1. Home
  2. Techniques
  3. Enterprise
  4. Process Discovery

Process Discovery

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

In Windows environments, adversaries could obtain details on running processes using the Tasklist utility via cmd or Get-Process via PowerShell. Information about processes can also be extracted from the output of Native API calls such as CreateToolhelp32Snapshot. In Mac and Linux, this is accomplished with the ps command. Adversaries may also opt to enumerate processes via /proc.

On network devices, Network Device CLI commands such as show processes can be used to display current running processes.[1][2]

ID: T1057
Sub-techniques:  No sub-techniques
ⓘ
Tactic: Discovery
ⓘ
Platforms: Linux, Network, Windows, macOS
Contributors: Austin Clark, @c2defense
Version: 1.5
Created: 31 May 2017
Last Modified: 16 April 2024
Version Permalink

Procedure Examples

ID Name Description
S0065 4H RAT

4H RAT has the capability to obtain a listing of running processes (including loaded modules).[3]
S0045 ADVSTORESHELL

ADVSTORESHELL can list running processes.[4]
S0331 Agent Tesla

Agent Tesla can list the current running processes on the system.[5]
S1129 Akira

Akira verifies the deletion of volume shadow copies by checking for the existence of the process ID related to the process created to delete these items.[6]
G0138 Andariel

Andariel has used tasklist to enumerate processes and find a specific string.[7]
S1133 Apostle

Apostle retrieves a list of all running processes on a victim host, and stops all services containing the string "sql," likely to propagate ransomware activity to database files.[8]
S0622 AppleSeed

AppleSeed can enumerate the current process on a compromised host.[9]
G0006 APT1

APT1 gathered a list of running processes on the system using tasklist /v.[10]
G0007 APT28

An APT28 loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions.[11]
G0022 APT3

APT3 has a tool that can list out currently running processes.[12][13]
G0067 APT37

APT37's Freenki malware lists running processes using the Microsoft Windows API.[14]
G0082 APT38

APT38 leveraged Sysmon to understand the processes, services in the organization.[15]
G1023 APT5

APT5 has used Windows-based utilities to carry out tasks including tasklist.exe. [16]
S0456 Aria-body

Aria-body has the ability to enumerate loaded modules for a process.[17].
S0373 Astaroth

Astaroth searches for different processes on the system.[18]
S1087 AsyncRAT

AsyncRAT can examine running processes to determine if a debugger is present.[19]
S0640 Avaddon

Avaddon has collected information about running processes.[20]
S0473 Avenger

Avenger has the ability to use Tasklist to identify running processes.[21]
S1053 AvosLocker

AvosLocker has discovered system processes by calling RmGetList.[22]
S0344 Azorult

Azorult can collect a list of running processes by calling CreateToolhelp32Snapshot.[23][24]
S0638 Babuk

Babuk has the ability to check running processes on a targeted system.[25][26][27]
S0414 BabyShark

BabyShark has executed the tasklist command.[28]

S0093 Backdoor.Oldrea

Backdoor.Oldrea collects information about running processes.[29]
S0031 BACKSPACE

BACKSPACE may collect information about running processes.[30]
S0606 Bad Rabbit

Bad Rabbit can enumerate all running processes to compare hashes.[31]
S1081 BADHATCH

BADHATCH can retrieve a list of running processes from a compromised machine.[32]

S0239 Bankshot

Bankshot identifies processes and collects the process ids.[33]
S0534 Bazar

Bazar can identity the current process on a compromised host.[34]
S0127 BBSRAT

BBSRAT can list running processes.[35]
S0017 BISCUIT

BISCUIT has a command to enumerate running processes and identify their owners.[36]
S0268 Bisonal

Bisonal can obtain a list of running processes on the victim’s machine.[37][38][39]
S0069 BLACKCOFFEE

BLACKCOFFEE has the capability to discover processes.[40]
S0089 BlackEnergy

BlackEnergy has gathered a process list by using Tasklist.exe.[41][42][43]
S0657 BLUELIGHT

BLUELIGHT can collect process filenames and SID authority level.[44]
S0486 Bonadan

Bonadan can use the ps command to discover other cryptocurrency miners active on the system.[45]
S0252 Brave Prince

Brave Prince lists the running processes.[46]
S1063 Brute Ratel C4

Brute Ratel C4 can enumerate all processes and locate specific process IDs (PIDs).[47]
S1039 Bumblebee

Bumblebee can identify processes associated with analytical tools.[48][49][50]
S0482 Bundlore

Bundlore has used the ps command to list processes.[51]
C0015 C0015

During C0015, the threat actors used the tasklist /s command as well as taskmanager to obtain a list of running processes.[52]
S0693 CaddyWiper

CaddyWiper can obtain a list of current processes.[53]
S0351 Cannon

Cannon can obtain a list of processes running on the system.[54][55]
S0030 Carbanak

Carbanak lists running processes.[56]
S0484 Carberp

Carberp has collected a list of running processes.[57]
S0335 Carbon

Carbon can list the processes on the victim’s machine.[58]
S0348 Cardinal RAT

Cardinal RAT contains watchdog functionality that ensures its process is always running, else spawns a new instance.[59]
S0572 Caterpillar WebShell

Caterpillar WebShell can gather a list of processes running on the machine.[60]

S0674 CharmPower

CharmPower has the ability to list running processes through the use of tasklist.[61]
S0144 ChChes

ChChes collects its process identifier (PID) on the victim.[62]
G0114 Chimera

Chimera has used tasklist to enumerate processes.[63]
S1149 CHIMNEYSWEEP

CHIMNEYSWEEP can check if a process name contains "creensaver."[64]
S0660 Clambling

Clambling can enumerate processes on a targeted system.[65]
S0611 Clop

Clop can enumerate all processes on the victim's machine.[66]
S1105 COATHANGER

COATHANGER will query running process information to determine subsequent program execution flow.[67]
S0154 Cobalt Strike

Cobalt Strike's Beacon payload can collect information on process details.[68][69][70]
S0244 Comnie

Comnie uses the tasklist to view running processes on the victim’s machine.[71]
S0575 Conti

Conti can enumerate through all open processes to search for any that have the string "sql" in their process name.[72]
S0115 Crimson

Crimson contains a command to list processes.[73][74][75]

S0625 Cuba

Cuba can enumerate processes running on a victim's machine.[76]
S1153 Cuckoo Stealer

Cuckoo Stealer can use ps aux to enumerate running processes.[77]
S0687 Cyclops Blink

Cyclops Blink can enumerate the process it is currently running under.[78]
S0497 Dacls

Dacls can collect data on running and parent processes.[79]
S0334 DarkComet

DarkComet can list active processes running on the victim’s machine.[80]
S1111 DarkGate

DarkGate performs various checks for running processes, including security software by looking for hard-coded process name values.[81]

G0012 Darkhotel

Darkhotel malware can collect a list of running processes on a system.[82]
S1066 DarkTortilla

DarkTortilla can enumerate a list of running processes on a compromised system.[83]
G0009 Deep Panda

Deep Panda uses the Microsoft Tasklist utility to list processes running on systems.[84]
S0021 Derusbi

Derusbi collects current and parent process IDs.[85][86]
S0659 Diavol

Diavol has used CreateToolhelp32Snapshot, Process32First, and Process32Next API calls to enumerate the running processes in the system.[87]
S0600 Doki

Doki has searched for the current process’s PID.[88]
S0695 Donut

Donut includes subprojects that enumerate and identify information about Process Injection candidates.[89]

S0472 down_new

down_new has the ability to list running processes on a compromised host.[21]
S0694 DRATzarus

DRATzarus can enumerate and examine running processes to determine if a debugger is present.[90]
S0567 Dtrack

