Skip to content

Archive of publicly available threat INTel reports (mostly APT Reports but not limited to).

Notifications You must be signed in to change notification settings

jack8daniels2/threat-INTel

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

20 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Threat INTel Reports

Archive of publicly available threat/cybercrime INTel reports (mostly APT Reports but not limited to). Useful as a reference when you emulate threat actors on a daily basis. Please create an issue if I'm missing a relevant Report.

Note: If you are looking for every type of publicly available documents and notes related to APTs have a look at APTnotes and aptnotes. Unfortunately the way they store and sort their data doesn't work for me anymore.

2017

Title Month Source
APT28: A WINDOW INTO RUSSIAS CYBER ESPIONAGE OPERATIONS? Jan FireEye
APT28: At the center of the storm. Russia strategically evolves its cyber operations Jan FireEeye
APT28 Under the Scope A Journey into Exfiltrating Intelligence and Government Information Feb BitDefender
KingSlayer A Supply chain attack Feb RSA
Enhanced Analysis of GRIZZLY STEPPE Activity Feb US-CERT
Dissecting the APT28 Mac OS X Payload Feb Bitdefender
From Shamoon to StoneDrill Mar Kaspersky
LAZARUS UNDER THE HOOD Apr Kaspersky
Appendix B: Moonlight Maze Technical Report Apr Kaspersky
Callisto Group Apr F-Secure
McAfee Labs Threats Report Apr McAfee

2016

Title Month Source
Analyzing a New Variant of BlackEnergy 3 Likely Insider-Based Execution Jan SentinelOne
Operation Dusty Sky Jan ClearSky
Uncovering the Seven Pointed Dagger Jan Arbor Networks
Know Your Enemies 2.0: A Primer on Advanced Persistent Threat Groups Feb ICIT
Operation Duststorm Feb Cylance
peration Blockbuster Feb Novetta
From Seoul to Sony Feb Blue Coat
The Four Element Sword Engagement Apr Arbor Networks
PLATINUM Targeted attacks in South and Southeast Asia Apr Microsoft
Mofang: A politically motivated information stealing adversary May FoxIT
Operation Groundbait:Analysis of a surveillance toolkit May Kaspersky
APT Case RUAG Technical Report May Melani GovCERT
Operation DustySky Part 2 Jun ClearSky
Visiting The Bear Den A Journey in the Land of Cyber-Espionage Jun ESET
Pacifier APT Jul Bitdefender
Unveiling Patchwork the Copy Paste APT Jul Cymmetria
Operation Manul Aug EFF
Moonsoon - Analysis of an APT Campaign Aug Forcepoint
The ProjectSauron APT Aug Kaspersky
Carbanak Oracle Breach Aug VISA
Visa Alert and Update on the Oracle Breach Aug VISA
Ego Market When Greed for Fame Benefits Large-Scale Botnets Sep GoSecure
Hunting Libyan Scorpions Sep Cyberkov
En Route with Sednit Part 1: Approaching the Target Oct ESET
En Route with Sednit Part 2: Observing the Comings and Goings Oct ESET
En Route with Sednit Part 3: A Mysterious Downloader Oct ESET
Rootkit analysis Use case on HideDRV Oct Sekoia
Wave your false flags! Deception tactics muddying attribution in targeted attacks Oct Kaspersky
When The Lights Went Out: Ukraine Cybersecurity Threat Briefing Nov BAH
PROMETHIUM and NEODYMIUM: Parallel zero-day attacks targeting individuals in Europe Dec Microsoft
Use of Fancy Bear Android Malware tracking of Ukrainian Artillery Units Dec Crowdstrike
GRIZZLY STEPPE - Russian Malicious Cyber Activity Dec FBI

