JUST RELEASED: ATT&CK for Industrial Control Systems
ENTERPRISE MOBILE PRE-ATT&CK
TECHNIQUES
Initial Access
Execution
Persistence
Privilege Escalation
Defense Evasion
Credential Access
Discovery
Lateral Movement
Collection
Command and Control
Exfiltration
Impact
  1. Home
  2. Techniques
  3. Enterprise
  4. Process Discovery

Process Discovery

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Windows

An example command that would obtain details on processes is "tasklist" using the Tasklist utility.

Mac and Linux

In Mac and Linux, this is accomplished with the ps command.

ID: T1057
Tactic: Discovery
Platform: Linux, macOS, Windows
System Requirements: Administrator, SYSTEM may provide better process ownership details
Permissions Required: User, Administrator, SYSTEM
Data Sources: Process monitoring, Process command-line parameters
CAPEC ID: CAPEC-573
Version: 1.1
Created: 31 May 2017
Last Modified: 12 August 2019

Procedure Examples

Name Description
4H RAT

4H RAT has the capability to obtain a listing of running processes (including loaded modules).[85]
ADVSTORESHELL

ADVSTORESHELL can list running processes.[45]
Agent Tesla

Agent Tesla lists the current running processes on the system.[53]
APT1

APT1 gathered a list of running processes on the system using tasklist /v.[111]
APT28

An APT28 loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions.[34]
APT3

APT3 has a tool that can list out currently running processes.[114][115]
APT37

APT37's Freenki malware lists running processes using the Microsoft Windows API.[109]
APT38

APT38 leveraged Sysmon to understand the processes, services in the organization.[112]
Astaroth

Astaroth searches for different processes on the system.[97]
Azorult

Azorult can collect a list of running processes by calling CreateToolhelp32Snapshot.[60][61]
BabyShark

BabyShark has executed the tasklist command. [107]
Backdoor.Oldrea

Backdoor.Oldrea collects information about running processes.[13]
BACKSPACE

BACKSPACE may collect information about running processes.[14]
Bankshot

Bankshot identifies processes and collects the process ids.[42]
BBSRAT

BBSRAT can list running processes.[23]
BISCUIT

BISCUIT has a command to enumerate running processes and identify their owners.[71]
Bisonal

Bisonal can obtain a list of running processes on the victim’s machine.[35]
BLACKCOFFEE

BLACKCOFFEE has the capability to discover processes.[57]
BlackEnergy

BlackEnergy has gathered a process list by using Tasklist.exe.[32][33]
Brave Prince

Brave Prince lists the running processes.[52]
Cannon

Cannon can obtain a list of processes running on the system.[27][28]
Carbanak

Carbanak lists running processes.[31]
Carbon

Carbon can list the processes on the victim’s machine.[66]
Cardinal RAT

Cardinal RAT contains watchdog functionality that ensures its process is always running, else spawns a new instance.[72]
ChChes

ChChes collects its process identifier (PID) on the victim.[58]
Cobalt Strike

Cobalt Strike's "beacon" payload can collect information on process details.[2]
Comnie

Comnie uses the tasklist to view running processes on the victim’s machine.[8]
Crimson

Crimson contains a command to list processes.[40]
DarkComet

DarkComet can list active processes running on the victim’s machine.[65]
Darkhotel

Darkhotel has searched for anti-malware strings and anti-virus processes running on the system.[125]
Deep Panda

Deep Panda uses the Microsoft Tasklist utility to list processes running on systems.[117]
Derusbi

Derusbi collects current and parent process IDs.[43][44]
Duqu

The discovery modules used with Duqu can collect information on process details.[82]
DustySky

DustySky collects information about running processes from victims.[12]
Elise

Elise enumerates processes via the tasklist command.[62]
ELMER

ELMER is capable of performing process listings.[17]
Emotet

Emotet has been observed enumerating local processes.[96]
Empire

Empire can find information about processes running on local and remote systems.[6]
Epic

Epic uses the tasklist /v command to obtain a list of processes.[69][70]
EvilBunny

EvilBunny has used EnumProcesses() to identify how many process are running in the environment.[103]
FELIXROOT

FELIXROOT collects a list of running processes.[78]
Final1stspy

Final1stspy obtains a list of running processes.[79]
FinFisher

FinFisher checks its parent process for indications that it is running in a sandbox setup.[83][84]
FruitFly