Dtrack’s dropper can list all running processes.[91][92]
S0038 Duqu

The discovery modules used with Duqu can collect information on process details.[93]
S1159 DUSTTRAP

DUSTTRAP can enumerate running processes.[94]
S0062 DustySky

DustySky collects information about running processes from victims.[95][96]
G1006 Earth Lusca

Earth Lusca has used Tasklist to obtain information from a compromised host.[97]
S0605 EKANS

EKANS looks for processes from a hard-coded list.[98][99][100]
S0081 Elise

Elise enumerates processes via the tasklist command.[101]
S0064 ELMER

ELMER is capable of performing process listings.[102]
S0367 Emotet

Emotet has been observed enumerating local processes.[103]
S0363 Empire

Empire can find information about processes running on local and remote systems.[104][105]
S0091 Epic

Epic uses the tasklist /v command to obtain a list of processes.[106][107]
S0396 EvilBunny

EvilBunny has used EnumProcesses() to identify how many process are running in the environment.[108]
S0512 FatDuke

FatDuke can list running processes on the localhost.[109]
S0267 FELIXROOT

FELIXROOT collects a list of running processes.[110]
S0355 Final1stspy

Final1stspy obtains a list of running processes.[111]
S0182 FinFisher

FinFisher checks its parent process for indications that it is running in a sandbox setup.[112][113]
S0696 Flagpro

Flagpro has been used to run the tasklist command on a compromised system.[114]
S0661 FoggyWeb

FoggyWeb's loader can enumerate all Common Language Runtimes (CLRs) and running Application Domains in the compromised AD FS server's Microsoft.IdentityServer.ServiceHost.exe process.[115]
S0503 FrameworkPOS

FrameworkPOS can enumerate and exclude selected processes on a compromised host to speed execution of memory scraping.[116]
C0001 Frankenstein

During Frankenstein, the threat actors used Empire to obtain a list of all running processes.[105]
S0277 FruitFly

FruitFly has the ability to list processes on the system.[117]
S1044 FunnyDream

FunnyDream has the ability to discover processes, including Bka.exe and BkavUtil.exe.[118]
C0007 FunnyDream

During FunnyDream, the threat actors used Tasklist on targeted systems.[118]
S0410 Fysbis

Fysbis can collect information about running processes.[119]

G0047 Gamaredon Group

Gamaredon Group has used tools to enumerate processes on target hosts including Process Explorer.[120][121]
S0666 Gelsemium

Gelsemium can enumerate running processes.[122]
S0049 GeminiDuke

GeminiDuke collects information on running processes and environment variables from the victim.[123]
S0460 Get2

Get2 has the ability to identify running processes on an infected host.[124]
S0032 gh0st RAT

gh0st RAT has the capability to list processes.[125]
S0249 Gold Dragon

Gold Dragon checks the running processes on the victim’s machine.[46]
S0477 Goopy

Goopy has checked for the Google Updater process to ensure Goopy was loaded properly.[126]
S0531 Grandoreiro

Grandoreiro can identify installed security tools based on process names.[127]
S0237 GravityRAT

GravityRAT lists the running processes on the system.[128]
G0125 HAFNIUM

HAFNIUM has used tasklist to enumerate processes.[129]
S0151 HALFBAKED

HALFBAKED can obtain information about running processes on the victim.[130]
S0617 HELLOKITTY

HELLOKITTY can search for specific processes to terminate.[131]
S0170 Helminth

Helminth has used Tasklist to get information on processes.[11]
G1001 HEXANE

HEXANE has enumerated processes on targeted systems.[132]
S1027 Heyoka Backdoor

Heyoka Backdoor can gather process information.[133]
G0126 Higaisa

Higaisa’s shellcode attempted to find the process ID of the current process.[134]
S0431 HotCroissant

HotCroissant has the ability to list running processes on the infected host.[135]
S0203 Hydraq

Hydraq creates a backdoor through which remote attackers can monitor processes.[136][137]
S0278 iKitten

iKitten lists the current processes running.[117]
S0434 Imminent Monitor

Imminent Monitor has a "Process Watcher" feature to monitor processes in case the client ever crashes or gets closed.[138]
S1139 INC Ransomware

INC Ransomware can use the Microsoft Win32 Restart Manager to kill processes with a specific handle or that are accessing resources it wants to encrypt.[139]
G0100 Inception

Inception has used a reconnaissance module to identify active processes and other associated loaded modules.[140]
S1072 Industroyer2

Industroyer2 has the ability to cyclically enumerate running processes such as PServiceControl.exe, PService_PDD.exe, and other targets supplied through a hardcoded configuration.[141]
S0260 InvisiMole

InvisiMole can obtain a list of running processes.[142][143]
S1132 IPsec Helper

IPsec Helper can identify the process it is currently running under and its number, and pass this back to a command and control node.[8]
S0581 IronNetInjector

IronNetInjector can identify processes via C# methods such as GetProcessesByName and running Tasklist with the Python os.popen function.[144]
S0015 Ixeshe

Ixeshe can list running processes.[145]
S0528 Javali

Javali can monitor processes for open browsers and custom banking applications.[146]
S0044 JHUHUGIT

JHUHUGIT obtains a list of running processes on the victim.[147][148]
S0201 JPIN

JPIN can list running processes.[149]
S0283 jRAT

jRAT can query and kill system processes.[150]
S0088 Kasidet

Kasidet has the ability to search for a given process name in processes currently running in the system.[151]
S0265 Kazuar

Kazuar obtains a list of running processes through WMI querying and the ps command.[152]
G0004 Ke3chang

Ke3chang performs process discovery using tasklist commands.[153][154]
S0271 KEYMARBLE

KEYMARBLE can obtain a list of running processes on the system.[155]
S0607 KillDisk

KillDisk has called GetCurrentProcess.[156]
G0094 Kimsuky

Kimsuky can gather a list of all processes running on a victim's machine.[157]
S0599 Kinsing

Kinsing has used ps to list processes.[158]
S0162 Komplex

The OsInfo function in Komplex collects a running process list.[159]
S0356 KONNI

KONNI has used the command cmd /c tasklist to get a snapshot of the current processes on the target machine.[160][161]
S1075 KOPILUWAK

KOPILUWAK can enumerate current running processes on the targeted machine.[162]
C0035 KV Botnet Activity

Scripts associated with KV Botnet Activity initial deployment can identify processes related to security tools and other botnet families for follow-on disabling during installation.[163]
S0236 Kwampirs

Kwampirs collects a list of running services with the command tasklist /v.[164]
S1160 Latrodectus

Latrodectus can enumerate running processes including process grandchildren on targeted hosts.[165][166][167]
G0032 Lazarus Group

Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by Lazarus Group also gathers process times.[168][169][170][171][79][172]
S0211 Linfo

Linfo creates a backdoor through which remote attackers can retrieve a list of running processes.[173]
S0681 Lizar

Lizar has a plugin designed to obtain a list of processes.[174][175]
S0582 LookBack

LookBack can list running processes.[176]
S0451 LoudMiner

LoudMiner used the ps command to monitor the running processes on the system.[177]

S0532 Lucifer

Lucifer can identify the process that owns remote connections.[178]
S1141 LunarWeb

LunarWeb has used shell commands to list running processes.[179]
S0409 Machete

Machete has a component to check for running processes to look for web browsers.[180]

S1016 MacMa

MacMa can enumerate running processes.[181]
S1048 macOS.OSAMiner

macOS.OSAMiner has used ps ax | grep <name> | grep -v grep | ... and ps ax | grep -E... to conduct process discovery.[182]
S1060 Mafalda

