APT41 / Wicked Panda: threat actor report
China-linked APT41 runs state espionage alongside financially motivated operations. The report covers the group's toolset, a PlugX analysis, case studies from aviation, …
Public sector
66 pages
Threat actorCyber espionageIoCYARA / SigmaPhishing
APT28 / Fancy Bear: threat actor report
APT28, linked to Russian military intelligence: its targets, four main intrusion paths, a toolset from X-Agent to Zebrocy, and per-malware IoCs with Snort rules.
Key findings
- 01APT28 gets in through four main paths: malware via spear-phishing, webmail access via spear-phishing, strategic web compromise and internet-facing servers.
- 02CHOPSTICK (X-Agent), a modular backdoor family in use since 2012 with Windows and Linux variants, is the group's main tool.
- 03Cyber espionage is combined with information operations built on leaked data, as in the election and sports body cases.
- 04The mitigations section focuses on hardening network device services such as SNMP, Telnet, VPN, SSH and TACACS+.
Active since at least 2007, APT28 (Fancy Bear, Sofacy, Sednit, STRONTIUM) targets government, defence and media organisations in NATO countries. The group is assessed to be behind attacks on the German and Norwegian parliaments, TV5Monde, the World Anti-Doping Agency and the Democratic National Committee.
The report examines the group's four main intrusion paths separately: malware via spear-phishing, webmail access via spear-phishing, strategic web compromise and internet-facing servers. It includes hardening advice for network device services such as SNMP, Telnet, VPN, SSH and TACACS+, and Snort rules for X-Agent, CompuTrace, XTunnel and Zebrocy.
Get the report
Get the full report as a PDF
63 pages, in Turkish. The report opens on this page and is also emailed to you as a PDF.
Other reports
Actor240524: an espionage campaign against Azerbaijani and Israeli diplomats
Actor240524, first seen in 2024, targets government bodies and diplomats in Azerbaijan and Israel. The report walks through the infection chain from …
Public sector
32 pages
APT29 / Cozy Bear: threat actor report
APT29, attributed to Russia's Foreign Intelligence Service (SVR): its operations from SolarWinds to the earthquake-themed campaign against Türkiye, its techniques against cloud …
Public sector
95 pages