FruitFly has the ability to list processes on the system.[22]
Fysbis

Fysbis can collect information about running processes. [106]
GeminiDuke

GeminiDuke collects information on running processes and environment variables from the victim.[29]
gh0st RAT

gh0st RAT has the capability to list processes.[89]
Gold Dragon

Gold Dragon checks the running processes on the victim’s machine.[52]
GravityRAT

GravityRAT lists the running processes on the system.[50]
HALFBAKED

HALFBAKED can obtain information about running processes on the victim.[68]
Helminth

Helminth has used Tasklist to get information on processes.[34]
Honeybee

Honeybee gathers a list of processes using the tasklist command and then is sent back to the control server.[110]
Hydraq

Hydraq creates a backdoor through which remote attackers can monitor processes.[54][55]
iKitten

iKitten lists the current processes running.[22]
InvisiMole

InvisiMole obtains a list of running processes.[10]
Ixeshe

Ixeshe can list running processes.[101]
JHUHUGIT

JHUHUGIT obtains a list of running processes on the victim.[86][87]
JPIN

JPIN can list running processes.[7]
jRAT

jRAT can query and kill system processes.[98]
Kasidet

Kasidet has the ability to search for a given process name in processes currently running in the system.[92]
Kazuar

Kazuar obtains a list of running processes through WMI querying and the ps command.[37]
Ke3chang

Ke3chang performs process discovery using tasklist commands.[118][119]
KEYMARBLE

KEYMARBLE can obtain a list of running processes on the system.[21]
Komplex

The OsInfo function in Komplex collects a running process list.[74]
Kwampirs

Kwampirs collects a list of running services with the command tasklist /v.[41]
Lazarus Group

Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by Lazarus Group also gathers process times.[120][121][122][39]
Linfo

Linfo creates a backdoor through which remote attackers can retrieve a list of running processes.[80]
Machete

Machete has a component to check for running processes to look for web browsers. [104]
Magic Hound

Magic Hound malware can list running processes.[126]
MobileOrder

MobileOrder has a command to upload information about all running processes to its C2 server.[67]
Molerats

Molerats actors obtained a list of active processes on the victim and sent them to C2 servers.[12]
MoonWind

MoonWind has a command to return a list of running processes.[75]
Mosquito

Mosquito runs tasklist to obtain running processes.[19]
MuddyWater

MuddyWater has used malware to obtain a list of running processes on the system.[127]
NavRAT

NavRAT uses tasklist /v to check running processes.[30]
NETEAGLE

NETEAGLE can send process listings over the C2 channel.[14]
OceanSalt

OceanSalt can collect the name and ID for every process running on the system.[26]
OilRig

OilRig has run tasklist on a victim's machine.[108]
Orz

Orz can gather a process list from the victim.[20]
Pasam

Pasam creates a backdoor through which remote attackers can retrieve lists of running processes.[51]
PLAINTEE

PLAINTEE performs the tasklist command to list running processes.[36]
PlugX

PlugX has a module to list the processes running on a machine.[15]
POORAIM

POORAIM can enumerate processes.[16]
Poseidon Group

After compromising a victim, Poseidon Group lists all running processes.[116]
PowerDuke

PowerDuke has a command to list the victim's processes.[18]
PowerSploit

PowerSploit's Get-ProcessTokenPrivilege Privesc-PowerUp module can enumerate privileges for a given process.[3][4]
PowerStallion

PowerStallion has been used to monitor process lists.[102]
POWRUNER

POWRUNER may collect process information by running tasklist on a victim.[25]
Proxysvc

Proxysvc lists processes running on the system.[39]
Pupy

Pupy can list the running processes and get the process ID and parent process’s ID.[1]
RATANKBA

RATANKBA lists the system’s processes.[46][47]
Remsec

Remsec can obtain a process list from the victim.[81]
RogueRobin

RogueRobin checks the running processes for evidence it may be running in a sandbox environment. It specifically enumerates processes for Wireshark and Sysinternals.[77]
ROKRAT

ROKRAT lists the current running processes on the system.[64]
RTM

RTM can obtain information about process integrity levels.[9]
Seasalt

Seasalt has a command to perform a process listing.[71]
SHOTPUT

SHOTPUT has a command to obtain a process listing.[11]
Socksbot

Socksbot can list all running processes.[88]
Stealth Falcon

Stealth Falcon malware gathers a list of running processes.[124]
StreamEx

StreamEx has the ability to enumerate processes.[73]
Sykipot

Sykipot may gather a list of running processes by running tasklist /v.[38]
SynAck

SynAck enumerates all running processes.[48][49]
Tasklist

Tasklist can be used to discover processes running on a system.[5]
Trojan.Karagany