Mafalda can enumerate running processes on a machine.[183]
G0059 Magic Hound

Magic Hound malware can list running processes.[184]
S0652 MarkiRAT

MarkiRAT can search for different processes on a system.[185]
S0449 Maze

Maze has gathered all of the running system processes.[186]

S1059 metaMain

metaMain can enumerate the processes that run on the platform.[183][187]
S0455 Metamorfo

Metamorfo has performed process name checks and has monitored applications.[188]

S0688 Meteor

Meteor can check if a specific process is running, such as Kaspersky's avp.exe.[189]
S1146 MgBot

MgBot includes a module for establishing a process watchdog for itself, identifying if the MgBot process is still running.[190]
S1122 Mispadu

Mispadu can enumerate the running processes on a compromised host.[191]
S0079 MobileOrder

MobileOrder has a command to upload information about all running processes to its C2 server.[192]
G0021 Molerats

Molerats actors obtained a list of active processes on the victim and sent them to C2 servers.[95]
S0149 MoonWind

MoonWind has a command to return a list of running processes.[193]
S0256 Mosquito

Mosquito runs tasklist to obtain running processes.[194]
G0069 MuddyWater

MuddyWater has used malware to obtain a list of running processes on the system.[195][196]
G0129 Mustang Panda

Mustang Panda has used tasklist /v to determine active process information.[197]

S0247 NavRAT

NavRAT uses tasklist /v to check running processes.[198]
S0630 Nebulae

Nebulae can enumerate processes on a target system.[199]
S0034 NETEAGLE

NETEAGLE can send process listings over the C2 channel.[30]
S0198 NETWIRE

NETWIRE can discover processes on compromised hosts.[200]
S1090 NightClub

NightClub has the ability to use GetWindowThreadProcessId to identify the process behind a specified window.[201]
S1147 Nightdoor

Nightdoor can collect information on installed applications via Windows registry keys, as well as collecting information on running processes.[202]
S1100 Ninja

Ninja can enumerate processes on a targeted host.[203][204]
S0385 njRAT

njRAT can search a list of running processes for Tr.exe.[205]
S1107 NKAbuse

NKAbuse will check victim systems to ensure only one copy of the malware is running.[206]
S0644 ObliqueRAT

ObliqueRAT can check for blocklisted process names on a compromised host.[207]
S0346 OceanSalt

OceanSalt can collect the name and ID for every process running on the system.[208]
G0049 OilRig

OilRig has run tasklist on a victim's machine.[209]
C0012 Operation CuckooBees

During Operation CuckooBees, the threat actors used the tasklist command as part of their advanced reconnaissance.[210]
C0006 Operation Honeybee

During Operation Honeybee, the threat actors obtained a list of running processes on a victim machine using cmd /c tasklist > %temp%\temp.ini.[211]
C0014 Operation Wocao

During Operation Wocao, the threat actors used tasklist to collect a list of running processes on an infected system.[212]
S0229 Orz

Orz can gather a process list from the victim.[213]
S1017 OutSteel

OutSteel can identify running processes on a compromised host.[214]
S0626 P8RAT

P8RAT can check for specific processes associated with virtual environments.[215]
S0664 Pandora

Pandora can monitor processes on a compromised host.[216]
S0208 Pasam

Pasam creates a backdoor through which remote attackers can retrieve lists of running processes.[217]
S1050 PcShare

PcShare can obtain a list of running processes on a compromised host.[118]
S0517 Pillowmint

Pillowmint can iterate through running processes every six seconds collecting a list of processes to capture from later.[218]

S0501 PipeMon

PipeMon can iterate over the running processes to find a suitable injection target.[219]
S0254 PLAINTEE

PLAINTEE performs the tasklist command to list running processes.[220]
G1040 Play

Play has used the information stealer Grixba to check for a list of security processes.[221]
S0435 PLEAD

PLEAD has the ability to list processes on the compromised host.[222]
S0013 PlugX

PlugX has a module to list the processes running on a machine.[223]
S0428 PoetRAT

PoetRAT has the ability to list all running processes.[224]
S0216 POORAIM

POORAIM can enumerate processes.[225]
G0033 Poseidon Group

After compromising a victim, Poseidon Group lists all running processes.[226]
S0139 PowerDuke

PowerDuke has a command to list the victim's processes.[227]
S0441 PowerShower

PowerShower has the ability to deploy a reconnaissance module to retrieve a list of the active processes.[228]
S0194 PowerSploit

PowerSploit's Get-ProcessTokenPrivilege Privesc-PowerUp module can enumerate privileges for a given process.[229][230]
S0393 PowerStallion

PowerStallion has been used to monitor process lists.[231]
S0223 POWERSTATS

POWERSTATS has used get_tasklist to discover processes on the compromised host.[232]
S0184 POWRUNER

POWRUNER may collect process information by running tasklist on a victim.[233]
S0238 Proxysvc

Proxysvc lists processes running on the system.[171]
S0192 Pupy

Pupy can list the running processes and get the process ID and parent process’s ID.[234]
S0650 QakBot

QakBot has the ability to check running processes.[235]
S0629 RainyDay

RainyDay can enumerate processes on a target system.[199]
S0458 Ramsay

Ramsay can gather a list of running processes by using Tasklist.[236]
S1130 Raspberry Robin

Raspberry Robin can identify processes running on the victim machine, such as security software, during execution.[237][238]
S0241 RATANKBA

RATANKBA lists the system’s processes.[239][240]
S0662 RCSession

RCSession can identify processes based on PID.[241]
S0125 Remsec

Remsec can obtain a process list from the victim.[242]
S0448 Rising Sun

Rising Sun can enumerate all running processes and process information on an infected machine.[243]

G0106 Rocke

Rocke can detect a running process's PID on the infected machine.[244]

S0270 RogueRobin

RogueRobin checks the running processes for evidence it may be running in a sandbox environment. It specifically enumerates processes for Wireshark and Sysinternals.[245]
S0240 ROKRAT

ROKRAT can list the current running processes on the system.[246][247]
S1078 RotaJakiro

RotaJakiro can monitor the /proc/[PID] directory of known RotaJakiro processes as a part of its persistence when executing with non-root permissions. If the process is found dead, it resurrects the process. RotaJakiro processes can be matched to an associated Advisory Lock, in the /proc/locks folder, to ensure it doesn't spawn more than one process.[248]
S1073 Royal

Royal can use GetCurrentProcess to enumerate processes.[249]
S0148 RTM

RTM can obtain information about process integrity levels.[250]
S0446 Ryuk

Ryuk has called CreateToolhelp32Snapshot to enumerate all running processes.[251]
S1018 Saint Bot

Saint Bot has enumerated running processes on a compromised host to determine if it is running under the process name dfrgui.exe.[214]
S1085 Sardonic

Sardonic has the ability to execute the tasklist command.[252]
S0461 SDBbot

SDBbot can enumerate a list of running processes on a compromised machine.[253]
S0345 Seasalt

Seasalt has a command to perform a process listing.[36]
S0596 ShadowPad

ShadowPad has collected the PID of a malicious process.[254]
S0445 ShimRatReporter

ShimRatReporter listed all running processes on the machine.[255]
S0063 SHOTPUT

SHOTPUT has a command to obtain a process listing.[256]
G0121 Sidewinder

Sidewinder has used tools to identify running processes on the victim's machine.[257]
S0692 SILENTTRINITY

SILENTTRINITY can enumerate processes, including properties to determine if they have the Common Language Runtime (CLR) loaded.[258]
S0468 Skidmap

Skidmap has monitored critical processes to ensure resiliency.[259]

S0533 SLOTHFULMEDIA

SLOTHFULMEDIA has enumerated processes by ID, name, or privileges.[260]

