDoor.Fysbis.1. Retrieved December 7, 2017.
  74. Kakara, H., Maruyama, E. (2020, April 17). Gamaredon APT Group Use Covid-19 Lure in Campaigns. Retrieved May 19, 2020.
  75. Symantec. (2022, January 31). Shuckworm Continues Cyber-Espionage Attacks Against Ukraine. Retrieved February 17, 2022.
  76. CERT-EE. (2021, January 27). Gamaredon Infection: From Dropper to Entry. Retrieved February 17, 2022.
  77. ESET. (2017, August). Gazing at Gazer: Turla’s new second stage backdoor. Retrieved September 14, 2017.
  78. Kaspersky Lab's Global Research & Analysis Team. (2017, August 30). Introducing WhiteBear. Retrieved September 21, 2017.
  79. Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.
  80. FireEye Threat Intelligence. (2015, July 13). Demonstrating Hustle, Chinese APT Groups Quickly Use Zero-Day Vulnerability (CVE-2015-5119) Following Hacking Team Leak. Retrieved January 25, 2016.
  81. Quinn, J. (2019, March 25). The odd case of a Gh0stRAT variant. Retrieved July 15, 2020.
  82. Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018.
  83. Trustwave SpiderLabs. (2020, June 26). GoldenSpy: Chapter Two – The Uninstaller. Retrieved July 23, 2020.
  84. ESET. (2020, April 28). Grandoreiro: How engorged can an EXE get?. Retrieved November 13, 2020.
  85. Sandvik, Runa. (2021, October 1). Made In America: Green Lambert for OS X. Retrieved March 21, 2022.
  86. Sandvik, Runa. (2021, October 18). Green Lambert and ATT&CK. Retrieved March 21, 2022.
  87. Cherepanov, A. (2018, October). GREYENERGY A successor to BlackEnergy. Retrieved November 15, 2018.
  88. Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved July 16, 2021.
  89. Scott-Railton, J., et al. (2016, August 2). Group5: Syria and the Iranian Connection. Retrieved September 26, 2016.
  90. Duncan, B. (2020, April 3). GuLoader: Malspam Campaign Installing NetWire RAT. Retrieved January 7, 2021.
  91. Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing LNK. Retrieved April 24, 2017.
  92. Anubhav, A., Jallepalli, D. (2016, September 23). Hancitor (AKA Chanitor) observed using multiple attack approaches. Retrieved August 13, 2020.
  93. Patil, S. and Williams, M.. (2019, June 5). Government Sector in Central Asia Targeted With New HAWKBALL Backdoor Delivered via Microsoft Office Vulnerabilities. Retrieved June 20, 2019.
  94. Thomas, W. et al. (2022, February 25). CrowdStrike Falcon Protects from New Wiper Malware Used in Ukraine Cyberattacks. Retrieved March 25, 2022.
  95. ESET. (2022, March 1). IsaacWiper and HermeticWizard: New wiper and worm targetingUkraine. Retrieved April 10, 2022.
  96. Fidelis Cybersecurity. (2015, December 16). Fidelis Threat Advisory #1020: Dissecting the Malware Involved in the INOCNATION Campaign. Retrieved March 24, 2016.
  97. Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.
  98. Sherstobitoff, R. (2018, March 02). McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups. Retrieved May 16, 2018.
  99. Knight, S.. (2020, April 16). VMware Carbon Black TAU Threat Analysis: The Evolution of Lazarus. Retrieved May 1, 2020.
  100. Desai, D.. (2015, August 14). Chinese cyber espionage APT group leveraging recently leaked Hacking Team exploits to target a Financial Services Firm. Retrieved January 26, 2016.
  101. Symantec Security Response. (2010, January 18). The Trojan.Hydraq Incident. Retrieved February 20, 2018.
  102. Lelli, A. (2010, January 11). Trojan.Hydraq. Retrieved February 20, 2018.
  103. Falcone, R. and Lancaster, T. (2019, May 28). Emissary Panda Attacks Middle East Government Sharepoint Servers. Retrieved July 9, 2019.
