Meta tags:
Headings (most frequently used words):
automated, collection, procedure, examples, mitigations, detection, strategy, references,
Text of the page (most frequently used words):
and (120), the (89), retrieved (88), data (34), files (33), 2020 (30), from (30), automatically (30), for (29), may (28), 2024 (26), file (26), #collect (24), information (22), april (21), used (21), has (20), 2019 (19), july (19), can (19), june (18), 2018 (18), threat (18), 2026 (17), with (16), collection (16), system (16), all (15), november (15), january (14), 2021 (14), 2025 (14), october (13), march (13), stealer (13), automated (13), techniques (12), december (12), 2022 (12), group (11), att (10), february (10), august (10), 2016 (10), extensions (10), victim (10), list (10), use (9), 2023 (9), target (9), cyber (9), 2017 (9), cloud (9), enterprise (8), compromised (8), september (8), campaign (8), adversary (8), server (8), command (8), attack (7), new (7), shai (7), hulud (7), scripts (7), name (7), documents (7), them (7), script (7), collected (7), directory (7), intelligence (6), malware (6), team (6), about (6), tools (6), operation (6), one (6), user (6), into (6), based (6), access (6), through (6), that (6), identify (6), exfiltration (6), systems (6), drives (6), archive (6), machine (6), ics (5), mobile (5), none (5), detection (5), research (5), espionage (5), networks (5), back (5), unit (5), apt (5), strelastealer (5), microsoft (5), sharepoint (5), security (5), raccoon (5), version (5), actors (5), organizations (5), targeting (5), directories (5), storage (5), other (5), recursively (5), txt (5), removable (5), predefined (5), during (5), batch (5), gather (5), tool (5), mitre (4), are (4), resources (4), campaigns (4), zebrocy (4), part (4), custom (4), targets (4), environments (4), uses (4), analysis (4), credentials (4), exploitation (4), long (4), redcurl (4), remote (4), invisimole (4), patchwork (4), also (4), sensitive (4), using (4), scripting (4), clipboard (4), certain (4), collects (4), doc (4), docx (4), xls (4), xlsx (4), pptx (4), specific (4), search (4), executes (4), local (4), network (4), configuration (4), set (4), control (4), such (4), copy (4), discovery (4), groups (3), cti (3), mitigations (3), defenses (3), sub (3), winter (3), vivern (3), analyzing (3), windtail (3), vermin (3), valak (3), air (3), gapped (3), tropic (3), trooper (3), persists (3), you (3), supply (3), chain (3), tajmahal (3), t9000 (3), backdoor (3), strongpity (3), large (3), sidewinder (3), attacks (3), faou (3), read (3), rtm (3), rover (3), rotajakiro (3), roadtools (3), azure (3), ramsay (3), python (3), poshc2 (3), poetrat (3), pacu (3), your (3), phishing (3), outsteel (3), wocao (3), hidden (3), nppspy (3), netwire (3), mini (3), micropsia (3), metamorfo (3), messagetap (3), targeted (3), services (3), under (3), logs (3), lightneuron (3), code (3), execution (3), actor (3), lamehug (3), intrusion (3), across (3), oilrig (3), helminth (3), goldfinder (3), gamaredon (3), fin6 (3), open (3), frankenstein (3), darkgate (3), cryptocurrency (3), crutch (3), confucius (3), related (3), comnie (3), bankshot (3), commands (3), attor (3), apt41 (3), dust (3), apt1 (3), anthropic (3), orchestrated (3), agrius (3), sms (3), api (3), content (3), via (3), utilities (3), discover (3), exfiltrate (3), description (3), over (3), time (3), encrypted (3), scans (3), following (3), pdf (3), before (3), http (3), ability (3), ppt (3), host (3), sends (3), scan (3), store (3), within (3), empire (3), this (3), technique (3), corporation (2), website (2), domains (2), reference (2), software (2), components (2), analytics (2), strategies (2), assets (2), tactics (2), matrices (2), core (2), objects (2), eset (2), sednit (2), cert (2), aka (2), east (2), implant (2), linked (2), rat (2), ukraine (2), attacking (2), chen (2), usbferry (2), counter (2), bronze (2), cyberespionage (2), know (2), sophisticated (2), framework (2), grunzweig (2), working (2), hours (2), force (2), scale (2), blog (2), mail (2), active (2), cve (2), detecting (2), against (2), russian (2), banking (2), boutin (2), live (2), pierre (2), bourhis (2), quentin (2), bourgue (2), sekoia (2), tdr (2), sherstobitoff (2), steal (2), lures (2), sectors (2), perez (2), check (2), pulse (2), include (2), document (2), china (2), serpens (2), passwords (2), adversaries (2), text (2), turla (2), email (2), prompt (2), government (2), america (2), hromcova (2), spyware (2), card (2), follow (2), dissecting (2), enter (2), ransomware (2), lunghi (2), activity (2), mandiant (2), graph (2), non (2), agents (2), powershell (2), onedrive (2), pbpaste (2), repeated (2), shell (2), events (2), enumerate (2), line (2), platforms (2), analytic (2), encryption (2), off (2), way (2), mitigate (2), but (2), not (2), stop (2), acquiring (2), period (2), able (2), means (2), rar (2), jpg (2), jpeg (2), various (2), types (2), identified (2), void (2), manticore (2), saves (2), generated (2), module (2), report (2), credential (2), later (2), usbstealer (2), compile (2), 3390 (2), teampcp (2), compress (2), searches (2), devices (2), matching (2), gathered (2), without (2), shimratreporter (2), iterate (2), toolshell (2), monitors (2), browsing (2), screenshots (2), url (2), linux (2), tagging (2), collecting (2), proxysvc (2), reports (2), loop (2), every (2), memory (2), pacemaker (2), specified (2), mythic (2), mustang (2), panda (2), password (2), odt (2), csv (2), continuous (2), message (2), number (2), menupass (2), including (2), details (2), lumma (2), lofise (2), ke3chang (2), well (2), hafnium (2), stored (2), packet (2), response (2), interesting (2), monitor (2), funnydream (2), username (2), domain (2), fin5 (2), ember (2), bear (2), images (2), then (2), chimera (2), ccf32 (2), usb (2), badnews (2), arcanedoor (2), apt28 (2), appleseed (2), sql (2), extract (2), t1119 (2), could (2), location (2), ckcon (2), person (2), tickets (2), faq (2), 2015, registered, trademarks, cookie, preferences, changelog, privacy, policy, terms, contact, reset, filters, journey, land, what, going, uac, 0114, ukrainian, polish, gov, entities, 5909, wardle, patrick, middle, windshift, osx, domaintools, investigations, handala, mois, influence, ecosystem, assessment, lancaster, cortes, quasar, reaves, platt, connection, gozi, loader, confcrew, calvet, 2014, union, despite, disclosures, aqua, update, ongoing, investigation, continued, remediation, mccarthy, trivy, everything, need, latest, great, project, miller, osborn, advanced, modular, complex, anti, tudorica, revealing, trojanized, infrastructure, golo, mühr, joe, fasulo, charlotte, hammond, ibm, strela, today, invoice, tomorrow, phish, fortgale, benjamin, chang, goutam, tripathy, pranay, kumar, chhaparwal, anmol, maurya, vishwa, thothathri, palo, alto, early, dcso, cytec, shortandmalicious, aims, hegel, global, perspective, yonathan, klijnsma, mofang, politically, motivated, stealing, vulnerabilities, brief, updated, trend, micro, proactive, insights, 53770, 53771, defender, guidance, investigating, defending, gianpietro, cutolo, aggressive, fast, spreading, charlie, eriksen, s1ngularity, attackers, strike, again, duncan, harbison, language, malspam, pushing, redaman, manual, guide, trojan, ray, hayashi, indian, ambassador, afghanistan, alex, turing, hui, wang, secret, dirk, jan, mollema, introducing, exploration, awakening, pentest, didn, sanmillan, toolkit, tailored, depth, return, dead, s2w, talon, malhotra, ghostsecret, seeks, worldwide, nettitude, mercer, covid, azerbaijan, public, private, rhino, labs, suspected, leverage, authentication, bypass, secure, zero, day, spear, payloads, downloader, saintbot, dantzig, schamper, shining, light, hacking, unit42, evasive, playbook, viewer, dray, agha, cleartext, shenanigans, gifting, lambert, intro, thomas, mythc, documentation, president, ngos, flashpoint, worm, era, tsarfaty, sierra, iglesias, brazilian, users, leong, dean, who, reading, messages, symantec, japan, running, cybereaon, lummanagement, rise, lummastealer, dedola, toddycat, keep, calm, away, google, gtig, tracker, advances, usage, conteras, splunk, payload, llm, driven, mstic, nickel, latin, europe, cherpanov, story, hromcová, surprisingly, equipped, undercover, since, 2013, falcone, lee, saudi, arabian, deliver, silk, typhoon, nafisi, lelli, goldmax, sibot, nobelium, layered, persistence, grows, its, game, magecart, skimmers, injected, online, shops, fireeye, money, operations, crime, bromiley, lewis, hospitality, gaming, industries, tracking, attacker, around, world, years, adamitis, alive, cobble, together, source, pieces, monstrous, cadet, blizzard, emerges, novel, distinct, adi, zeligson, rotem, kerner, mining, keeping, door, pegasus, pakistani, military, continues, asia, jansen, abusing, fly, radar, vrabie, chinese, south, eastern, asian, institutions, cobra, turkish, financial, sector, untangling, tor, communications, meet, fantasy, creature, spy, platform, canadian, centre, impacting, cisco, asa, vpns, mike, stokkel, arisen, mueller, indictment, united, states, viktor, borisovich, netyksho, exposing, units, kisa, reconnaissance, resource, muzabi, disrupting, first, reported, chechik, tom, fakterman, daniel, frank, assaf, dahan, agonizing, israeli, higher, education, tech, why, texting, unc3944, leverages, sim, swapping, extortion, notoriety, references, suspicious, sign, ins, browser, often, programmatic, mailbox, an0534, applescript, third, party, automation, frameworks, automator, bursts, observable, unified, an0533, like, xclip, detectable, auditd, syscall, osquery, an0532, native, focus, engine, commonly, leveraged, an0531, det0186, strategy, m1029, strong, should, prevent, offline, cracking, brute, encrypt, m1041, mitigation, zip, bmp, tiff, kum, tlg, sbx, hse, hsf, lhz, s0251, delivered, capable, scanning, machines, looking, exfiltrating, g1035, add, possess, array, archiving, s0466, conducted, stryker, consistent, scripted, g1055, each, format, yyyy, s0257, download, build, harvested, s0476, s0136, g0081, ran, interest, g0027, paths, developer, tooling, container, enviornments, s9041, index, send, queue, s0467, pre, defined, any, written, s0098, searcher, component, s0491, attempts, login, thunderbird, outlook, s1183, g0121, instruction, compiled, sent, operators, s0445, web, config, expose, machinekey, settings, c0058, secrets, endpoints, s9008, captures, browses, strings, s0148, regular, timeframe, s0090, depending, distribution, device, s1078, gathers, s0684, g1039, conduct, initial, word, media, connected, continue, s0458, downloaded, servers, s1148, s0238, contains, parsing, valid, credit, numbers, s0378, monitoring, track, modification, enable, automatic, s0428, developed, executed, upload, g0040, cloudformation, templates, ec2, aws, inspector, iam, s1091, entries, seconds, order, application, proc, s1109, s1017, infected, c0014, g0049, recorded, s1131, s0198, supports, downloads, s0699, g0129, vaults, stolen, leveraging, both, primary, fallback, s9043, mdb, accde, accdb, s0339, mouse, clicks, timers, contents, s0455, checks, two, keyword_parm, parm, instructions, how, save, parsed, extracted, traffic, contained, either, phone, imsi, keyword, matched, saved, theft, s0443, csvde, g0045, wallet, s1213, three, place, protected, further, s1101, configured, s0395, hosts, s9035, performed, frequent, scheduled, g0004, sort, generate, newly, inserted, drive, s0260, vbscript, receives, execute, s0170, msgraph, g0125, logged, route, hops, took, hardcoded, status, headers, values, received, node, s0597, deployed, g0047, changes, s1044, c0001, pos, remove, log, bind, submit, payment, button, g0037, processes, environment, pull, results, g0053, s0363, engages, mass, intrusions, g1003, associated, wallets, notifies, when, s1111, s0538, png, xlm, odp, ods, rtf, xlsm, g0142, temp, info, dat, uploads, temporarily, s0244, dlls, retrieval, g0114, s1043, generates, s0239, copies, s0128, s0438, included, capture, c0046, sqluldr2, pinegrove, database, c0040, publicly, available, multiple, dccc, dnc, g0007, perform, series, g0006, keystrokes, screen, s0622, claude, process, volumes, human, direction, c0062, query, databases, personally, identifiable, net4, exe, g1030, procedure, examples, permalink, last, modified, created, arun, seelagan, cisa, praetorian, contributors, iaas, office, suite, saas, windows, macos, tactic, incorporate, move, object, service, dashboard, lateral, transfer, functionality, built, apis, pipelines, interfaces, transform, load, etl, once, established, internal, methods, performing, fitting, criteria, type, intervals, interpreter, home, join, mclean, hotel, found, register, here, contribute, benefactors, legal, branding, updates, history, engage, advisory, council, learn, more, get, started, detections,
Text of the page (random words):
ms that automatically scan for interesting documents 23 s0597 goldfinder goldfinder logged and stored information related to the route or hops a packet took from a compromised machine to a hardcoded c2 server including the target c2 url http response status code http response headers and values and data received from the c2 node 24 g0125 hafnium hafnium has used msgraph to exfiltrate data from email onedrive and sharepoint 25 s0170 helminth a helminth vbscript receives a batch script to execute a set of commands in a command prompt 26 s0260 invisimole invisimole can sort and collect specific documents as well as generate a list of all files on a newly inserted drive and store them in an encrypted file 27 28 g0004 ke3chang ke3chang has performed frequent and scheduled data collection from victim networks 29 s9035 lamehug lamehug can recursively copy files from targeted directories on victim hosts 30 31 s0395 lightneuron lightneuron can be configured to automatically collect files under a specified directory 