S1124 SocGholish

SocGholish can list processes on targeted hosts.[261]
S0273 Socksbot

Socksbot can list all running processes.[262]
S0627 SodaMaster

SodaMaster can search a list of running processes.[215]
C0024 SolarWinds Compromise

During the SolarWinds Compromise, APT29 used multiple command-line utilities to enumerate running processes.[263][264][265]
S0615 SombRAT

SombRAT can use the getprocesslist command to enumerate processes on a compromised host.[266][131][267]
S0516 SoreFang

SoreFang can enumerate processes on a victim machine through use of Tasklist.[268]
G0038 Stealth Falcon

Stealth Falcon malware gathers a list of running processes.[269]
S0142 StreamEx

StreamEx has the ability to enumerate processes.[270]
S0491 StrongPity

StrongPity can determine if a user is logged in by checking to see if explorer.exe is running.[271]
S0559 SUNBURST

SUNBURST collected a list of process names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.[272]
S0562 SUNSPOT

SUNSPOT monitored running processes for instances of MsBuild.exe by hashing the name of each running process and comparing it to the corresponding value 0x53D525. It also extracted command-line arguments and individual arguments from the running MsBuild.exe process to identify the directory path of the Orion software Visual Studio solution.[273]
S1064 SVCReady

SVCReady can collect a list of running processes from an infected host.[274]
S0018 Sykipot

Sykipot may gather a list of running processes by running tasklist /v.[275]
S0242 SynAck

SynAck enumerates all running processes.[276][277]
S0464 SYSCON

SYSCON has the ability to use Tasklist to list running processes.[278]
S0663 SysUpdate

SysUpdate can collect information about running processes.[279]
S0011 Taidoor

Taidoor can use GetCurrentProcessId for process discovery.[280]
S0586 TAINTEDSCRIBE

TAINTEDSCRIBE can execute ProcessList for process discovery.[281]
S0467 TajMahal

TajMahal has the ability to identify running processes and associated plugins on an infected host.[282]
S0057 Tasklist

Tasklist can be used to discover processes running on a system.[283]
G0139 TeamTNT

TeamTNT has searched for rival malware and removes it if found.[284] TeamTNT has also searched for running processes containing the strings aliyun or liyun to identify machines running Alibaba Cloud Security tools.[285]
S0595 ThiefQuest

ThiefQuest obtains a list of running processes using the function kill_unwanted.[286]
G1022 ToddyCat

ToddyCat has run cmd /c start /b tasklist to enumerate processes.[204]
S0266 TrickBot

TrickBot uses module networkDll for process list discovery.[287][288]
S0094 Trojan.Karagany

Trojan.Karagany can use Tasklist to collect a list of running tasks.[29][289]
G0081 Tropic Trooper

Tropic Trooper is capable of enumerating the running processes on the system using pslist.[290][291]
S0436 TSCookie

TSCookie has the ability to list processes on the infected host.[292]
G0010 Turla

Turla surveys a system upon check-in to discover running processes using the tasklist /v command.[106] Turla RPC backdoors have also enumerated processes associated with specific open ports or named pipes.[231]
S0333 UBoatRAT

UBoatRAT can list running processes on the system.[293]
S0022 Uroburos

Uroburos can use its Process List command to enumerate processes on compromised hosts.[294]
S0386 Ursnif

Ursnif has gathered information about running processes.[295][296]
S0452 USBferry

USBferry can use tasklist to gather information about the process running on the infected system.[291]

S0476 Valak

Valak has the ability to enumerate running processes on a compromised host.[297]
S0257 VERMIN

VERMIN can get a list of the processes and running tasks on the system.[298]
S0180 Volgmer

Volgmer can gather a list of processes.[299]
G1017 Volt Typhoon

Volt Typhoon has enumerated running processes on targeted systems including through the use of Tasklist.[300][301][302]
S0670 WarzoneRAT

WarzoneRAT can obtain a list of processes on a compromised host.[303]
S0579 Waterbear

Waterbear can identify the process for a specific security product.[304]
G0112 Windshift

Windshift has used malware to enumerate active processes.[305]
S0219 WINERACK

WINERACK can enumerate processes.[225]
S0059 WinMM

WinMM sets a WH_CBT Windows hook to collect information on process creation.[306]
S0141 Winnti for Windows

Winnti for Windows can check if the explorer.exe process is responsible for calling its install function.[307]
G0044 Winnti Group

Winnti Group looked for a specific process running on infected servers.[308]
S1065 Woody RAT

Woody RAT can call NtQuerySystemProcessInformation with SystemProcessInformation to enumerate all running processes, including associated information such as PID, parent PID, image name, and owner.[309]
S0161 XAgentOSX

XAgentOSX contains the getProcessList function to run ps aux to get running processes.[310]
S0248 yty

yty gets an output of running processes using the tasklist command.[311]
S0251 Zebrocy

Zebrocy uses the tasklist and wmic process get Capture, ExecutablePath commands to gather the processes running on the system.[54][312][55][313][314]
S0330 Zeus Panda

Zeus Panda checks for running processes on the victim’s machine.[315]
S1114 ZIPLINE

ZIPLINE can identify running processes and their names.[316]
S0672 Zox

Zox has the ability to list processes.[317]
S0412 ZxShell

ZxShell has a command, ps, to obtain a listing of processes on the system.[318]

S1013 ZxxZ

ZxxZ has created a snapshot of running processes using CreateToolhelp32Snapshot.[319]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

ID Data Source Data Component Detects
DS0017 Command Command Execution

Monitor executed commands and arguments for actions that may attempt to get information about running processes on a system.
DS0009 Process OS API Execution

Monitor for API calls may attempt to get information about running processes on a system.

Process Creation

Monitor for newly executed processes that may attempt to get information about running processes on a system. To be effective in deciphering malicious and benign activity, the full command line is essential. Similarly, having information about the parent process can help with making decisions and tuning to an environment.

Because these commands are built in, they may be run frequently by power users or even by normal users. Thus, an analytic looking at this information should have well-defined white- or blacklists, and should consider looking at an anomaly detection approach, so that this information can be learned dynamically.Within the built-in Windows Commands:

  • hostname
  • ipconfig
  • net
  • quser
  • qwinsta
  • sc with flags query, queryex, qc
  • systeminfo
  • tasklist
  • dsquery
  • whoamiNote: To be effective in deciphering malicious and benign activity, the full command line is essential. Similarly, having information about the parent process can help with making decisions and tuning to an environment.

Analytic 1 - Host Discovery Commands

(source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode="1") OR (source="WinEventLog:Security" EventCode="4688") (Image="C:\Windows\\hostname.exe" OR Image="C:\Windows\\ipconfig.exe" OR Image="C:\Windows\\net.exe" OR Image="C:\Windows\\quser.exe" OR Image="C:\Windows\\qwinsta.exe" OR (Image="C:\Windows\\sc.exe" AND (CommandLine=" query " OR CommandLine=" qc ")) OR Image="C:\Windows\\systeminfo.exe" OR Image="C:\Windows\\tasklist.exe" OR Image="C:\Windows\*\whoami.exe")|stats values(Image) as "Images" values(CommandLine) as "Command Lines" by ComputerName