2015

Title Month Source
Insight In To A Strategic Web Compromise And Attack Campaign Against Hong Kong Infrastructure Jan Dragon Threat Labs
The Waterbug Attack Group Jan Symantec
CARBANAK APT THE GREAT BANK ROBBERY Feb Kaspersky
Behind The Syrian Conflict's Digital Front Lines Feb FireEye
The Desert Falcons Targeted Attacks Feb Kaspersky
Southeast Asia: An Evolving Cyber Threat Landscape Feb FireEye
Operation Arid Viper: Bypassing The Iron Dome Feb Trend Micro
Plugx Goes To The Registry And India Feb Sophos
ScanBox II Feb PWC
Crowdstrike Global Threat Intel Report Feb Crowdstrike
Equation Group: Questions And Answers Feb Kaspersky
Shooting Elephants Feb CIRCL Luxembourg
Tibetan Uprising Day Malware Attacks Mar The Citizen Lab
Operation Woolen-Goldfish When Kittens Go Phishing Mar Trend Micro
Volatile Cedar Threat Intelligence And Research Mar5 Check Point
HACKING THE STREET? FIN4 LIKELY PLAYING THE MARKET Apr FireEye
APT30 And The Mechanics Of A Long-Running Cyber Espionage Operation Apr FireEye
Sofacy II Same Sofacy, Different Day Apr PWC
CozyDuke Apr F-Secure
Dissecting Linux/Moose The Analysis of a Linux Router-based Worm Hungry for Social Networks May ESET
Operation Tropic Trooper: Relying On Tried-And-Tested Flaws To Infiltrate Secret Keepers May Trend Micro
Oceanlotus APT-C-00 May SkyEye
APT28 Targets Financial Markets: Zero Day Hashes Released May Root9b
Analysis On APT-To-Be Attack That Focusing On China's Government Agency May Antiy CERT
The Msnmm Campaigns: The Earliest Naikon APT Campaigns May Kaspersky
Operation Oil Tanker: The Phantom Menace May PandaLabs
Duqu 2.0: A Comparison To Duqu Jun CrySyS Lab
Operation Lotusblossom Jun PaloAlto
An Iranian Cyber-Attack Campaign Against Targets In The Middle East Jun ClearSky
The Duqu 2.0 Technical Details Jun Kaspersky
Insight in to advances of adversary tactics, techniques and procedures through analysis of an attack against an organisation in the Asia Pacific region Jun Dragon Threat Labs
Target Attacks Against Tibetan And Hong Kong Groups Exploiting CVE-2014-4114 Jun The Citizen Lab
Operation Potao Express: Analysis Of A Cyber-Espionage Toolkit Jul ESET
The Black Vine Cyberespionage Group Jul Symantec
HAMMERTOSS: Stealthy Tactics Define a Russian Cyber Threat Group Jul FireEye
Butterfly: Corporate Spies Out For Financial Gain Jul Symantec
RSA Research Terracotta VPN: Enabler Of Advanced Threat Anonymity Aug RSA
THE DUKES: 7 years of Russian cyberespionage Sep F-Secure
RUSSIAN FINANCIAL CYBERCRIME: HOW IT WORKS Nov Kaspersky
CopyKittens Attack Group Nov ClearSky