32 s1101 lofise lofise can collect all the files from the working directory every three hours and place them into a password protected archive for further exfiltration 33 s1213 lumma stealer lumma stealer has automated collection of various information including cryptocurrency wallet details 34 g0045 menupass menupass has used the csvde tool to collect active directory files and data 35 s0443 messagetap messagetap checks two files keyword_parm txt and parm txt for instructions on how to target and save data parsed and extracted from sms message data from the network traffic if an sms message contained either a phone number imsi number or keyword that matched the predefined list it is saved to a csv file for later theft by the threat actor 36 s0455 metamorfo metamorfo has automatically collected mouse clicks continuous screenshots on the machine and set timers to collect the contents of the clipboard and website browsing 37 s0339 micropsia micropsia executes an rar tool to recursively archive files based on a predefined list of file extensions xls xlsx csv odt doc docx ppt pptx pdf mdb accdb accde txt 38 s9043 mini shai hulud mini shai hulud has the ability to automatically compile gathered credentials from configuration files and password vaults within an archive and exfiltrate stolen data leveraging both a primary and fallback c2 39 g0129 mustang panda mustang panda used custom batch scripts to collect files automatically from a targeted system 40 s0699 mythic mythic supports scripting of file downloads from agents 41 s0198 netwire netwire can automatically archive collected data 42 s1131 nppspy nppspy collection is automatically recorded to a specified file on the victim machine 43 g0049 oilrig oilrig has used automated collection 44 c0014 operation wocao during operation wocao threat actors used a script to collect information about the infected system 45 s1017 outsteel outsteel can automatically scan for and collect files with specific extensions 46 s1109 pacemaker pacemaker can enter a loop to read proc entries every 2 seconds in order to read a target application s memory 47 s1091 pacu pacu can automatically collect data such as cloudformation templates ec2 user data aws inspector reports and iam credential reports 48 g0040 patchwork patchwork developed a file stealer to search c and collect files with certain extensions patchwork also executed a script to enumerate all drives store them as a list and upload generated files to the c2 server 10 s0428 poetrat poetrat used file system monitoring to track modification and enable automatic exfiltration 49 s0378 poshc2 poshc2 contains a module for recursively parsing through files and directories to gather valid credit card numbers 50 s0238 proxysvc proxysvc automatically collects data about the victim and sends it to the control server 51 s1148 raccoon stealer raccoon stealer collects files and directories from victim systems based on configuration data downloaded from command and control servers 52 53 54 s0458 ramsay ramsay can conduct an initial scan for microsoft word documents on the local system removable media and connected network drives before tagging and collecting them it can continue tagging documents to collect with follow up scans 55 g1039 redcurl redcurl has used batch scripts to collect data 56 57 s0684 roadtools roadtools automatically gathers data from azure ad environments using the azure graph api 58 s1078 rotajakiro depending on the linux distribution rotajakiro executes a set of commands to collect device information and sends the collected information to the c2 server 59 s0090 rover rover automatically collects files from the local system and removable drives based on a predefined list of file extensions on a regular timeframe 60 s0148 rtm rtm monitors browsing activity and automatically captures screenshots if a victim browses to a url matching one of a list of strings 61 62 s9008 shai hulud shai hulud has the ability to automatically collect host data secrets system information and endpoints 63 64 65 c0058 sharepoint toolshell exploitation during sharepoint toolshell exploitation threat actors used a command shell to automatically iterate through web config files to expose and collect machinekey settings 66 67 s0445 shimratreporter shimratreporter gathered information automatically without instruction from a c2 related to the user and host machine that is compiled into a report and sent to the operators 68 g0121 sidewinder sidewinder has used tools to automatically collect system and network configuration information 69 s1183 strelastealer strelastealer attempts to identify