References

  1. US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.
  2. Cisco. (2022, August 16). show processes - . Retrieved July 13, 2022.
  3. Crowdstrike Global Intelligence Team. (2014, June 9). CrowdStrike Intelligence Report: Putter Panda. Retrieved January 22, 2016.
  4. ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.
  5. Zhang, X. (2017, June 28). In-Depth Analysis of A New Variant of .NET Malware AgentTesla. Retrieved November 5, 2018.
  6. Max Kersten & Alexandre Mundo. (2023, November 29). Akira Ransomware. Retrieved April 4, 2024.
  7. Park, S. (2021, June 15). Andariel evolves to target South Korea with ransomware. Retrieved September 29, 2021.
  8. Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024.
  9. Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021.
  10. Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.
  11. Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017.
  12. Chen, X., Scott, M., Caselden, D.. (2014, April 26). New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks. Retrieved January 14, 2016.
  13. Yates, M. (2017, June 18). APT3 Uncovered: The code evolution of Pirpi. Retrieved September 28, 2017.
  14. Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.
  15. FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 6, 2018.
  16. Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.
  17. CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.
  18. Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.
  19. Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.
  20. Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.
  21. Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.
  22. Hasherezade. (2021, July 23). AvosLocker enters the ransomware scene, asks for partners. Retrieved January 11, 2023.
  23. Yan, T., et al. (2018, November 21). New Wine in Old Bottle: New Azorult Variant Found in FindMyName Campaign using Fallout Exploit Kit. Retrieved November 29, 2018.
  24. Proofpoint. (2018, July 30). New version of AZORult stealer improves loading features, spreads alongside ransomware in new campaign. Retrieved November 29, 2018.
  25. Sogeti. (2021, March). Babuk Ransomware. Retrieved August 11, 2021.
  26. Mundo, A. et al. (2021, February). Technical Analysis of Babuk Ransomware. Retrieved August 11, 2021.
  27. Centero, R. et al. (2021, February 5). New in Ransomware: Seth-Locker, Babuk Locker, Maoloa, TeslaCrypt, and CobraLocker. Retrieved August 11, 2021.
  28. Unit 42. (2019, February 22). New BabyShark Malware Targets U.S. National Security Think Tanks. Retrieved October 7, 2019.
  29. Symantec Security Response. (2014, June 30). Dragonfly: Cyberespionage Attacks Against Energy Suppliers. Retrieved April 8, 2016.
  30. FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved May 1, 2015.
  31. Mamedov, O. Sinitsyn, F. Ivanov, A.. (2017, October 24). Bad Rabbit ransomware. Retrieved January 28, 2021.
  32. Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.
  33. Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.
  34. Cybereason Nocturnus. (2020, July 16). A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES. Retrieved November 18, 2020.
  35. Lee, B. Grunzweig, J. (2015, December 22). BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger. Retrieved August 19, 2016.
  36. Mandiant. (n.d.). Appendix C (Digital) - The Malware Arsenal. Retrieved July 18, 2016.
  37. Hayashi, K., Ray, V. (2018, July 31). Bisonal Malware Used in Attacks Against Russia and South Korea. Retrieved August 7, 2018.
  38. Zykov, K. (2020, August 13). CactusPete APT group’s updated Bisonal backdoor. Retrieved May 5, 2021.
  39. Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022.
  40. FireEye Labs/FireEye Threat Intelligence. (2015, May 14). Hiding in Plain Sight: FireEye and Microsoft Expose Obfuscation Tactic. Retrieved January 22, 2016.
  41. F-Secure Labs. (2014). BlackEnergy & Quedagh: The convergence of crimeware and APT attacks. Retrieved March 24, 2016.
  42. Baumgartner, K. and Garnaeva, M.. (2014, November 3). BE2 custom plugins, router abuse, and target profiles. Retrieved March 24, 2016.
  43. Cherepanov, A.. (2016, January 3). BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry . Retrieved June 10, 2020.
  44. Cash, D., Grunzweig, J., Meltzer, M., Adair, S., Lancaster, T. (2021, August 17). North Korean APT InkySquid Infects Victims Using Browser Exploits. Retrieved September 30, 2021.
  45. Dumont, R., M.Léveillé, M., Porcher, H. (2018, December 1). THE DARK SIDE OF THE FORSSHE A landscape of OpenSSH backdoors. Retrieved July 16, 2020.
  46. Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018.
  47. Harbison, M. and Renals, P. (2022, July 5). When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors. Retrieved February 1, 2023.
  48. Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.
  49. Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022.
  50. Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.
  51. Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.
  52. DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.
  53. Threat Intelligence Team. (2022, March 18). Double header: IsaacWiper and CaddyWiper . Retrieved April 11, 2022.
  54. Falcone, R., Lee, B. (2018, November 20). Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan. Retrieved November 26, 2018.
  55. Lee, B., Falcone, R. (2018, December 12). Dear Joohn: The Sofacy Group’s Global Campaign. Retrieved April 19, 2019.
  56. Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018.
  57. Trusteer Fraud Prevention Center. (2010, October 7). Carberp Under the Hood of Carberp: Malware & Configuration Analysis. Retrieved July 15, 2020.
  58. ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.
  59. Grunzweig, J.. (2017, April 20). Cardinal RAT Active for Over Two Years. Retrieved December 8, 2018.
  60. ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021.
  61. Check Point. (2022, January 11). APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit. Retrieved January 24, 2022.
  62. Miller-Osborn, J. and Grunzweig, J.. (2017, February 16). menuPass Returns with New Malware and New Attacks Against Japanese Academics and Organizations. Retrieved March 1, 2017.
  63. Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024.
  64. Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.
  65. Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.
  66. Mundo, A. (2019, August 1). Clop Ransomware. Retrieved May 10, 2021.
  67. Dutch Military Intelligence and Security Service (MIVD) & Dutch General Intelligence and Security Service (AIVD). (2024, February 6). Ministry of Defense of the Netherlands uncovers COATHANGER, a stealthy Chinese FortiGate RAT. Retrieved February 7, 2024.
  68. Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017.
  69. Mavis, N. (2020, September 21). The Art and Science of Detecting Cobalt Strike. Retrieved September 12, 2024.
  70. Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021.
  71. Grunzweig, J. (2018, January 31). Comnie Continues to Target Organizations in East Asia. Retrieved June 7, 2018.
  72. Baskin, B. (2020, July 8). TAU Threat Discovery: Conti Ransomware. Retrieved February 17, 2021.
  73. Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.
  74. Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.
  75. N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.
  76. Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.
  77. Kohler, A. and Lopez, C. (2024, April 30). Malware: Cuckoo Behaves Like Cross Between Infostealer and Spyware. Retrieved August 20, 2024.
  78. NCSC. (2022, February 23). Cyclops Blink Malware Analysis Report. Retrieved March 3, 2022.
  79. Mabutas, G. (2020, May 11). New MacOS Dacls RAT Backdoor Shows Lazarus’ Multi-Platform Attack Capability. Retrieved August 10, 2020.
  80. Kujawa, A. (2018, March 27). You dirty RAT! Part 1: DarkComet. Retrieved November 6, 2018.
  81. Adi Zeligson & Rotem Kerner. (2018, November 13). Enter The DarkGate - New Cryptocurrency Mining and Ransomware Campaign. Retrieved February 9, 2024.
  82. Kaspersky Lab's Global Research & Analysis Team. (2015, August 10). Darkhotel's attacks in 2015. Retrieved November 2, 2018.