  104. QiAnXin Threat Intelligence Center. (2019, February 18). APT-C-36: Continuous Attacks Targeting Colombian Government Institutions and Corporations. Retrieved May 5, 2020.
  105. ASERT Team. (2018, April 04). Innaput Actors Utilize Remote Access Trojan Since 2016, Presumably Targeting Victim Files. Retrieved July 9, 2018.
  106. Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.
  107. Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.
  108. Sancho, D., et al. (2012, May 22). IXESHE An APT Campaign. Retrieved June 7, 2019.
  109. ESET. (2016, October). En Route with Sednit - Part 1: Approaching the Target. Retrieved November 8, 2016.
  110. Lee, B, et al. (2018, February 28). Sofacy Attacks Multiple Government Entities. Retrieved March 15, 2018.
  111. Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
  112. Sharma, R. (2018, August 15). Revamped jRAT Uses New Anti-Parsing Techniques. Retrieved September 21, 2018.
  113. Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.
  114. US-CERT. (2018, August 09). MAR-10135536-17 – North Korean Trojan: KEYMARBLE. Retrieved August 16, 2018.
  115. Cherepanov, A.. (2016, December 13). The rise of TeleBots: Analyzing disruptive KillDisk attacks. Retrieved June 10, 2020.
  116. Tarakanov , D.. (2013, September 11). The “Kimsuky” Operation: A North Korean APT?. Retrieved August 13, 2019.
  117. An, J and Malhotra, A. (2021, November 10). North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets. Retrieved December 29, 2021.
  118. KISA. (n.d.). Phishing Target Reconnaissance and Attack Resource Analysis Operation Muzabi. Retrieved March 7, 2022.
  119. Bermejo, L., et al. (2017, June 22). Following the Trail of BlackTech’s Cyber Espionage Campaigns. Retrieved May 5, 2020.
  120. Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26). Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.
  121. Rascagneres, P. (2017, May 03). KONNI: A Malware Under The Radar For Years. Retrieved November 5, 2018.
  122. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.
  1. Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.
  2. Faou, M. (2019, May). Turla LightNeuron: One email away from remote code execution. Retrieved June 24, 2019.
  3. Zhou, R. (2012, May 15). Backdoor.Linfo. Retrieved February 23, 2018.
  4. CarbonBlack Threat Analysis Unit. (2019, March 22). TAU Threat Intelligence Notification – LockerGoga Ransomware. Retrieved April 16, 2019.
  5. Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.
  6. Raggi, M. Schwarz, D.. (2019, August 1). LookBack Malware Targets the United States Utilities Sector with Phishing Attacks Impersonating Engineering Licensing Boards. Retrieved February 25, 2021.
  7. Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.
  8. ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019.
  9. PETER EWANE. (2017, June 9). MacSpy: OS X RAT as a Service. Retrieved September 21, 2018.
  10. Lee, B. and Falcone, R. (2017, February 15). Magic Hound Campaign Attacks Saudi Targets. Retrieved December 27, 2017.
  11. Mandiant. (2018). Mandiant M-Trends 2018. Retrieved July 9, 2018.
  12. Accenture Security. (2018, April 23). Hogfish Redleaves Campaign. Retrieved July 2, 2018.
  13. US District Court Southern District of New York. (2018, December 17). United States v. Zhu Hua Indictment. Retrieved December 17, 2020.
  14. Leong, R., Perez, D., Dean, T. (2019, October 31). MESSAGETAP: Who’s Reading Your Text Messages?. Retrieved May 11, 2020.
  15. Erlich, C. (2020, April 3). The Avast Abuser: Metamorfo Banking Malware Hides By Abusing Avast Executable. Retrieved May 26, 2020.
  16. Zhang, X. (2020, February 4). Another Metamorfo Variant Targeting Customers of Financial Institutions in More Countries. Retrieved July 30, 2020.
  17. Check Point Research Team. (2021, August 14). Indra - Hackers Behind Recent Attacks on Iran. Retrieved February 17, 2022.
  18. Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.