and collect mail login data from thunderbird and outlook following execution 70 71 72 73 s0491 strongpity strongpity has a file searcher component that can automatically collect and archive files based on a predefined list of file extensions 74 s0098 t9000 t9000 searches removable storage devices for files with a pre defined list of file extensions e g doc ppt xls docx pptx xlsx any matching files are encrypted and written to a local user directory 75 s0467 tajmahal tajmahal has the ability to index and compress files into a send queue for exfiltration 76 s9041 teampcp cloud stealer teampcp cloud stealer can identify and collect credentials across over 50 file paths in cloud ci cd developer tooling and container enviornments 77 78 g0027 threat group 3390 threat group 3390 ran a command to compile an archive of file types of interest from the victim user s directories 79 g0081 tropic trooper tropic trooper has collected information automatically using the adversary s usbferry attack 80 s0136 usbstealer for all non removable drives on a victim usbstealer executes automated collection of certain files for later exfiltration 81 s0476 valak valak can download a module to search for and build a report of harvested credential data 82 s0257 vermin vermin saves each collected file with the automatically generated format 0 dd mm yyyy txt 83 g1055 void manticore void manticore conducted large scale data exfiltration in the stryker operation consistent with automated or scripted collection against enterprise systems 84 s0466 windtail windtail can identify and add files that possess specific file extensions to an array for archiving 85 g1035 winter vivern winter vivern delivered a powershell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via http 86 s0251 zebrocy zebrocy scans the system and automatically collects files with the following extensions doc docx xls xlsx pdf pptx rar zip jpg jpeg bmp tiff kum tlg sbx cr hse hsf and lhz 87 88 mitigations id mitigation description m1041 encrypt sensitive information encryption and off system storage of sensitive information may be one way to mitigate collection of files but may not stop an adversary from acquiring the information if an intrusion persists over a long period of time and the adversary is able to discover and access the data through other means strong passwords should be used on certain encrypted documents that use them to prevent offline cracking through brute force techniques m1029 remote data storage encryption and off system storage of sensitive information may be one way to mitigate collection of files but may not stop an adversary from acquiring the information if an intrusion persists over a long period of time and the adversary is able to discover and access the data through other means detection strategy id name analytic id analytic description det0186 automated file and api collection detection across platforms an0531 automated execution of native utilities and scripts to discover enumerate and exfiltrate files and clipboard content focus is on detecting repeated file access scripting engine use and use of command line utilities commonly leveraged by collection scripts an0532 repeated or automated access to user document directories or clipboard using shell scripts or utilities like xclip pbpaste detectable via auditd syscall logs or osquery file events an0533 use of pbpaste applescript or third party automation frameworks e g automator to collect clipboard or file content in bursts observable via unified logs an0534 suspicious sign ins to graph api or sensitive resources using non browser scripting agents e g python powershell often for programmatic access to mailbox or onedrive content references mandiant intelligence 2023 september 14 why are you texting me unc3944 leverages sms phishing campaigns for sim swapping ransomware extortion and notoriety retrieved january 2 2024 or chechik tom fakterman daniel frank assaf dahan 2023 november 6 agonizing serpens aka agrius targeting the israeli higher education and tech sectors retrieved may 22 2024 anthropic 2025 november disrupting the first reported ai orchestrated cyber espionage campaign retrieved april 20 2026 kisa 2021 phishing target reconnaissance and attack resource analysis operation muzabi retrieved march 8 2024 mandiant n d apt1 exposing one of china s cyber espionage units retrieved july 18 2016 mueller r 2018 july 13 indictment united states of america vs viktor borisovich netyksho et al retrieved november 17 2024 mike stokkel et al 2024 july 18 apt41 has arisen from the dust retrieved september 16 2024 canadian centre for cyber