| From Token Bingo to MAX Takeover: Kali365 Operator Expands Operation Across Microsoft Outlook, Okta, Xerox DocuShare, and Other Services arcticwolf.com | 2 Jun 2026 | 6 | 3 | 0 |
| Token Bingo: Don't Let Your Code be the Winner arcticwolf.com | 24 Apr 2026 | 6 | 3 | 0 |
| Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure unit42.paloaltonetworks.com | 31 Mar 2026 | 1 | 1 | 0 |
| MuddyWater Exposed: Inside an Iranian APT operation - Ctrl-Alt-Intel ctrlaltintel.com | 4 Mar 2026 | 13 | 11 | 0 |
| Dropping Elephant APT Group Targets Turkish Defense Industry With New Campaign and Capabilities: LOLBAS, VLC Player, and Encrypted Shellcode arcticwolf.com | 23 Jul 2025 | 6 | 3 | 0 |
| SharePoint Under Siege: ToolShell Exploit (CVE-2025-49706 & CVE-2025-49704) - Eye Research SharePoint 0-day uncovered (CVE-2025-53770) research.eye.security | 19 Jul 2025 | 8 | 5 | 0 |
| Blind Eagle: …And Justice for All research.checkpoint.com | 10 Mar 2025 | 1 | 1 | 0 |
| Weathering the storm: In the midst of a Typhoon blog.talosintelligence.com | 20 Feb 2025 | 4 | 4 | 0 |
| Matrix Unleashes A New Widespread DDoS Campaign aquasec.com | 26 Nov 2024 | 11 | 7 | 1 |
| The Nearest Neighbor Attack: How A Russian APT Weaponized Nearby Wi-Fi Networks for Covert Access volexity.com | 22 Nov 2024 | 1 | 1 | 0 |
| Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella trendmicro.com | 19 Nov 2024 | 7 | 5 | 0 |
| New Campaign Uses Remcos RAT to Exploit Victims fortinet.com | 8 Nov 2024 | 1 | 1 | 0 |
| In-Depth Analysis: Velvet Ant's Prolonged Cyber Attack on a Large Organization sygnia.co | 3 Jun 2024 | 1 | 1 | 0 |
| Infiltrating Defenses: Abusing VMware in MITRE’s Cyber Intrusion ctid.mitre.org | 22 May 2024 | 2 | 2 | 0 |
| ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices blog.talosintelligence.com | 24 Apr 2024 | 7 | 5 | 1 |
| Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400) volexity.com | 12 Apr 2024 | 1 | 1 | 0 |
| Staying ahead of threat actors in the age of AI microsoft.com | 14 Feb 2024 | 1 | 1 | 0 |
| Dark Web Profile: INC Ransom socradar.io | 24 Jan 2024 | 1 | 1 | 0 |
| Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN volexity.com | 10 Jan 2024 | 2 | 2 | 0 |
| Deceptive Cracked Software Spreads Lumma Variant on YouTube fortinet.com | 8 Jan 2024 | 1 | 1 | 0 |
| Peach Sandstorm password spray campaigns enable intelligence collection at high-value targets microsoft.com | 14 Sep 2023 | 2 | 2 | 0 |
| The five-day job: A BlackByte ransomware intrusion case study microsoft.com | 6 Jul 2023 | 4 | 3 | 0 |
| Cadet Blizzard emerges as a novel and distinct Russian threat actor microsoft.com | 14 Jun 2023 | 4 | 4 | 0 |
| Breaking the silence blog.talosintelligence.com | 8 Dec 2022 | 4 | 4 | 0 |
| Revealing Emperor Dragonfly: Night Sky and Cheerscrypt - A Single Ransomware Group sygnia.co | 3 Oct 2022 | 2 | 1 | 0 |
| Woody Rat A New Feature Rich Malware Woody RAT | ThreatDown Woody RAT: A new feature-rich malware spotted in the wild threatdown.com | 2 Aug 2022 | 1 | 1 | 0 |
| Exposing POLONIUM activity and infrastructure targeting Israeli organizations microsoft.com | 2 Jun 2022 | 1 | 1 | 0 |
