APT41 / Wicked Panda: threat actor report
China-linked APT41 runs state espionage alongside financially motivated operations. The report covers the group's toolset, a PlugX analysis, case studies from aviation, …
Public sector
66 pages
Threat actorCyber espionageYARA / SigmaPhishing
APT34 / Helix Kitten (OilRig): threat actor report
Campaigns by Iran-linked APT34 against energy, finance, telecom and government organisations in the Middle East; its PowerShell-based backdoors, DNS-based C2 and ready-to-use YARA/Sigma rules.
Key findings
- 01APT34's toolset is built largely on PowerShell, with POWRUNER, QUADAGENT and BONDUPDATER at its core.
- 02Command-and-control traffic is hidden in DNS queries, with domains produced by a DGA.
- 03Initial access relies on documents impersonating reputable institutions and fake business relationships built on LinkedIn.
- 04Critical sectors in the Middle East, energy, finance and telecom above all, are the group's main targets.
Active since at least 2014, APT34 (OilRig, Helix Kitten, Hazel Sandstorm, COBALT GYPSY) collects intelligence in line with Iran's strategic interests. The group relies on social engineering such as documents impersonating reputable institutions and fake business relationships built on LinkedIn.
The report examines the POWRUNER script (hUpdateCheckers.ps1), the domain generation algorithm (DGA) and DNS-based BONDUPDATER communication at code level. Alongside domain, IP, MD5 and endpoint indicators, it includes YARA and Sigma rules that SOC teams can use directly.
Get the report
Get the full report as a PDF
55 pages, in Turkish. The report opens on this page and is also emailed to you as a PDF.
Other reports
Actor240524: an espionage campaign against Azerbaijani and Israeli diplomats
Actor240524, first seen in 2024, targets government bodies and diplomats in Azerbaijan and Israel. The report walks through the infection chain from …
Public sector
32 pages
APT29 / Cozy Bear: threat actor report
APT29, attributed to Russia's Foreign Intelligence Service (SVR): its operations from SolarWinds to the earthquake-themed campaign against Türkiye, its techniques against cloud …
Public sector
95 pages