  83. Secureworks Counter Threat Unit Research Team. (2022, August 17). DarkTortilla Malware Analysis. Retrieved November 3, 2022.
  84. Alperovitch, D. (2014, July 7). Deep in Thought: Chinese Targeting of National Security Think Tanks. Retrieved November 12, 2014.
  85. Fidelis Cybersecurity. (2016, February 29). The Turbo Campaign, Featuring Derusbi for 64-bit Linux. Retrieved March 2, 2016.
  86. FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.
  87. Neeamni, D., Rubinfeld, A.. (2021, July 1). Diavol - A New Ransomware Used By Wizard Spider?. Retrieved November 12, 2021.
  88. Fishbein, N., Kajiloti, M.. (2020, July 28). Watch Your Containers: Doki Infecting Docker Servers in the Cloud. Retrieved March 30, 2021.
  89. TheWover. (2019, May 9). donut. Retrieved March 25, 2022.
  90. ClearSky Research Team. (2020, August 13). Operation 'Dream Job' Widespread North Korean Espionage Campaign. Retrieved December 20, 2021.
  91. Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.
  92. Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.
  93. Symantec Security Response. (2011, November). W32.Duqu: The precursor to the next Stuxnet. Retrieved September 17, 2015.
  94. Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.
  95. ClearSky. (2016, January 7). Operation DustySky. Retrieved January 8, 2016.
  96. GReAT. (2019, April 10). Gaza Cybergang Group1, operation SneakyPastes. Retrieved May 13, 2020.
  97. Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.
  98. Dragos. (2020, February 3). EKANS Ransomware and ICS Operations. Retrieved February 9, 2021.
  99. Zafra, D., et al. (2020, February 24). Ransomware Against the Machine: How Adversaries are Learning to Disrupt Industrial Production by Targeting IT and OT. Retrieved March 2, 2021.
  100. Singleton, C. and Kiefer, C. (2020, September 28). Ransomware 2020: Attack Trends Affecting Organizations Worldwide. Retrieved September 20, 2021.
  101. Accenture Security. (2018, January 27). DRAGONFISH DELIVERS NEW FORM OF ELISE MALWARE TARGETING ASEAN DEFENCE MINISTERS’ MEETING AND ASSOCIATES. Retrieved November 14, 2018.
  102. Winters, R. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016.
  103. ASEC. (2017). ASEC REPORT VOL.88. Retrieved April 16, 2019.
  104. Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.
  105. Adamitis, D. et al. (2019, June 4). It's alive: Threat actors cobble together open-source pieces into monstrous Frankenstein campaign. Retrieved May 11, 2020.
  106. Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.
  107. Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.
  108. Marschalek, M.. (2014, December 16). EvilBunny: Malware Instrumented By Lua. Retrieved June 28, 2019.
  109. Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.
  110. Cherepanov, A. (2018, October). GREYENERGY A successor to BlackEnergy. Retrieved November 15, 2018.
  111. Grunzweig, J. (2018, October 01). NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT. Retrieved November 5, 2018.
  112. FinFisher. (n.d.). Retrieved September 12, 2024.
  113. Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.
  114. Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.
  115. Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.
  116. Kremez, V. (2019, September 19). FIN6 “FrameworkPOS”: Point-of-Sale Malware Analysis & Internals. Retrieved September 8, 2020.
  117. Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.
  118. Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.
  119. Doctor Web. (2014, November 21). Linux.BackDoor.Fysbis.1. Retrieved December 7, 2017.
  120. Symantec. (2022, January 31). Shuckworm Continues Cyber-Espionage Attacks Against Ukraine. Retrieved February 17, 2022.
  121. Unit 42. (2022, February 3). Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine. Retrieved February 21, 2022.
  122. Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.
  123. F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015.
  124. Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.
  125. FireEye Threat Intelligence. (2015, July 13). Demonstrating Hustle, Chinese APT Groups Quickly Use Zero-Day Vulnerability (CVE-2015-5119) Following Hacking Team Leak. Retrieved January 25, 2016.
  126. Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.
  127. ESET. (2020, April 28). Grandoreiro: How engorged can an EXE get?. Retrieved November 13, 2020.
  128. Mercer, W., Rascagneres, P. (2018, April 26). GravityRAT - The Two-Year Evolution Of An APT Targeting India. Retrieved May 16, 2018.
  129. Eoin Miller. (2021, March 23). Defending Against the Zero Day: Analyzing Attacker Behavior Post-Exploitation of Microsoft Exchange. Retrieved October 27, 2022.
  130. Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing LNK. Retrieved April 24, 2017.
  131. McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.
  132. Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022.
  133. Chen, Joey. (2022, June 9). Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years. Retrieved July 14, 2022.
  134. Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.
  135. Knight, S.. (2020, April 16). VMware Carbon Black TAU Threat Analysis: The Evolution of Lazarus. Retrieved May 1, 2020.
  136. Symantec Security Response. (2010, January 18). The Trojan.Hydraq Incident. Retrieved February 20, 2018.
  137. Lelli, A. (2010, January 11). Trojan.Hydraq. Retrieved February 20, 2018.
  138. Unit 42. (2019, December 2). Imminent Monitor – a RAT Down Under. Retrieved May 5, 2020.
  139. Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.
  140. Symantec. (2018, March 14). Inception Framework: Alive and Well, and Hiding Behind Proxies. Retrieved May 8, 2020.
  141. Daniel Kapellmann Zafra, Raymond Leong, Chris Sistrunk, Ken Proska, Corey Hildebrandt, Keith Lunden, Nathan Brubaker. (2022, April 25). INDUSTROYER.V2: Old Malware Learns New Tricks. Retrieved March 30, 2023.
  142. Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.
  143. Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.
  144. Reichel, D. (2021, February 19). IronNetInjector: Turla’s New Malware Loading Tool. Retrieved February 24, 2021.
  145. Sancho, D., et al. (2012, May 22). IXESHE An APT Campaign. Retrieved June 7, 2019.
  146. GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.
  147. ESET. (2016, October). En Route with Sednit - Part 1: Approaching the Target. Retrieved November 8, 2016.
  148. Lee, B, et al. (2018, February 28). Sofacy Attacks Multiple Government Entities. Retrieved March 15, 2018.
  149. Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
  150. Bingham, J. (2013, February 11). Cross-Platform Frutas RAT Builder and Back Door. Retrieved April 23, 2019.
  151. Yadav, A., et al. (2016, January 29). Malicious Office files dropping Kasidet and Dridex. Retrieved March 24, 2016.
  152. Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.
  153. Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.
  154. Smallridge, R. (2018, March 10). APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS. Retrieved April 4, 2018.
  155. US-CERT. (2018, August 09). MAR-10135536-17 – North Korean Trojan: KEYMARBLE. Retrieved August 16, 2018.
  156. Gilbert Sison, Rheniel Ramos, Jay Yaneza, Alfredo Oliveira. (2018, January 15). KillDisk Variant Hits Latin American Financial Groups. Retrieved January 12, 2021.
  157. An, J and Malhotra, A. (2021, November 10). North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets. Retrieved December 29, 2021.
  158. Singer, G. (2020, April 3). Threat Alert: Kinsing Malware Attacks Targeting Container Environments. Retrieved April 1, 2021.
  159. Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26). Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.
  160. Karmi, D. (2020, January 4). A Look Into Konni 2019 Campaign. Retrieved April 28, 2020.
  1. Threat Intelligence Team. (2021, August 23). New variant of Konni malware used in campaign targetting Russia. Retrieved January 5, 2022.
  2. Hawley, S. et al. (2023, February 2). Turla: A Galaxy of Opportunity. Retrieved May 15, 2023.
  3. Black Lotus Labs. (2023, December 13). Routers Roasting On An Open Firewall: The KV-Botnet Investigation. Retrieved June 10, 2024.