| Bitter APT adds Bangladesh to their targets blog.talosintelligence.com | 11 May 2022 | 4 | 4 | 0 |
| Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself microsoft.com | 9 May 2022 | 16 | 16 | 0 |
| TeamTNT Targeting AWS, Alibaba blog.talosintelligence.com | 21 Apr 2022 | 3 | 3 | 0 |
| Exposing initial access broker with ties to Conti blog.google | 17 Mar 2022 | 1 | 1 | 0 |
| New Formbook Campaign Delivered Through Phishing Emails netskope.com | 11 Mar 2022 | 2 | 2 | 0 |
| OutSteel, SaintBot Delivered by Spear Phishing Attacks Targeting Ukraine Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader Saint unit42.paloaltonetworks.com | 26 Feb 2022 | 1 | 1 | 0 |
| APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit research.checkpoint.com | 11 Jan 2022 | 1 | 1 | 0 |
| Cybercrime underground flush with shipping companies’ credentials Intel 471 · github.com | 2 Nov 2021 | 1 | 1 | 1 |
| NOBELIUM targeting delegated administrative privileges to facilitate broader attacks microsoft.com | 25 Oct 2021 | 1 | 1 | 0 |
| How Groove Gang is shaking up the Ransomware-as-a-Service market to empower affiliates Intel 471 · github.com | 9 Sep 2021 | 1 | 1 | 3 |
| North Korean APT InkySquid Infects Victims Using Browser Exploits volexity.com | 17 Aug 2021 | 2 | 2 | 0 |
| Cobalt Strike: Favorite Tool from APT to Crimeware Proofpoint · github.com | 29 Jun 2021 | 1 | 1 | 0 |
| CVE-2021-30724: CVMServer Vulnerability in macOS and iOS trendmicro.com | 3 Jun 2021 | 1 | 0 | 0 |
| EtterSilent: the underground’s new favorite maldoc builder Intel 471 · github.com | 7 Apr 2021 | 1 | 1 | 2 |
| Secure containerized environments with updated threat matrix for Kubernetes microsoft.com | 23 Mar 2021 | 1 | 0 | 0 |
| Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities volexity.com | 2 Mar 2021 | 1 | 1 | 0 |
| BendyBear: Novel Chinese Shellcode Linked With Cyber Espionage Group BlackTech unit42.paloaltonetworks.com | 9 Feb 2021 | 2 | 2 | 0 |
| Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes unit42.paloaltonetworks.com | 3 Feb 2021 | 1 | 0 | 0 |
| New campaign targeting security researchers blog.google | 25 Jan 2021 | 1 | 1 | 0 |
| Ransomware-as-a-service: The pandemic within a pandemic Intel 471 · github.com | 16 Nov 2020 | 1 | 1 | 1 |
| Prioritizing “critical” vulnerabilities: A threat intelligence perspective Intel 471 · github.com | 12 Aug 2020 | 4 | 4 | 2 |
| Inside Microsoft 365 Defender: Mapping attack chains from cloud to endpoint microsoft.com | 18 Jun 2020 | 2 | 2 | 0 |
| Kinsing Malware Attacks Targeting Container Environment aquasec.com | 3 Apr 2020 | 1 | 1 | 0 |
| Ghost in the shell: Investigating web shell attacks microsoft.com | 4 Feb 2020 | 2 | 2 | 0 |
| TA428 Group abusing recent conflict between Iran and USA Lab52 / S2 Grupo · github.com | 9 Jan 2020 | 1 | 1 | 1 |
| Leviathan: Geostrategy and TTP (Tactics, Techniques and Procedures) Lab52 / S2 Grupo · github.com | 30 May 2019 | 4 | 4 | 1 |
| DNS Hijacking Abuses Trust In Core Internet Service blog.talosintelligence.com | 17 Apr 2019 | 10 | 10 | 0 |
| SpeakUp: A New Undetected Backdoor Linux Trojan research.checkpoint.com | 4 Feb 2019 | 6 | 4 | 0 |
