Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 22:04:39 UTC
Home > List all groups > List all tools > List all groups using tool NineBlog
 Tool: NineBlog
Names NineBlog
Category Malware
Type Reconnaissance, Backdoor
Description
(FireEye) We noticed the decoded VBScript backdoors from recent activity were nearly
identical (with some small changes) to the first NINEBLOG variants we observed in 2013.
The minimal code changes may be due to the fact that the encoding provides enough
obfuscation to prevent detection, allowing the core functionality of the backdoor to remain the
same. Additionally, newer variants of the VBScript include some code enhancements.
Information
<https://www2.fireeye.com/rs/848-DID-242/images/rpt-southeast-asia-fall-2015.pdf>
<https://www.fireeye.com/blog/threat-research/2013/08/the-curious-case-of-encoded-vb-scripts-apt-nineblog.html>
Last change to this tool card: 01 May 2020
Download this tool card in JSON format
All groups using tool NineBlog
Changed Name Country Observed
APT groups
  NineBlog 2013  
1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=50eee0e3-8e91-4f31-b1c2-e7d939b1625c
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=50eee0e3-8e91-4f31-b1c2-e7d939b1625c
Page 1 of 1