2014

Title Month Source
Targeted Attacks Against The Energy Sector Jan Symantec
Emerging Threat Profile Shell_Crew Jan RSA
New Cdto: A Sneakernet Trojan Solution Jan Fidelis
Intruder File Report- Sneakernet Trojan Jan Fidelis
Uroburos Highly Complex Espionage Software With Russian Roots Feb GDATA
Unveiling Careto - The Masked Apt Feb Kaspersky
Gathering In The Middle East, Operation Stteam Feb Fidelis
The Monju Incident Feb Context
Snake Campaign & Cyber Espionage Toolkit Mar BAE
Deep Panda May Crowdstrike
Operation Saffron Rose May FireEye
Rat In A Jar: A Phishing Campaign Using Unrecom May Fidelis
Illuminating The Etumbot Apt Backdoor Jun Arbor
Putter Panda Jun Crowdstrike
Anatomy Of The Attack: Zombie Zero Jun Trapx
Dragonfly: Cyberespionage Attacks Against Energy Suppliers Jun Symantec
Police Story: Hacking Team Government Surveillance Malware Jun The Citizen Lab
Energetic Bear _ Crouching Yeti Jul Kaspersky
The Eye Of The Tiger (Pitty Tiger) Jul Airbus
Crouching Yeti: Appendixes Jul Kaspersky
Operation Arachnophobia Caught In The Spider's Web Aug Threat Connect
Sidewinder Targeted Attack Against Android In The Golden Age Of Ad Libraries Aug FireEye
Profiling An Enigma: The Mystery Of North Korea's Cyber Threat Landscape Aug HP
The Epic Turla Operation: Solving Some Of The Mysteries Of Snake/Uroboros Aug Kaspersky
Syrian Malware, The Ever-Evolving Threat Aug Kaspersky
Cosmicduke Cosmu With A Twist Of Miniduke Sep F-Secure
Operation Quantum Entanglement Sep FireEye
BLACKENERGY & QUEDAGH The convergence of crimeware and APT attacks Oct F-Secure
Sofacy Phishing Oct PWC
Operation Pawn Storm Using Decoys to Evade Detection Oct Trend Micro
Hikit Analysis Oct Novetta
Apt28: A Window Into Russia's Cyber Espionage Operations Oct FireEye
Micro-Targeted Malvertising Via Real-Time Ad Bidding Oct Invincea
The Rotten Tomato Campaign Oct Sophos
Zoxpng Analysis Oct Novetta
Operation Toohash How Targeted Attacks Work Oct GDATA
The Darkhotel Apt A Story Of Unusual Hospitality Nov Kaspersky
Darkhotel Indicators Of Compromise Nov Kaspersky
Derusbi (Server Variant) Analysis Nov Novetta
Evil Bunny: Suspect #4 Nov Marion
The Regin Platform Nation-State Ownership Of Gsm Networks Nov Kaspersky
Regin: Top-Tier Espionage Tool Enables Stealthy Surveillance Nov Symantec
Anunak: Apt Against Financial Institutions Dec FoxIT
The Inception Framework: Cloud-Hosted Apt Dec Blue Coat
Operation Cleaver Dec Cylance
Bots, Machines, And The Matrix Dec Fidelis
Hacking The Street? Fin4 Likely Playing The Market Dec FireEye
W32/Regin, Stage #1 Dec F-Secure
W64/Regin, Stage #1 Dec F-Secure

2013

Title Month Source
"Red October" Diplomatic Cyber Attacks Investigation Jan Kaspersky
The Icefog Apt: A Tale Of Cloak And Three Daggers Jan Kaspersky
A closer look at MiniDuke Feb BitDefender
Stuxnet 0.5: The Missing Link Feb Symantec
The Miniduke Mystery: Pdf 0-Day Government Spy Assembler 0X29A Micro Backdoor Feb Kaspersky
Miniduke: Indicators Feb CrySyS Lab
Apt1 Exposing One Of China's Cyber Espionage Units Feb Mandiant
Command And Control In The Fifth Domain Feb Command Five Pty Ltd
Comment Crew: Indicators Of Compromise Feb Symantec
Dissecting Operation Troy: Cyberespionage In South Korea Mar McAfee
The Teamspy Story - Abusing Teamviewer In Cyberespionage Campaigns Mar Kaspersky
Analysis Of A Plugx Variant (Plugx Version 7.0) Mar CIRCL
You Only Click Twice: Finfisher's Global Proliferation Mar Citizen Lab
Apt1: Technical Backstage Mar itrust
Safe A Targeted Threat Mar Trend Micro
Winnti: More Than Just A Game Apr Kaspersky
Analysis Of A Stage 3 Miniduke Sample May CIRCL
Operation Hangover - Unveiling An Indian Cyberattack Infrastructure May Norman
The Chinese Malware Complexes: The Maudi Surveillance Operation Jun Norman
A Call To Harm: New Malware Attacks Target The Syrian Opposition Jun Citizen Lab
Crude Faux: An Analysis Of Cyber Conflict Within The Oil & Gas Industries Jun Cerias
Njrat Uncovered Jun Fidelis
The Nettraveler (Aka Travnet) Jun Kaspersky
The Plugx Malware Revisited: Introducing Smoaler Jul Sophos
Operation Hangover - Unveiling An Indian Cyberattack Infrastructure (Appendix) Aug FIXME
The Little Malware That Could: Detecting And Defeating The China Chopper Web Shell Aug FireEye
Inside Report _ Apt Attacks On Indian Cyber Space Aug Infosec Consorcium
Poison Ivy: Assessing Damage And Extracting Intelligence Aug FireEye
2Q Report On Targeted Attack Campaigns Sep Trend Micro
Hidden Lynx: Professional Hackers For Hire Sep Symantec
World War C: Understanding Nation-State Motives Behind Today's Advanced Cyber Attacks Sep FireEye
Fakem Rat: Malware Disguised As Windows Messenger And Yahoo! Messenger Oct Trend Micro
Supply Chain Analysis: From Quartermaster To Sunshopfireeye Nov FireEye
Energy At Risk: A Study Of It Security In The Energy And Natural Resources Industry Dec KPMG
Etso Apt Attacks Analysis Dec AHNLAB
Operation Ke3Chang Targeted Attacks Against Ministries Of Foreign Affairs Dec FireEye
"Njrat", The Saga Continues Dec Fidelis

