APT41 / Wicked Panda: threat actor report
China-linked APT41 runs state espionage alongside financially motivated operations. The report covers the group's toolset, a PlugX analysis, case studies from aviation, …
Public sector
66 pages
Threat actorCyber espionageIoCYARA / SigmaSupply chain
APT29 / Cozy Bear: threat actor report
APT29, attributed to Russia's Foreign Intelligence Service (SVR): its operations from SolarWinds to the earthquake-themed campaign against Türkiye, its techniques against cloud identity infrastructure, and IoCs per campaign.
Key findings
- 01Through SUNBURST, planted in a SolarWinds Orion update, APT29 reached thousands of organisations from a single supply-chain step.
- 02Golden SAML and the hijacking of Azure AD applications show the group gaining persistence in cloud identity infrastructure without needing passwords.
- 03The phishing campaign that used the earthquake in Türkiye as a lure shows how quickly current events are turned into decoy documents.
- 04Legitimate admin tools such as AADInternals, AdFind and BloodHound are preferred over malware during reconnaissance.
Active since at least 2008, APT29 (Midnight Blizzard, NOBELIUM, The Dukes) targets government networks, diplomatic missions, research institutes and think tanks. The group is known for patient, long-term access and for its ability to reach thousands of organisations through a single software update, as in the SolarWinds Orion supply-chain attack.
The report examines identity-focused techniques such as DLL side-loading, Golden SAML and the hijacking of Azure AD applications. The campaign that used the earthquake in Türkiye as a lure is covered as a separate case study; hashes for PinchDuke, CosmicDuke, Operation Ghost and other campaigns are appended.
Get the report
Get the full report as a PDF
95 pages, in Turkish. The report opens on this page and is also emailed to you as a PDF.
Other reports
Actor240524: an espionage campaign against Azerbaijani and Israeli diplomats
Actor240524, first seen in 2024, targets government bodies and diplomats in Azerbaijan and Israel. The report walks through the infection chain from …
Public sector
32 pages
APT34 / Helix Kitten (OilRig): threat actor report
Campaigns by Iran-linked APT34 against energy, finance, telecom and government organisations in the Middle East; its PowerShell-based backdoors, DNS-based C2 and ready-to-use …
Banking & finance
55 pages