  4. Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.
  5. Proofpoint Threat Research and Team Cymru S2 Threat Research. (2024, April 4). Latrodectus: This Spider Bytes Like Ice . Retrieved May 31, 2024.
  6. Stepanic, D. and Bousseaden, S. (2024, May 15). Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID. Retrieved September 13, 2024.
  7. Batista, J. (2024, June 17). Latrodectus, are you coming back?. Retrieved September 13, 2024.
  8. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.
  9. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Loaders, Installers and Uninstallers Report. Retrieved March 2, 2016.
  10. Sherstobitoff, R. (2018, February 12). Lazarus Resurfaces, Targets Global Banks and Bitcoin Users. Retrieved February 19, 2018.
  11. Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.
  12. Saini, A. and Hossein, J. (2022, January 27). North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign. Retrieved January 27, 2022.
  13. Zhou, R. (2012, May 15). Backdoor.Linfo. Retrieved February 23, 2018.
  14. Seals, T. (2021, May 14). FIN7 Backdoor Masquerades as Ethical Hacking Tool. Retrieved February 2, 2022.
  15. BI.ZONE Cyber Threats Research Team. (2021, May 13). From pentest to APT attack: cybercriminal group FIN7 disguises its malware as an ethical hacker’s toolkit. Retrieved February 2, 2022.
  16. Raggi, M. Schwarz, D.. (2019, August 1). LookBack Malware Targets the United States Utilities Sector with Phishing Attacks Impersonating Engineering Licensing Boards. Retrieved February 25, 2021.
  17. Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.
  18. Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.
  19. Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.
  20. ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019.
  21. M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.
  22. Phil Stokes. (2021, January 11). FADE DEAD | Adventures in Reversing Malicious Run-Only AppleScripts. Retrieved September 29, 2022.
  23. Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.
  24. Lee, B. and Falcone, R. (2017, February 15). Magic Hound Campaign Attacks Saudi Targets. Retrieved December 27, 2017.
  25. GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.
  26. Mundo, A. (2020, March 26). Ransomware Maze. Retrieved May 18, 2020.
  27. SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.
  28. Erlich, C. (2020, April 3). The Avast Abuser: Metamorfo Banking Malware Hides By Abusing Avast Executable. Retrieved May 26, 2020.
  29. Check Point Research Team. (2021, August 14). Indra - Hackers Behind Recent Attacks on Iran. Retrieved February 17, 2022.
  30. Threat Hunter Team. (2023, April 20). Daggerfly: APT Actor Targets Telecoms Company in Africa. Retrieved July 25, 2024.
  31. ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.
  32. Falcone, R. and Miller-Osborn, J.. (2016, January 24). Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists. Retrieved February 10, 2016.
  33. Miller-Osborn, J. and Grunzweig, J.. (2017, March 30). Trochilus and New MoonWind RATs Used In Attack Against Thai Organizations. Retrieved March 30, 2017.
  34. ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.
  35. Kaspersky Lab's Global Research & Analysis Team. (2018, October 10). MuddyWater expands operations. Retrieved November 2, 2018.
  36. ClearSky. (2019, June). Iranian APT group ‘MuddyWater’ Adds Exploits to Their Arsenal. Retrieved May 14, 2020.
  37. Hamzeloofard, S. (2020, January 31). New wave of PlugX targets Hong Kong | Avira Blog. Retrieved April 13, 2021.
  38. Mercer, W., Rascagneres, P. (2018, May 31). NavRAT Uses US-North Korea Summit As Decoy For Attacks In South Korea. Retrieved June 11, 2018.
  39. Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.
  40. Maniath, S. and Kadam P. (2019, March 19). Dissecting a NETWIRE Phishing Campaign's Usage of Process Hollowing. Retrieved January 7, 2021.
  41. Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.
  42. Ahn Ho, Facundo Muñoz, & Marc-Etienne M.Léveillé. (2024, March 7). Evasive Panda leverages Monlam Festival to target Tibetans. Retrieved July 25, 2024.
  43. Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.
  44. Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.
  45. Pascual, C. (2018, November 27). AutoIt-Compiled Worm Affecting Removable Media Delivers Fileless Version of BLADABINDI/njRAT Backdoor. Retrieved June 4, 2019.
  46. KASPERSKY GERT. (2023, December 14). Unveiling NKAbuse: a new multiplatform threat abusing the NKN protocol. Retrieved February 8, 2024.
  47. Malhotra, A. (2021, March 2). ObliqueRAT returns with new campaign using hijacked websites. Retrieved September 2, 2021.
  48. Sherstobitoff, R., Malhotra, A. (2018, October 18). ‘Operation Oceansalt’ Attacks South Korea, U.S., and Canada With Source Code From Chinese Hacker Group. Retrieved November 30, 2018.
  49. Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.
  50. Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.
  51. Sherstobitoff, R. (2018, March 02). McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups. Retrieved May 16, 2018.
  52. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.
  53. Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.
  54. Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
  55. GREAT. (2021, March 30). APT10: sophisticated multi-layered loader Ecipekac discovered in A41APT campaign. Retrieved June 17, 2021.
  56. Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.
  57. Mullaney, C. & Honda, H. (2012, May 4). Trojan.Pasam. Retrieved February 22, 2018.
  58. Trustwave SpiderLabs. (2020, June 22). Pillowmint: FIN7’s Monkey Thief . Retrieved July 27, 2020.
  59. Tartare, M. et al. (2020, May 21). No “Game over” for the Winnti Group. Retrieved August 24, 2020.
  60. Ash, B., et al. (2018, June 26). RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families. Retrieved July 2, 2018.
  61. Trend Micro Research. (2023, July 21). Ransomware Spotlight: Play. Retrieved September 24, 2024.
  62. Bermejo, L., et al. (2017, June 22). Following the Trail of BlackTech’s Cyber Espionage Campaigns. Retrieved May 5, 2020.
  63. Computer Incident Response Center Luxembourg. (2013, March 29). Analysis of a PlugX variant. Retrieved November 5, 2018.
  64. Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.
  65. FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved March 1, 2018.
  66. Kaspersky Lab's Global Research and Analysis Team. (2016, February 9). Poseidon Group: a Targeted Attack Boutique specializing in global cyber-espionage. Retrieved March 16, 2016.
  67. Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
  68. GReAT. (2019, August 12). Recent Cloud Atlas activity. Retrieved May 8, 2020.
  69. PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.
  70. PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.
  71. Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.
  72. Lunghi, D. and Horejsi, J.. (2019, June 10). MuddyWater Resurfaces, Uses Multi-Stage Backdoor POWERSTATS V3 and New Post-Exploitation Tools. Retrieved May 14, 2020.
  73. Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017.
  74. Nicolas Verdier. (n.d.). Retrieved January 29, 2018.
  75. Morrow, D. (2021, April 15). The rise of QakBot. Retrieved September 27, 2021.
  76. Antiy CERT. (2020, April 20). Analysis of Ramsay components of Darkhotel's infiltration and isolation network. Retrieved March 24, 2021.
  77. Christopher So. (2022, December 20). Raspberry Robin Malware Targets Telecom, Governments. Retrieved May 17, 2024.
  78. Patrick Schläpfer . (2024, April 10). Raspberry Robin Now Spreading Through Windows Script Files. Retrieved May 17, 2024.
  79. Lei, C., et al. (2018, January 24). Lazarus Campaign Targeting Cryptocurrencies Reveals Remote Controller Tool, an Evolved RATANKBA, and More. Retrieved May 22, 2018.
  80. Trend Micro. (2017, February 27). RATANKBA: Delving into Large-scale Watering Holes against Enterprises. Retrieved May 22, 2018.
  81. Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.
  82. Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.