security 2024 april 24 cyber activity impacting cisco asa vpns retrieved january 6 2025 hromcova z 2019 october at commands tor based communications meet attor a fantasy creature and also a spy platform retrieved may 6 2020 lunghi d et al 2017 december untangling the patchwork cyberespionage group retrieved july 10 2018 sherstobitoff r 2018 march 08 hidden cobra targets turkish financial sector with new bankshot implant retrieved may 18 2018 vrabie v 2020 november dissecting a chinese apt targeting south eastern asian government institutions retrieved september 19 2022 jansen w 2021 january 12 abusing cloud services to fly under the radar retrieved september 12 2024 grunzweig j 2018 january 31 comnie continues to target organizations in east asia retrieved june 7 2018 lunghi d 2021 august 17 confucius uses pegasus spyware related lures to target pakistani military retrieved december 26 2021 faou m 2020 december 2 turla crutch keeping the back door open retrieved december 4 2020 adi zeligson rotem kerner 2018 november 13 enter the darkgate new cryptocurrency mining and ransomware campaign retrieved february 9 2024 microsoft threat intelligence 2023 june 14 cadet blizzard emerges as a novel and distinct russian threat actor retrieved july 10 2023 adamitis d et al 2019 june 4 it s alive threat actors cobble together open source pieces into monstrous frankenstein campaign retrieved may 11 2020 bromiley m and lewis p 2016 october 7 attacking the hospitality and gaming industries tracking an attacker around the world in 7 years retrieved october 6 2017 fireeye threat intelligence 2016 april follow the money dissecting the operations of the cyber crime group fin6 retrieved november 17 2024 chen j 2019 october 10 magecart card skimmers injected into online shops retrieved september 9 2020 boutin j 2020 june 11 gamaredon group grows its game retrieved june 16 2020 nafisi r lelli a 2021 march 4 goldmax goldfinder and sibot analyzing nobelium s layered persistence retrieved march 8 2021 microsoft threat intelligence 2025 march 5 silk typhoon targeting it supply chain retrieved march 20 2025 falcone r and lee b 2016 may 26 the oilrig campaign attacks on saudi arabian organizations deliver helminth backdoor retrieved may 3 2017 hromcová z 2018 june 07 invisimole surprisingly equipped spyware undercover since 2013 retrieved july 10 2018 hromcova z and cherpanov a 2020 june invisimole the hidden part of the story retrieved july 16 2020 mstic 2021 december 6 nickel targeting government organizations across latin america and europe retrieved march 18 2022 conteras t splunk research team 2025 september 25 from prompt to payload lamehug s llm driven cyber intrusion retrieved april 21 2026 google threat intelligence group 2025 november 5 gtig ai threat tracker advances in threat actor usage of ai tools retrieved march 31 2026 faou m 2019 may turla lightneuron one email away from remote code execution retrieved june 24 2019 dedola g et al 2023 october 12 toddycat keep calm and check logs retrieved january 3 2024 cybereaon security services team n d your data is under new lummanagement the rise of lummastealer retrieved march 22 2025 symantec 2020 november 17 japan linked organizations targeted in long running and sophisticated attack campaign retrieved december 17 2020 leong r perez d dean t 2019 october 31 messagetap who s reading your text messages retrieved may 11 2020 sierra e iglesias g 2018 april 24 metamorfo campaigns targeting brazilian users retrieved july 30 2020 tsarfaty y 2018 july 25 micropsia malware retrieved november 13 2018 flashpoint 2026 may 28 the mini shai hulud worm and the new era of ci cd exploitation retrieved july 16 2026 counter threat unit research team 2019 december 29 bronze president targets ngos retrieved april 13 2021 thomas c n d mythc documentation retrieved march 25 2022 lambert t 2020 january 29 intro to netwire retrieved january 7 2021 dray agha 2022 august 16 cleartext shenanigans gifting user passwords to adversaries with nppspy retrieved may 17 2024 unit42 2016 may 1 evasive serpens unit 42 playbook viewer retrieved february 6 2023 dantzig m v schamper e 2019 december 19 operation wocao shining a light on one of china s hidden hacking groups retrieved october 8 2020 unit 42 2022 february 25 spear phishing attacks target organizations in ukraine payloads include the document stealer outsteel and the downloader saintbot retrieved june 9 2022 perez d et al 2021 april 20 check your pulse suspected apt actors leverage authentication bypass techniques and pulse secure zero day retrieved february 5 2024 rhino security labs 2019 august 22 ...
|