| Golden Chickens: Uncovering a Malware-as-a-Service (MaaS) Provider QuoIntelligence · github.com | 29 Nov 2018 | 3 | 3 | 2 |
| Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows unit42.paloaltonetworks.com | 17 Sep 2018 | 1 | 1 | 0 |
| Rocke: The Champion of Monero Miners blog.talosintelligence.com | 30 Aug 2018 | 2 | 2 | 0 |
| Patchwork APT Group Targets US Think Tanks volexity.com | 7 Jun 2018 | 1 | 1 | 0 |
| Cobalt Strikes Again, Spam Runs Target Russian Banks trendmicro.com | 20 Nov 2017 | 1 | 1 | 0 |
| Leviathan: Espionage Actor Targets Defense & Government proofpoint.com | 16 Oct 2017 | 2 | 2 | 0 |
| Emails with Backdoor Targets Russian Businesses trendmicro.com | 7 Aug 2017 | 1 | 1 | 0 |
| The Trail of BlackTech’s Cyber Espionage Campaigns trendmicro.com | 22 Jun 2017 | 5 | 5 | 0 |
| RATANKBA: Delving into Large-scale Watering Holes trendmicro.com | 27 Feb 2017 | 4 | 4 | 0 |
| BITTER: A Targeted Attack Against Pakistan | Forcepoint BITTER: a targeted attack against Pakistan forcepoint.com | 21 Oct 2016 | 1 | 1 | 0 |
| Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists unit42.paloaltonetworks.com | 24 Jan 2016 | 6 | 6 | 0 |
| Threat Spotlight: Group 72, Opening the ZxShell blogs.cisco.com | 28 Oct 2014 | 3 | 3 | 0 |
| ____________________________________________________________________________________________________ clearskysec.com | Undated | 1 | 1 | 0 |
| ____________________________________________________________________________________________________ clearskysec.com | Undated | 3 | 3 | 0 |
| (eset):research web-assets.esetstatic.com | Undated | 2 | 1 | 0 |
| #StopRansomware: Hive Ransomware cisa.gov | Undated | 5 | 5 | 1 |
| #StopRansomware: Medusa Ransomware cisa.gov | Undated | 4 | 4 | 1 |
| 2020 Financial Services and Insurance Industry Threat Report proofpoint.com | Undated | 7 | 6 | 0 |
| 2022OverWatchThreatHuntingReport go.crowdstrike.com | Undated | 3 | 3 | 0 |
| 260702 ic3.gov | Undated | 4 | 4 | 0 |
| 34273894723094830293843427389472309483029384 services.google.com | Undated | 3 | 2 | 0 |
| 3CXDesktopApp Backdoored in a Suspected Lazarus Campaign blog.qualys.com | Undated | 1 | 0 | 0 |
| A brief history and further technical analysis of Sodinokibi Ransomware picussecurity.com | Undated | 1 | 1 | 1 |
| A lookback under the TA410 umbrella: Its cyberespionage TTPs and activity welivesecurity.com | Undated | 2 | 2 | 1 |
| AA20-258A: Chinese Ministry of State Security-Affiliated Cyber Threat Actor Activity us-cert.cisa.gov | Undated | 4 | 4 | 2 |
| AA21-200B: Chinese State-Sponsored Cyber Operations: Observed TTPs us-cert.cisa.gov | Undated | 3 | 3 | 0 |
| Advisory further TTPs associated with SVR cyber actors ncsc.gov.uk | Undated | 15 | 15 | 0 |
| Advisory: APT29 targets ncsc.gov.uk | Undated | 4 | 4 | 0 |
| Agent Tesla | Old RAT Uses New Tricks to Stay on Top sentinelone.com | Undated | 2 | 2 | 0 |
| Analyzing Attacker Behavior Post-Exploitation of MS Exchange rapid7.com | Undated | 1 | 0 | 0 |
| Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years sentinelone.com | Undated | 3 | 3 | 0 |