Trojan.Karagany can use tasklist to collect a list of running tasks.[13]
Tropic Trooper

Tropic Trooper enumerates the running processes on the system.[123]
Turla

Turla surveys a system upon check-in to discover running processes using the tasklist /v command. Turla RPC backdoors have also enumerated processes associated with specific open ports or named pipes.[69][102]
UBoatRAT

UBoatRAT can list running processes on the system.[24]
Ursnif

Ursnif has gathered information about running processes.[99][100]
VERMIN

VERMIN can get a list of the processes and running tasks on the system.[59]
Volgmer

Volgmer can gather a list of processes.[63]
WINERACK

WINERACK can enumerate processes.[16]
WinMM

WinMM sets a WH_CBT Windows hook to collect information on process creation.[90]
Winnti Group

Winnti Group looked for a specific process running on infected servers.[113]
XAgentOSX

XAgentOSX contains the getProcessList function to run ps aux to get running processes.[56]
yty

yty gets an output of running processes using the tasklist command.[76]
Zebrocy

Zebrocy uses the tasklist and wmic process get Capture, ExecutablePath commands to gather the processes running on the system.[27][93][28][94][95]
Zeus Panda

Zeus Panda checks for running processes on the victim’s machine.[91]
ZxShell

ZxShell has a command, ps, to obtain a listing of processes on the system. [105]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

Normal, benign system and network events that look like process discovery may be uncommon, depending on the environment and how they are used. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.