  19. Miller-Osborn, J. and Grunzweig, J.. (2017, March 30). Trochilus and New MoonWind RATs Used In Attack Against Thai Organizations. Retrieved March 30, 2017.
  20. Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.
  21. ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.
  22. Counter Threat Unit Research Team. (2019, December 29). BRONZE PRESIDENT Targets NGOs. Retrieved April 13, 2021.
  23. F-Secure Labs. (2016, July). NANHAISHU RATing the South China Sea. Retrieved July 6, 2018.
  24. Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.
  25. Fidelis Cybersecurity. (2013, June 28). Fidelis Threat Advisory #1009: "njRAT" Uncovered. Retrieved June 4, 2019.
  26. Pascual, C. (2018, November 27). AutoIt-Compiled Worm Affecting Removable Media Delivers Fileless Version of BLADABINDI/njRAT Backdoor. Retrieved June 4, 2019.
  27. Grunzweig, J., Lee, B. (2018, September 27). New KONNI Malware attacking Eurasia and Southeast Asia. Retrieved November 5, 2018.
  28. Sherstobitoff, R., Malhotra, A. (2018, October 18). ‘Operation Oceansalt’ Attacks South Korea, U.S., and Canada With Source Code From Chinese Hacker Group. Retrieved November 30, 2018.
  29. Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017.
  30. Lee, B., Falcone, R. (2018, February 23). OopsIE! OilRig Uses ThreeDollars to Deliver New Trojan. Retrieved July 16, 2018.
  31. Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.
  32. Falcone, R., et al. (2018, September 04). OilRig Targets a Middle Eastern Government and Adds Evasion Techniques to OopsIE. Retrieved September 24, 2018.
  33. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.
  34. Horejsi, J. (2018, April 04). New MacOS Backdoor Linked to OceanLotus Found. Retrieved November 13, 2018.
  35. Magisa, L. (2020, November 27). New MacOS Backdoor Connected to OceanLotus Surfaces. Retrieved December 2, 2020.
  36. Mullaney, C. & Honda, H. (2012, May 4). Trojan.Pasam. Retrieved February 22, 2018.
  37. Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.
  38. Check Point. (2020, November 6). Ransomware Alert: Pay2Key. Retrieved January 4, 2021.
  39. Leonardo. (2020, May 29). MALWARE TECHNICAL INSIGHT TURLA “Penquin_x64”. Retrieved March 11, 2021.
  40. Trustwave SpiderLabs. (2020, June 22). Pillowmint: FIN7’s Monkey Thief . Retrieved July 27, 2020.
  41. Crowdstrike Global Intelligence Team. (2014, June 9). CrowdStrike Intelligence Report: Putter Panda. Retrieved January 22, 2016.
  42. Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.
  43. hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.
  44. Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
  45. Lancaster, T. (2018, November 5). Inception Attackers Target Europe with Year-old Office Vulnerability. Retrieved May 8, 2020.
  46. Singh, S. et al.. (2018, March 13). Iranian Threat Group Updates Tactics, Techniques and Procedures in Spear Phishing Campaign. Retrieved April 11, 2018.
  47. Cherepanov, A.. (2016, May 17). Operation Groundbait: Analysis of a surveillance toolkit. Retrieved May 18, 2016.
  48. Group IB. (2020, September). LOCK LIKE A PRO. Retrieved September 27, 2021.
  49. Kasza, A. and Reichel, D. (2017, February 27). The Gamaredon Group Toolset Evolution. Retrieved March 1, 2017.
  50. Gorelik, M.. (2019, June 10). SECURITY ALERT: FIN8 IS BACK IN BUSINESS, TARGETING THE HOSPITALITY INDUSTRY. Retrieved June 13, 2019.
  51. CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.
  52. Sette, N. et al. (2020, June 4). Qakbot Malware Now Exfiltrating Emails for Sophisticated Thread Hijacking Attacks. Retrieved September 27, 2021.
  53. CS. (2020, October 7). Duck Hunting with Falcon Complete: A Fowl Banking Trojan Evolves, Part 2. Retrieved September 27, 2021.