| APT-31 Leverages COVID-19 Vaccine Theme zscaler.com | Undated | 1 | 1 | 0 |
| APT44: Unearthing services.google.com | Undated | 3 | 3 | 0 |
| Bitdefender In depth analysis of APT28–The Political Cyber Espionage download.bitdefender.com | Undated | 1 | 0 | 0 |
| Bitdefender Labs bitdefender.com | Undated | 1 | 1 | 0 |
| Blackcat blog.group-ib.com | Undated | 3 | 3 | 1 |
| BlackEnergy & Quedagh: The convergence of crimeware and APT attacks blog-assets.f-secure.com | Undated | 1 | 1 | 0 |
| Blog | Arctic Wolf arcticwolf.com | Undated | 12 | 8 | 0 |
| Blue Mockingbird activity mines Monero cryptocurrency redcanary.com | Undated | 1 | 1 | 0 |
| Bored BeaverTail & InvisibleFerret Yacht Club esentire.com | Undated | 2 | 2 | 0 |
| BRONZE UNION Cyberespionage Persists Despite Disclosures sophos.com | Undated | 1 | 1 | 1 |
| Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem security.com | Undated | 1 | 1 | 0 |
| CanisterWorm Gets Teeth: TeamPCP's Kubernetes Wiper Targets Iran aikido.dev | Undated | 1 | 0 | 0 |
| Centreon to Exim and Back: On the Trail of Sandworm domaintools.com | Undated | 2 | 1 | 0 |
| China-Based APT Mustang Panda Targets Minority Groups, Public and Private Sector Organizations anomali.com | Undated | 1 | 0 | 0 |
| Chinese Threat Actor Used Modified Cobalt Strike Variant to Attack Taiwanese Critical Infrastructure blog.eclecticiq.com | Undated | 5 | 5 | 0 |
| Cisco Event Response: Continued Attacks Against Cisco Firewalls sec.cloudapps.cisco.com | Undated | 3 | 2 | 0 |
| CISCO SD-WAN THREAT HUNT GUIDE cyber.gov.au | Undated | 1 | 1 | 1 |
| Cloaked and Covert: Uncovering UNC3886 Espionage Operations cloud.google.com | Undated | 5 | 5 | 0 |
| Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System cisa.gov | Undated | 6 | 6 | 1 |
| Cyber Activity Impacting CISCO ASA VPNs - Canadian Centre for Cyber Security cyber.gc.ca | Undated | 2 | 2 | 0 |
| Darkhotel’s attacks in 2015 securelist.com | Undated | 1 | 1 | 0 |
| DarkVishnya: Banks attacked through direct connection to local network securelist.com | Undated | 1 | 1 | 0 |
| Detecting and mitigating Active Directory compromises cyber.gov.au | Undated | 1 | 1 | 0 |
| Disclaimer: This document is marked TLP:CLEAR. Disclosure is not limited. Sources may use TLP:CLEAR when information carries minimal or no foreseeable media.defense.gov | Undated | 2 | 2 | 1 |
| Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S. security.com | Undated | 1 | 1 | 0 |
| Ending Cyber Risk with Aurora Endpoint Security arcticwolf.com | Undated | 5 | 2 | 0 |
| Energy Sector Incident Report cert.pl | Undated | 1 | 0 | 0 |
| Enigma Stealer Targets Cryptocurrency Industry with Fake Jobs trendmicro.com | Undated | 1 | 1 | 1 |
| Eset gelsemium web-assets.esetstatic.com | Undated | 2 | 2 | 1 |
| ESET InvisiMole web-assets.esetstatic.com | Undated | 3 | 2 | 0 |
| Exbyte: BlackByte Ransomware Attackers Deploy New Exfiltration Tool security.com | Undated | 5 | 5 | 0 |
| FIN7.5: the infamous cybercrime rig “FIN7” continues its activities securelist.com | Undated | 1 | 1 | 0 |
| Get a Handle on cd00r: The Invisible Backdoor giac.org | Undated | 1 | 0 | 0 |
