APT41 / Wicked Panda: threat actor report
China-linked APT41 runs state espionage alongside financially motivated operations. The report covers the group's toolset, a PlugX analysis, case studies from aviation, …
Public sector
66 pages
Threat actorCyber espionageIoCPhishing
Actor240524: an espionage campaign against Azerbaijani and Israeli diplomats
Actor240524, first seen in 2024, targets government bodies and diplomats in Azerbaijan and Israel. The report walks through the infection chain from the phishing document to ABCLoader and ABCSync, its evasion techniques and IoCs.
Key findings
- 01Initial access comes through tailored, macro-enabled Word documents paired with LNK files.
- 02ABCLoader fetches additional payloads; ABCSync handles remote command execution.
- 03The malware detects analysis environments through API encryption, PEB and hardware breakpoint checks, screen resolution and process count tests, then stops.
- 04Command-and-control traffic travels over HTTPS and blends in with legitimate cloud domains.
Actor240524 aims to gain long-term access to the diplomatic correspondence and strategic data of its target countries for political leverage. The group gains initial access with tailored Word documents; a two-stage loader driven by macros and PowerShell then installs ABCSync, which provides remote command execution.
The report shows step by step how the malware recognises virtual machines and sandboxes, and lists countermeasures for each technique. An executive summary for non-technical decision makers closes the report.
Get the report
Get the full report as a PDF
32 pages, in Turkish. The report opens on this page and is also emailed to you as a PDF.
Other reports
APT29 / Cozy Bear: threat actor report
APT29, attributed to Russia's Foreign Intelligence Service (SVR): its operations from SolarWinds to the earthquake-themed campaign against Türkiye, its techniques against cloud …
Public sector
95 pages
APT34 / Helix Kitten (OilRig): threat actor report
Campaigns by Iran-linked APT34 against energy, finance, telecom and government organisations in the Middle East; its PowerShell-based backdoors, DNS-based C2 and ready-to-use …
Banking & finance
55 pages