References

  1. Nicolas Verdier. (n.d.). Retrieved January 29, 2018.
  2. Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017.
  3. PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.
  4. PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.
  5. Microsoft. (n.d.). Tasklist. Retrieved December 23, 2015.
  6. Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.
  7. Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
  8. Grunzweig, J. (2018, January 31). Comnie Continues to Target Organizations in East Asia. Retrieved June 7, 2018.
  9. Faou, M. and Boutin, J.. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.
  10. Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.
  11. Falcone, R. and Wartell, R.. (2015, July 27). Observations on CVE-2015-3113, Prior Zero-Days and the Pirpi Payload. Retrieved January 22, 2016.
  12. ClearSky. (2016, January 7). Operation DustySky. Retrieved January 8, 2016.
  13. Symantec Security Response. (2014, July 7). Dragonfly: Cyberespionage Attacks Against Energy Suppliers. Retrieved April 8, 2016.
  14. FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved May 1, 2015.
  15. Computer Incident Response Center Luxembourg. (2013, March 29). Analysis of a PlugX variant. Retrieved November 5, 2018.
  16. FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved March 1, 2018.
  17. Winters, R.. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016.
  18. Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
  19. ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.
  20. Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.
  21. US-CERT. (2018, August 09). MAR-10135536-17 – North Korean Trojan: KEYMARBLE. Retrieved August 16, 2018.
  22. Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.
  23. Lee, B. Grunzweig, J. (2015, December 22). BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger. Retrieved August 19, 2016.
  24. Hayashi, K. (2017, November 28). UBoatRAT Navigates East Asia. Retrieved January 12, 2018.
  25. Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017.
  26. Sherstobitoff, R., Malhotra, A. (2018, October 18). ‘Operation Oceansalt’ Attacks South Korea, U.S., and Canada With Source Code From Chinese Hacker Group. Retrieved November 30, 2018.
  27. Falcone, R., Lee, B. (2018, November 20). Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan. Retrieved November 26, 2018.
  28. Lee, B., Falcone, R. (2018, December 12). Dear Joohn: The Sofacy Group’s Global Campaign. Retrieved April 19, 2019.
  29. F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015.
  30. Mercer, W., Rascagneres, P. (2018, May 31). NavRAT Uses US-North Korea Summit As Decoy For Attacks In South Korea. Retrieved June 11, 2018.
  31. Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018.
  32. F-Secure Labs. (2014). BlackEnergy & Quedagh: The convergence of crimeware and APT attacks. Retrieved March 24, 2016.
  33. Baumgartner, K. and Garnaeva, M.. (2014, November 3). BE2 custom plugins, router abuse, and target profiles. Retrieved March 24, 2016.
  34. Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017.
  35. Hayashi, K., Ray, V. (2018, July 31). Bisonal Malware Used in Attacks Against Russia and South Korea. Retrieved August 7, 2018.
  36. Ash, B., et al. (2018, June 26). RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families. Retrieved July 2, 2018.
  37. Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.
  38. Blasco, J. (2011, December 12). Another Sykipot sample likely targeting US federal agencies. Retrieved March 28, 2016.
  39. Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.
  40. Huss, D.. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.
  41. Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.
  42. Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.
  43. Fidelis Cybersecurity. (2016, February 29). The Turbo Campaign, Featuring Derusbi for 64-bit Linux. Retrieved March 2, 2016.
  44. FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.
  45. ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.
  46. Lei, C., et al. (2018, January 24). Lazarus Campaign Targeting Cryptocurrencies Reveals Remote Controller Tool, an Evolved RATANKBA, and More. Retrieved May 22, 2018.
  47. Trend Micro. (2017, February 27). RATANKBA: Delving into Large-scale Watering Holes against Enterprises. Retrieved May 22, 2018.
  48. Ivanov, A. et al.. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
  49. Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.
  50. Mercer, W., Rascagneres, P. (2018, April 26). GravityRAT - The Two-Year Evolution Of An APT Targeting India. Retrieved May 16, 2018.
  51. Mullaney, C. & Honda, H. (2012, May 4). Trojan.Pasam. Retrieved February 22, 2018.
  52. Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018.
  53. Zhang, X. (2017, June 28). In-Depth Analysis of A New Variant of .NET Malware AgentTesla. Retrieved November 5, 2018.
  54. Symantec Security Response. (2010, January 18). The Trojan.Hydraq Incident. Retrieved February 20, 2018.
  55. Lelli, A. (2010, January 11). Trojan.Hydraq. Retrieved February 20, 2018.
  56. Robert Falcone. (2017, February 14). XAgentOSX: Sofacy's Xagent macOS Tool. Retrieved July 12, 2017.
  57. FireEye Labs/FireEye Threat Intelligence. (2015, May 14). Hiding in Plain Sight: FireEye and Microsoft Expose Obfuscation Tactic. Retrieved January 22, 2016.
  58. Miller-Osborn, J. and Grunzweig, J.. (2017, February 16). menuPass Returns with New Malware and New Attacks Against Japanese Academics and Organizations. Retrieved March 1, 2017.
  59. Lancaster, T., Cortes, J. (2018, January 29). VERMIN: Quasar RAT and Custom Malware Used In Ukraine. Retrieved July 5, 2018.
  60. Yan, T., et al. (2018, November 21). New Wine in Old Bottle: New Azorult Variant Found in FindMyName Campaign using Fallout Exploit Kit. Retrieved November 29, 2018.
  61. Proofpoint. (2018, July 30). New version of AZORult stealer improves loading features, spreads alongside ransomware in new campaign. Retrieved November 29, 2018.
  62. Accenture Security. (2018, January 27). DRAGONFISH DELIVERS NEW FORM OF ELISE MALWARE TARGETING ASEAN DEFENCE MINISTERS’ MEETING AND ASSOCIATES. Retrieved November 14, 2018.
  63. Yagi, J. (2014, August 24). Trojan.Volgmer. Retrieved July 16, 2018.
  64. Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018.