| GitHub User Compromised with Invisible Malware aikido.dev | Undated | 1 | 0 | 0 |
| Group5: Syria and the Iranian Connection citizenlab.ca | Undated | 1 | 1 | 0 |
| Higaisa or Winnti? APT41 backdoors, old and new ptsecurity.com | Undated | 1 | 1 | 0 |
| ICS/OT CYBERSECURITY hub.dragos.com | Undated | 7 | 3 | 0 |
| Impacket and Exfiltration Tool Used to Steal Sensitive Information from Defense Industrial Base Organization cisa.gov | Undated | 4 | 4 | 1 |
| Industrial Cybersecurity Threat Briefing boozallen.com | Undated | 6 | 3 | 0 |
| INSIGHTS FROM THE crowdstrike.com | Undated | 1 | 1 | 0 |
| IOC Extinction? China-Nexus Cyber Espionage Actors Use ORB Networks to Raise Cost on Defenders cloud.google.com | Undated | 1 | 1 | 0 |
| Iran-Based Threat Actor Exploits VPN Vulnerabilities cisa.gov | Undated | 4 | 4 | 1 |
| Iranian Government-Sponsored APT Actors Compromise Federal Network, Deploy Crypto Miner, Credential Harvester cisa.gov | Undated | 1 | 1 | 0 |
| It’s Parliamentary: KeyBoy and the Targeting of the Tibetan Community citizenlab.ca | Undated | 5 | 5 | 0 |
| Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation cloud.google.com | Undated | 5 | 4 | 1 |
| Japan-Linked Organizations Targeted in Long-Running and Sophisticated Attack Campaign security.com | Undated | 1 | 1 | 0 |
| Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions security.com | Undated | 1 | 1 | 0 |
| LightSpy Malware Variant Targeting macOS huntress.com | Undated | 2 | 2 | 0 |
| LockBit 2.0: How This RaaS Operates and How to Protect Against It unit42.paloaltonetworks.com | Undated | 4 | 4 | 1 |
| LockBit Ransomware 2.0 Resurfaces blog.cyble.com | Undated | 1 | 1 | 0 |
| M-T RENDS2018 static.carahsoft.com | Undated | 2 | 2 | 0 |
| Malicious ISO File Leads to Domain Wide Ransomware thedfirreport.com | Undated | 1 | 1 | 0 |
| McAfee Defender’s Blog: NetWalker mcafee.com | Undated | 4 | 4 | 1 |
| Microsoft research uncovers new Zerobot capabilities microsoft.com | Undated | 27 | 12 | 1 |
| Microsoft Security download.microsoft.com | Undated | 46 | 33 | 0 |
| Microsoft Security download.microsoft.com | Undated | 39 | 31 | 0 |
| Microsoft Word - JCSA-20241030-001 ic3.gov | Undated | 1 | 1 | 1 |
| MONSOON – ANALYSIS OF AN APT CAMPAIGN forcepoint.com | Undated | 4 | 4 | 0 |
| MoustachedBouncer: Espionage against foreign diplomats in Belarus welivesecurity.com | Undated | 2 | 2 | 0 |
| Nation-state threat actor Mint Sandstorm refines tradecraft to attack high-value targets microsoft.com | Undated | 4 | 4 | 0 |
| Nefilim Ransomware blog.qualys.com | Undated | 2 | 2 | 0 |
| Notorious Cybercrime Gang, FIN7, Lands Malware in Law Firm esentire.com | Undated | 3 | 3 | 0 |
| NotPetya Technical Analysis – A Triple Threat: File Encryption, MFT Encryption, Credential Theft crowdstrike.com | Undated | 1 | 1 | 1 |
| Objective-See's Blog OSX.CDDS (OSX.MacMa) objective-see.org | Undated | 2 | 2 | 0 |
| Operation Cloud Hopper: Technical Annex pwc.co.uk | Undated | 1 | 1 | 0 |
| Operation Dust Storm s7d2.scene7.com | Undated | 6 | 3 | 0 |
| Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data documents.trendmicro.com | Undated | 2 | 2 | 1 |