  54. Morrow, D. (2021, April 15). The rise of QakBot. Retrieved September 27, 2021.
  55. Lee, B., Falcone, R. (2018, July 25). OilRig Targets Technology Service Provider and Government Agency with QUADAGENT. Retrieved August 9, 2018.
  56. Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.
  57. Falcone, R. (2020, July 22). OilRig Targets Middle Eastern Telecommunications Organization and Adds Novel C2 Channel with Steganography to Its Inventory. Retrieved July 28, 2020.
  58. Carr, N, et all. (2019, October 10). Mahalo FIN7: Responding to the Criminal Operators’ New Tools and Techniques. Retrieved October 11, 2019.
  59. Grunzweig, J. and Miller-Osborn, J. (2017, November 10). New Malware with Ties to SunOrcal Discovered. Retrieved November 16, 2017.
  60. PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.
  61. Symantec Security Response. (2016, August 8). Backdoor.Remsec indicators of compromise. Retrieved August 17, 2016.
  62. Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 17, 2016.
  63. Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.
  64. Intel 471 Malware Intelligence team. (2020, March 31). REvil Ransomware-as-a-Service – An analysis of a ransomware affiliate operation. Retrieved August 4, 2020.
  65. Sherstobitoff, R., Malhotra, A., et. al.. (2018, December 18). Operation Sharpshooter Campaign Targets Global Defense, Critical Infrastructure. Retrieved May 14, 2020.
  66. Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With a New Malware Family Written in Golang. Retrieved April 24, 2019.
  67. Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020.
  68. Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.
  69. Duncan, B., Harbison, M. (2019, January 23). Russian Language Malspam Pushing Redaman Banking Malware. Retrieved June 16, 2020.
  70. Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, July 30). Sakula Malware Family. Retrieved January 26, 2016.
  71. Palotay, D. and Mackenzie, P. (2018, April). SamSam Ransomware Chooses Its Targets Carefully. Retrieved April 15, 2019.
  72. Cherepanov, A.. (2017, July 4). Analysis of TeleBots’ cunning backdoor . Retrieved June 11, 2020.
  73. Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.
  74. Symantec Security Response. (2015, July 13). “Forkmeiamfamous”: Seaduke, latest weapon in the Duke armory. Retrieved July 22, 2015.
  75. Mandiant. (n.d.). Appendix C (Digital) - The Malware Arsenal. Retrieved July 18, 2016.
  76. Schwarz, D. and Proofpoint Staff. (2019, January 9). ServHelper and FlawedGrace - New malware introduced by TA505. Retrieved May 28, 2019.
  77. Vilkomir-Preisman, S. (2019, April 2). New ServHelper Variant Employs Excel 4.0 Macro to Drop Signed Payload. Retrieved May 28, 2019.
  78. Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.
  79. Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.
  80. Skulkin, O.. (2019, January 20). Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis. Retrieved May 24, 2019.
  81. Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.
  82. Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022.
  83. DHS/CISA, Cyber National Mission Force. (2020, October 1). Malware Analysis Report (MAR) MAR-10303705-1.v1 – Remote Access Trojan: SLOTHFULMEDIA. Retrieved October 2, 2020.
  84. The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.
  85. Check Point Research. (2019, February 4). SpeakUp: A New Undetected Backdoor Linux Trojan. Retrieved April 17, 2019.
  86. Platt, J. and Reeves, J.. (2019, March). FIN7 Revisited: Inside Astra Panel and SQLRat Malware. Retrieved June 18, 2019.
  87. Kaspersky Lab. (2017, March 7). From Shamoon to StoneDrill: Wipers attacking Saudi organizations and beyond. Retrieved March 14, 2019.
  88. Mercer, W. et al. (2020, June 29). PROMETHIUM extends global reach with StrongPity3 APT. Retrieved July 20, 2020.
  89. Tudorica, R. et al. (2020, June 30). StrongPity APT - Revealing Trojanized Tools, Working Hours and Infrastructure. Retrieved July 20, 2020.