  1. Kujawa, A. (2018, March 27). You dirty RAT! Part 1: DarkComet. Retrieved November 6, 2018.
  2. ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.
  3. Falcone, R. and Miller-Osborn, J.. (2016, January 24). Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists. Retrieved February 10, 2016.
  4. Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing LNK. Retrieved April 24, 2017.
  5. Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.
  6. Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.
  7. Mandiant. (n.d.). Appendix C (Digital) - The Malware Arsenal. Retrieved July 18, 2016.
  8. Grunzweig, J.. (2017, April 20). Cardinal RAT Active for Over Two Years. Retrieved December 8, 2018.
  9. Cylance SPEAR Team. (2017, February 9). Shell Crew Variants Continue to Fly Under Big AV’s Radar. Retrieved February 15, 2017.
  10. Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26). Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.
  11. Miller-Osborn, J. and Grunzweig, J.. (2017, March 30). Trochilus and New MoonWind RATs Used In Attack Against Thai Organizations. Retrieved March 30, 2017.
  12. Schwarz, D., Sopko J. (2018, March 08). Donot Team Leverages New Modular Malware Framework in South Asia. Retrieved June 11, 2018.
  13. Falcone, R., et al. (2018, July 27). New Threat Actor Group DarkHydrus Targets Middle East Government. Retrieved August 2, 2018.
  14. Cherepanov, A. (2018, October). GREYENERGY A successor to BlackEnergy. Retrieved November 15, 2018.
  15. Grunzweig, J. (2018, October 01). NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT. Retrieved November 5, 2018.
  16. Zhou, R. (2012, May 15). Backdoor.Linfo. Retrieved February 23, 2018.
  17. Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.
  18. Symantec Security Response. (2011, November). W32.Duqu: The precursor to the next Stuxnet. Retrieved September 17, 2015.
  19. FinFisher. (n.d.). Retrieved December 20, 2017.
  20. Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.
  21. Crowdstrike Global Intelligence Team. (2014, June 9). CrowdStrike Intelligence Report: Putter Panda. Retrieved January 22, 2016.
  22. ESET. (2016, October). En Route with Sednit - Part 1: Approaching the Target. Retrieved November 8, 2016.
  23. Lee, B, et al. (2018, February 28). Sofacy Attacks Multiple Government Entities. Retrieved March 15, 2018.
  24. Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.
  25. FireEye Threat Intelligence. (2015, July 13). Demonstrating Hustle, Chinese APT Groups Quickly Use Zero-Day Vulnerability (CVE-2015-5119) Following Hacking Team Leak. Retrieved January 25, 2016.
  26. Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved April 10, 2019.
  27. Ebach, L. (2017, June 22). Analysis Results of Zeus.Variant.Panda. Retrieved November 5, 2018.
  28. Yadav, A., et al. (2016, January 29). Malicious Office files dropping Kasidet and Dridex. Retrieved March 24, 2016.
  29. ESET. (2018, November 20). Sednit: What’s going on with Zebrocy?. Retrieved February 12, 2019.
  30. ESET Research. (2019, May 22). A journey to Zebrocy land. Retrieved June 20, 2019.
  31. Accenture Security. (2018, November 29). SNAKEMACKEREL. Retrieved April 15, 2019.
  32. ASEC. (2017). ASEC REPORT VOL.88. Retrieved April 16, 2019.
  33. Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.
  34. Bingham, J. (2013, February 11). Cross-Platform Frutas RAT Builder and Back Door. Retrieved April 23, 2019.
  35. Caragay, R. (2015, March 26). URSNIF: The Multifaceted Malware. Retrieved June 5, 2019.
  36. Sioting, S. (2013, June 15). BKDR_URSNIF.SM. Retrieved June 5, 2019.
  37. Sancho, D., et al. (2012, May 22). IXESHE An APT Campaign. Retrieved June 7, 2019.
  38. Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.
  39. Marschalek, M.. (2014, December 16). EvilBunny: Malware Instrumented By Lua. Retrieved June 28, 2019.
  40. ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019.
  41. Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.
  42. Doctor Web. (2014, November 21). Linux.BackDoor.Fysbis.1. Retrieved December 7, 2017.
  43. Unit 42. (2019, February 22). New BabyShark Malware Targets U.S. National Security Think Tanks. Retrieved October 7, 2019.
  44. Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.
  45. Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.
  46. Sherstobitoff, R. (2018, March 02). McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups. Retrieved May 16, 2018.
  47. Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.
  48. FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 6, 2018.
  49. Kaspersky Lab's Global Research and Analysis Team. (2013, April 11). Winnti. More than just a game. Retrieved February 8, 2017.
  50. Chen, X., Scott, M., Caselden, D.. (2014, April 26). New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks. Retrieved January 14, 2016.
  51. Yates, M. (2017, June 18). APT3 Uncovered: The code evolution of Pirpi. Retrieved September 28, 2017.
  52. Kaspersky Lab's Global Research and Analysis Team. (2016, February 9). Poseidon Group: a Targeted Attack Boutique specializing in global cyber-espionage. Retrieved March 16, 2016.
  53. Alperovitch, D. (2014, July 7). Deep in Thought: Chinese Targeting of National Security Think Tanks. Retrieved November 12, 2014.
  54. Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.
  55. Smallridge, R. (2018, March 10). APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS. Retrieved April 4, 2018.
  56. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.
  57. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Loaders, Installers and Uninstallers Report. Retrieved March 2, 2016.
  58. Sherstobitoff, R. (2018, February 12). Lazarus Resurfaces, Targets Global Banks and Bitcoin Users. Retrieved February 19, 2018.
  59. Ray, V. (2016, November 22). Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy. Retrieved November 9, 2018.
  60. Marczak, B. and Scott-Railton, J.. (2016, May 29). Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents. Retrieved June 8, 2016.
  61. Kaspersky Lab's Global Research & Analysis Team. (2015, August 10). Darkhotel's attacks in 2015. Retrieved November 2, 2018.
  62. Lee, B. and Falcone, R. (2017, February 15). Magic Hound Campaign Attacks Saudi Targets. Retrieved December 27, 2017.
  63. Kaspersky Lab's Global Research & Analysis Team. (2018, October 10). MuddyWater expands operations. Retrieved November 2, 2018.