| Operation Transparent Title proofpoint.com | Undated | 1 | 1 | 0 |
| Operation Tropic Trooper: Relying on Tried-and-Tested Flaws to Infiltrate Secret Keepers documents.trendmicro.com | Undated | 2 | 2 | 0 |
| Operation Wilted Tulip clearskysec.com | Undated | 1 | 1 | 0 |
| OVERRULED: Containing a Potentially Destructive Adversary cloud.google.com | Undated | 2 | 2 | 0 |
| People’s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action cisa.gov | Undated | 5 | 5 | 0 |
| Picus-RedReport-2024 picussecurity.com | Undated | 9 | 5 | 0 |
| Platinum feature article Targeted attacks in South and Southeast Asia April 2016 download.microsoft.com | Undated | 4 | 4 | 0 |
| Popular telnyx package compromised on PyPI by TeamPCP aikido.dev | Undated | 2 | 1 | 0 |
| Qilin Ransomware Analysis: Critical TTPs and Defense picussecurity.com | Undated | 1 | 1 | 0 |
| RaaS AvosLocker Incident Response Analysis linkedin.com | Undated | 8 | 5 | 0 |
| RansomHub never sleeps episode 1 group-ib.com | Undated | 3 | 3 | 0 |
| Recent Cloud Atlas activity securelist.com | Undated | 2 | 2 | 0 |
| RECON MTL 2017 evolution of pirpi recon.cx | Undated | 6 | 6 | 0 |
| redpenguin-wp-draft-20250311 supportportal.juniper.net | Undated | 1 | 1 | 0 |
| REPORT ON THE INVESTIGATION INTO THE MALWARE-AS-A-SERVICE media.kasperskycontenthub.com | Undated | 1 | 1 | 0 |
| Report2020CrowdStrikeGlobalThreatReport go.crowdstrike.com | Undated | 1 | 1 | 0 |
| Return of the Higaisa APT zscaler.com | Undated | 1 | 1 | 0 |
| REvil Ransomware-as-a-Service: An analysis of a ransomware affiliate operation intel471.com | Undated | 2 | 2 | 0 |
| Rocke Evolves Its Arsenal With a New Malware Family Written in Golang anomali.com | Undated | 1 | 0 | 0 |
| Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure cisa.gov | Undated | 10 | 9 | 1 |
| RYUK RANSOMWARE cert.ssi.gouv.fr | Undated | 1 | 1 | 0 |
| S1ngularity/nx attackers strike again aikido.dev | Undated | 1 | 0 | 0 |
| Secure Cloud Analytics Alerts and Observations Reference Guide cisco.com | Undated | 3 | 2 | 0 |
| Security Response docs.broadcom.com | Undated | 1 | 1 | 0 |
| ShadowRay: First Known Attack Campaign Targeting AI Workloads Exploited In The Wild oligo.security | Undated | 5 | 0 | 0 |
| SharpPanda APT Campaign Expands its Arsenal Targeting G20 Nations blog.cyble.com | Undated | 3 | 3 | 1 |
| ShinyHunters Calling: Financially Motivated Data Extortion Group Targeting Enterprise Cloud Applications blog.eclecticiq.com | Undated | 1 | 1 | 0 |
| Shlayer malware abusing Gatekeeper bypass on macOS jamf.com | Undated | 1 | 1 | 0 |
| Sofacy APT hits high profile targets with updated toolset securelist.com | Undated | 1 | 1 | 0 |
| SPAWNCHIMERA Malware: The Chimera Spawning from Ivanti Connect Secure Vulnerability blogs.jpcert.or.jp | Undated | 2 | 1 | 0 |
| Take a “NetWalk” on the Wild Side mcafee.com | Undated | 4 | 4 | 1 |
| TeamPCP deploys CanisterWorm on NPM following Trivy compromise aikido.dev | Undated | 1 | 0 | 0 |
| Tech brief untangling the patchwork cyberespionage group documents.trendmicro.com | Undated | 5 | 5 | 0 |
| Technical Analysis of PureCrypter zscaler.com | Undated | 1 | 1 | 0 |