  90. Nicolas Falliere, Liam O. Murchu, Eric Chien. (2011, February). W32.Stuxnet Dossier. Retrieved December 7, 2020.
  91. MSTIC. (2020, December 18). Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers . Retrieved January 5, 2021.
  92. CrowdStrike Intelligence Team. (2021, January 11). SUNSPOT: An Implant in the Build Process. Retrieved January 11, 2021.
  93. Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.
  94. CISA, FBI, DOD. (2021, August). MAR-10292089-1.v2 – Chinese Remote Access Trojan: TAIDOOR. Retrieved August 24, 2021.
  95. USG. (2020, May 12). MAR-10288834-2.v1 – North Korean Trojan: TAINTEDSCRIBE. Retrieved March 5, 2021.
  96. ClearSky Cyber Security and Trend Micro. (2017, July). Operation Wilted Tulip: Exposing a cyber espionage apparatus. Retrieved August 21, 2017.
  97. AT&T Alien Labs. (2021, September 8). TeamTNT with new campaign aka Chimaera. Retrieved September 22, 2021.
  98. Miller, S, et al. (2019, April 10). TRITON Actor TTP Profile, Custom Attack Tools, Detections, and ATT&CK Mapping. Retrieved April 16, 2019.
  99. Livelli, K, et al. (2018, November 12). Operation Shaheen. Retrieved May 1, 2019.
  100. Counter Threat Unit Research Team. (2017, June 27). BRONZE UNION Cyberespionage Persists Despite Disclosures. Retrieved July 13, 2017.
  101. Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.
  102. Secureworks. (2019, July 24). Updated Karagany Malware Targets Energy Sector. Retrieved August 12, 2020.
  103. Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.
  104. US-CERT. (2018, June 14). MAR-10135536-12 – North Korean Trojan: TYPEFRAME. Retrieved July 13, 2018.
  105. Caragay, R. (2015, March 26). URSNIF: The Multifaceted Malware. Retrieved June 5, 2019.
  106. Calvet, J. (2014, November 11). Sednit Espionage Group Attacking Air-Gapped Networks. Retrieved January 4, 2017.
  107. GReAT. (2019, August 12). Recent Cloud Atlas activity. Retrieved May 8, 2020.
  108. Lancaster, T., Cortes, J. (2018, January 29). VERMIN: Quasar RAT and Custom Malware Used In Ukraine. Retrieved July 5, 2018.
  109. US-CERT. (2017, November 01). Malware Analysis Report (MAR) - 10135536-D. Retrieved July 16, 2018.
  110. Biasini, N. et al.. (2022, January 21). Ukraine Campaign Delivers Defacement and Wipers, in Continued Escalation. Retrieved March 14, 2022.
  111. Carr, N.. (2017, May 14). Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations. Retrieved June 18, 2017.
  112. Wardle, Patrick. (2019, January 15). Middle East Cyber-Espionage analyzing WindShift's implant: OSX.WindTail (part 2). Retrieved October 3, 2019.
  113. Anthe, C. et al. (2016, December 14). Microsoft Security Intelligence Report Volume 21. Retrieved November 27, 2017.
  114. Novetta Threat Research Group. (2015, April 7). Winnti Analysis. Retrieved February 8, 2017.
  115. John, E. and Carvey, H. (2019, May 30). Unraveling the Spiderweb: Timelining ATT&CK Artifacts Used by GRIM SPIDER. Retrieved May 12, 2020.
  116. Robert Falcone. (2017, February 14). XAgentOSX: Sofacy's Xagent macOS Tool. Retrieved July 12, 2017.
  117. ESET. (2018, November 20). Sednit: What’s going on with Zebrocy?. Retrieved February 12, 2019.
  118. ESET Research. (2019, May 22). A journey to Zebrocy land. Retrieved June 20, 2019.
  119. CISA. (2020, October 29). Malware Analysis Report (AR20-303B). Retrieved December 9, 2020.
  120. Ebach, L. (2017, June 22). Analysis Results of Zeus.Variant.Panda. Retrieved November 5, 2018.
  121. McAfee® Foundstone® Professional Services and McAfee Labs™. (2011, February 10). Global Energy Cyberattacks: “Night Dragon”. Retrieved February 19, 2018.
  122. Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.