2012

Title Month Source
The Heartbeat Apt Campaign Jan Trend Micro
Crouching Tiger, Hidden Dragon, Stolen Data Mar Context
Skywiper (A.K.A. Flame A.K.A. Flamer): A Complex Malware For Targeted Attacks Mar CrySyS Lab
Luckycat Redux: Inside An Apt Campaign With Multiple Targets In India And Japan Mar Trend Micro
Have I Got Newsforyou: Analysis Of Flamer C&C Server May Symantec
Ixeshe An Apt Campaign May Trend Micro
Pest Control: Taming The Rats Jun Matasano
From Bahrain With Love: Finfisher Spy Kit Exposed? Jul Citizen Lab
Recent Observations In Tibet-Related Information Operations: Advanced Social Engineering For The Distribution Of Lurk Malware Jul Citizen Lab
Iexpl0Re Rat Aug Citizen Lab
Gauss: Abnormal Distribution Aug Kaspersky
The Voho Campaign: An In Depth Analysis Aug RSA
The Elderwood Project Sep Symantec
Trojan.Taidoor: Targeting Think Tanks Oct Symantec
Recovering From Shamoon Nov Fidelis
Systematic Cyber Attacks Against Israeli And Palestinian Targets Going On For A Year Nov Norman
The Many Faces Of Gh0St Rat: Plotting The Connections Between Malware Attacks Nov Norman

2011

Title Month Source
W32.Stuxnet Dossier Feb Symantec
Global Energy Cyberattacks: Night Dragon Feb McAfee
Stuxnet Under the Microscope Apr ESET
Advanced Persistent Threats: A Decade in Review Jun Command Five Pty Ltd
The Lurid Downloader Aug Trend Micro
Revealed: Operation Shady Rat Aug McAfee
Enter the Cyber-dragon Sep Vanity Fair
SK Hack by an Advanced Persistent Threat Sep Command Five Pty Ltd
Alleged APT Intrusion Set: "1.php" Group Oct Zscaler
The Nitro Attacks: Stealing Secrets From The Chemical Industry Oct Symantec

2010

Title Month Source
The Command Structure Of The Aurora Botnet Jan Damballa
Operation Aurora: Detect, Diagnose, Respond Jan HBGary
Operation Aurora Feb HBGary
Combating Aurora Jan McAfee
In-Depth Analysis Of Hydraq: The Face Of Cyberwar Enemies Unfolds Mar CA
Shadows In The Cloud: Investigating Cyber Espionage 2.0 Apr Shadowserver
The Msupdater Trojan And Ongoing Targeted Attacks Sep Zscaler

2009

Title Month Source
Tracking GhostNet: Investigating a Cyber Espionage Network Mar TheSecDevGroup
DECLAWING THE DRAGON: WHY THE U.S. MUST COUNTER CHINESE CYBER-WARRIORS Jun NA
Capability of the People\92s Republic of China to Conduct Cyber Warfare and Computer Network Exploitation Oct Northrop Grumman
Russian Cyberwar on Georgia Nov georgiaupdate.gov.ge

References

About

Archive of publicly available threat INTel reports (mostly APT Reports but not limited to).

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published