  83. Sherstobitoff, R., Malhotra, A., et. al.. (2018, December 18). Operation Sharpshooter Campaign Targets Global Defense, Critical Infrastructure. Retrieved May 14, 2020.
  84. Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With a New Malware Family Written in Golang. Retrieved April 24, 2019.
  85. Falcone, R., et al. (2018, July 27). New Threat Actor Group DarkHydrus Targets Middle East Government. Retrieved August 2, 2018.
  86. Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018.
  87. Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020.
  88. Alex Turing, Hui Wang. (2021, April 28). RotaJakiro: A long live secret backdoor with 0 VT detection. Retrieved June 14, 2023.
  89. Cybereason Global SOC and Cybereason Security Research Teams. (2022, December 14). Royal Rumble: Analysis of Royal Ransomware. Retrieved March 30, 2023.
  90. Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.
  91. Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020.
  92. Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.
  93. Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
  94. Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.
  95. Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.
  96. Falcone, R. and Wartell, R.. (2015, July 27). Observations on CVE-2015-3113, Prior Zero-Days and the Pirpi Payload. Retrieved January 22, 2016.
  97. Hegel, T. (2021, January 13). A Global Perspective of the SideWinder APT. Retrieved January 27, 2021.
  98. Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022.
  99. Remillano, A., Urbanec, J. (2019, September 19). Skidmap Linux Malware Uses Rootkit Capabilities to Hide Cryptocurrency-Mining Payload. Retrieved June 4, 2020.
  100. DHS/CISA, Cyber National Mission Force. (2020, October 1). Malware Analysis Report (MAR) MAR-10303705-1.v1 – Remote Access Trojan: SLOTHFULMEDIA. Retrieved October 2, 2020.
  101. Secureworks. (n.d.). GOLD PRELUDE . Retrieved March 22, 2024.
  102. Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.
  103. Cash, D. et al. (2020, December 14). Dark Halo Leverages SolarWinds Compromise to Breach Organizations. Retrieved December 29, 2020.
  104. MSTIC, CDOC, 365 Defender Research Team. (2021, January 20). Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop . Retrieved January 22, 2021.
  105. CrowdStrike. (2022, January 27). Early Bird Catches the Wormhole: Observations from the StellarParticle Campaign. Retrieved February 7, 2022.
  106. The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.
  107. CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.
  108. CISA. (2020, July 16). MAR-10296782-1.v1 – SOREFANG. Retrieved September 29, 2020.
  109. Marczak, B. and Scott-Railton, J.. (2016, May 29). Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents. Retrieved June 8, 2016.
  110. Cylance SPEAR Team. (2017, February 9). Shell Crew Variants Continue to Fly Under Big AV’s Radar. Retrieved February 15, 2017.
  111. Mercer, W. et al. (2020, June 29). PROMETHIUM extends global reach with StrongPity3 APT. Retrieved July 20, 2020.
  112. FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.
  113. CrowdStrike Intelligence Team. (2021, January 11). SUNSPOT: An Implant in the Build Process. Retrieved January 11, 2021.
  114. Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.
  115. Blasco, J. (2011, December 12). Another Sykipot sample likely targeting US federal agencies. Retrieved March 28, 2016.
  116. Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
  117. Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.
  118. McCabe, A. (2020, January 23). The Fractured Statue Campaign: U.S. Government Agency Targeted in Spear-Phishing Attacks. Retrieved June 2, 2020.
  119. Daniel Lunghi. (2023, March 1). Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting. Retrieved March 20, 2023.
  120. CISA, FBI, DOD. (2021, August). MAR-10292089-1.v2 – Chinese Remote Access Trojan: TAIDOOR. Retrieved August 24, 2021.
  121. USG. (2020, May 12). MAR-10288834-2.v1 – North Korean Trojan: TAINTEDSCRIBE. Retrieved March 5, 2021.
  122. GReAT. (2019, April 10). Project TajMahal – a sophisticated new APT framework. Retrieved October 14, 2019.
  123. Microsoft. (n.d.). Tasklist. Retrieved December 23, 2015.
  124. Fiser, D. Oliveira, A. (n.d.). Tracking the Activities of TeamTNT A Closer Look at a Cloud-Focused Malicious Actor Group. Retrieved September 22, 2021.
  125. Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022.
  126. Patrick Wardle. (2020, June 29). OSX.EvilQuest Uncovered part i: infection, persistence, and more!. Retrieved March 18, 2021.
  127. Boutin, J. (2020, October 12). ESET takes part in global operation to disrupt Trickbot. Retrieved March 15, 2021.
  128. Tudorica, R., Maximciuc, A., Vatamanu, C. (2020, March 18). New TrickBot Module Bruteforces RDP Connections, Targets Select Telecommunication Services in US and Hong Kong. Retrieved March 15, 2021.
  129. Secureworks. (2019, July 24). Updated Karagany Malware Targets Energy Sector. Retrieved August 12, 2020.
  130. Ray, V. (2016, November 22). Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy. Retrieved November 9, 2018.
  131. Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.
  132. Tomonaga, S. (2018, March 6). Malware “TSCookie”. Retrieved May 6, 2020.
  133. Hayashi, K. (2017, November 28). UBoatRAT Navigates East Asia. Retrieved January 12, 2018.
  134. FBI et al. (2023, May 9). Hunting Russian Intelligence “Snake” Malware. Retrieved June 8, 2023.
  135. Caragay, R. (2015, March 26). URSNIF: The Multifaceted Malware. Retrieved June 5, 2019.
  136. Sioting, S. (2013, June 15). BKDR_URSNIF.SM. Retrieved June 5, 2019.
  137. Salem, E. et al. (2020, May 28). VALAK: MORE THAN MEETS THE EYE . Retrieved June 19, 2020.
  138. Lancaster, T., Cortes, J. (2018, January 29). VERMIN: Quasar RAT and Custom Malware Used In Ukraine. Retrieved July 5, 2018.
  139. Yagi, J. (2014, August 24). Trojan.Volgmer. Retrieved July 16, 2018.
  140. Microsoft Threat Intelligence. (2023, May 24). Volt Typhoon targets US critical infrastructure with living-off-the-land techniques. Retrieved July 27, 2023.
  141. Counter Threat Unit Research Team. (2023, May 24). Chinese Cyberespionage Group BRONZE SILHOUETTE Targets U.S. Government and Defense Organizations. Retrieved July 27, 2023.
  142. CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.
  143. Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.
  144. Su, V. et al. (2019, December 11). Waterbear Returns, Uses API Hooking to Evade Security. Retrieved February 22, 2021.
  145. The BlackBerry Research & Intelligence Team. (2020, October). BAHAMUT: Hack-for-Hire Masters of Phishing, Fake News, and Fake Apps. Retrieved February 8, 2021.
  146. Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved April 10, 2019.
  147. Novetta Threat Research Group. (2015, April 7). Winnti Analysis. Retrieved February 8, 2017.
  148. Kaspersky Lab's Global Research and Analysis Team. (2013, April 11). Winnti. More than just a game. Retrieved February 8, 2017.
  149. MalwareBytes Threat Intelligence Team. (2022, August 3). Woody RAT: A new feature-rich malware spotted in the wild. Retrieved December 6, 2022.
  150. Robert Falcone. (2017, February 14). XAgentOSX: Sofacy's Xagent macOS Tool. Retrieved July 12, 2017.
  151. Schwarz, D., Sopko J. (2018, March 08). Donot Team Leverages New Modular Malware Framework in South Asia. Retrieved June 11, 2018.
  152. ESET. (2018, November 20). Sednit: What’s going on with Zebrocy?. Retrieved February 12, 2019.
  153. ESET Research. (2019, May 22). A journey to Zebrocy land. Retrieved June 20, 2019.
  154. Accenture Security. (2018, November 29). SNAKEMACKEREL. Retrieved April 15, 2019.
  155. Ebach, L. (2017, June 22). Analysis Results of Zeus.Variant.Panda. Retrieved November 5, 2018.
  156. McLellan, T. et al. (2024, January 12). Cutting Edge: Suspected APT Targets Ivanti Connect Secure VPN in New Zero-Day Exploitation. Retrieved February 27, 2024.
  157. Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
  158. Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.
  159. Raghuprasad, C . (2022, May 11). Bitter APT adds Bangladesh to their targets. Retrieved June 1, 2022.