| Technical Analysis: Black Basta Malware Overview quadrantsec.com | Undated | 1 | 0 | 0 |
| The cyber threat from supply chains - Canadian Centre for Cyber Security cyber.gc.ca | Undated | 2 | 1 | 0 |
| THE DUKES 7 YEARS OF RUSSIAN CYBERESPIONAGE blog-assets.f-secure.com | Undated | 4 | 4 | 0 |
| The Epic Turla Operation media.kasperskycontenthub.com | Undated | 1 | 1 | 0 |
| The Mac Malware of 2024 objective-see.org | Undated | 1 | 1 | 0 |
| The Overlooked North Korean Actor services.google.com | Undated | 15 | 13 | 0 |
| The Tortoise and The Malwahare pwc.com | Undated | 3 | 2 | 0 |
| TheNaikonAPT MsnMM1 media.kasperskycontenthub.com | Undated | 3 | 3 | 0 |
| This document is marked TLP:CLEAR. Disclosure is not limited. Sources may use TLP:CLEAR when information cisa.gov | Undated | 1 | 1 | 0 |
| THREAT ANALYSIS REPORT: Bumblebee Loader – The High Road to Enterprise Domain Control cybereason.com | Undated | 1 | 1 | 0 |
| Trellix SecondSight Threat Hunting Report, Feb 2026 trellix.com | Undated | 1 | 1 | 0 |
| Trellix Threat Report, April 2022 trellix.com | Undated | 1 | 1 | 0 |
| TTPs used by BlackByte Ransomware Targeting Critical Infrastructure picussecurity.com | Undated | 3 | 3 | 1 |
| U/OO/140757-20 PP-20-0393 28 May 2020 media.defense.gov | Undated | 1 | 1 | 0 |
| U/OO/158036-21 media.defense.gov | Undated | 2 | 2 | 0 |
| Ukraine: Disk-wiping Attacks Precede Russian Invasion security.com | Undated | 1 | 0 | 0 |
| UNC215: Spotlight on a Chinese Espionage Campaign in Israel fireeye.com | Undated | 1 | 1 | 0 |
| UNC5221’s Latest Exploit: Weaponizing CVE-2025-22457 in Ivanti Connect Secure picussecurity.com | Undated | 1 | 1 | 0 |
| Uncovering DRBControl: Inside the Cyberespionage Campaign Targeting Gambling Operations documents.trendmicro.com | Undated | 1 | 1 | 0 |
| Us 21 Anatomy Of Native Iis Malware wp i.blackhat.com | Undated | 4 | 4 | 0 |
| VB2020 06 vb2020.vblocalhost.com | Undated | 5 | 4 | 0 |
| VB2021 paper: The Baffling Berserk Bear: A Decade’s Activity Targeting Critical Infrastructur vblocalhost.com | Undated | 1 | 1 | 0 |
| Version: 1.5 media.kasperskycontenthub.com | Undated | 6 | 4 | 0 |
| Vice Society leverages PrintNightmare in ransomware attacks blog.talosintelligence.com | Undated | 2 | 2 | 1 |
| Vice Society: Profiling a Persistent Threat to the Education Sector unit42.paloaltonetworks.com | Undated | 2 | 2 | 2 |
| ViperSoftX Updates Encryption, Steals Data trendmicro.com | Undated | 1 | 0 | 0 |
| VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors cloud.google.com | Undated | 2 | 2 | 0 |
| Whitepaper Name Goes trustwave.com | Undated | 18 | 4 | 0 |
| Who’s swimming in South Korean waters? Meet ScarCruft’s Dolphin welivesecurity.com | Undated | 1 | 1 | 1 |
| WIN32/INDUSTROYER web-assets.esetstatic.com | Undated | 1 | 0 | 0 |
| WTB: Adwind Trojan Circumvents Antivirus Software To Infect Your PC anomali.com | Undated | 4 | 0 | 1 |
| WTB: Remote Mac Exploitation Via Custom URL Schemes anomali.com | Undated | 1 | 1 | 0 |
| Zero-Day Vulnerability in MOVEit Transfer Exploited for Data Theft mandiant.com | Undated | 1 | 1 | 0 |