{
	"id": "9aa2d4c2-2d23-4d4f-a1d4-6d9b94629084",
	"created_at": "2026-04-06T03:36:26.439339Z",
	"updated_at": "2026-04-10T03:35:47.078513Z",
	"deleted_at": null,
	"sha1_hash": "ed23f33adf8d0338fa7d95ac9444d616eaf303ab",
	"title": "CREAMSICLE (Malware Family)",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 36816,
	"plain_text": "CREAMSICLE (Malware Family)\r\nBy Fraunhofer FKIE\r\nArchived: 2026-04-06 02:52:33 UTC\r\nwin.creamsicle (Back to overview)\r\nCREAMSICLE\r\nActor(s): APT 30\r\nThere is no description at this point.\r\nReferences\r\n2015-04-01 ⋅ FireEye ⋅ FireEye\r\nAPT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION\r\nBACKBEND backspace CREAMSICLE FLASHFLOOD GEMCUTTER MILKMAID Naikon NETEAGLE\r\nORANGEADE SHIPSHAPE SPACESHIP SslMM Sys10 WinMM xsPlus APT30\r\nThere is no Yara-Signature yet.\r\nSource: https://malpedia.caad.fkie.fraunhofer.de/details/win.creamsicle\r\nhttps://malpedia.caad.fkie.fraunhofer.de/details/win.creamsicle\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://malpedia.caad.fkie.fraunhofer.de/details/win.creamsicle"
	],
	"report_names": [
		"win.creamsicle"
	],
	"threat_actors": [
		{
			"id": "360f51f5-8a80-41d6-92c4-9aa042cd2732",
			"created_at": "2022-10-25T16:07:23.34569Z",
			"updated_at": "2026-04-10T02:00:04.55147Z",
			"deleted_at": null,
			"main_name": "APT 30",
			"aliases": [
				"APT 30",
				"Bronze Geneva",
				"Bronze Sterling",
				"CTG-5326",
				"G0013",
				"Override Panda",
				"RADIUM",
				"Raspberry Typhoon"
			],
			"source_name": "ETDA:APT 30",
			"tools": [
				"BackBend",
				"Creamsicle",
				"Flashflood",
				"Gemcutter",
				"Lecna",
				"NetEagle",
				"Neteagle_Scout",
				"Orangeade",
				"ScoutEagle",
				"Shipshape",
				"ZRLnk",
				"norton"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "a9ee8219-1882-4b1b-bac8-641b1603787d",
			"created_at": "2022-10-25T15:50:23.78263Z",
			"updated_at": "2026-04-10T02:00:05.351155Z",
			"deleted_at": null,
			"main_name": "APT30",
			"aliases": [
				"APT30"
			],
			"source_name": "MITRE:APT30",
			"tools": [
				"SHIPSHAPE",
				"FLASHFLOOD",
				"NETEAGLE"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "30ed778d-15b3-484e-a90b-e1e05b36a42f",
			"created_at": "2023-01-06T13:46:38.290626Z",
			"updated_at": "2026-04-10T02:00:02.91411Z",
			"deleted_at": null,
			"main_name": "APT30",
			"aliases": [
				"G0013"
			],
			"source_name": "MISPGALAXY:APT30",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "b69484be-98d1-49e6-aed1-a28dbf65176a",
			"created_at": "2022-10-25T16:07:23.886782Z",
			"updated_at": "2026-04-10T02:00:04.779029Z",
			"deleted_at": null,
			"main_name": "Naikon",
			"aliases": [
				"G0019",
				"Hellsing",
				"ITG06",
				"Lotus Panda",
				"Naikon",
				"Operation CameraShy"
			],
			"source_name": "ETDA:Naikon",
			"tools": [
				"8.t Dropper",
				"8.t RTF exploit builder",
				"8t_dropper",
				"AR",
				"ARL",
				"Agent.dhwf",
				"Aria-body",
				"Aria-body loader",
				"Asset Reconnaissance Lighthouse",
				"BackBend",
				"Creamsicle",
				"Custom HDoor",
				"Destroy RAT",
				"DestroyRAT",
				"Flashflood",
				"FoundCore",
				"Gemcutter",
				"HDoor",
				"JadeRAT",
				"Kaba",
				"Korplug",
				"LOLBAS",
				"LOLBins",
				"LadonGo",
				"Lecna",
				"Living off the Land",
				"NBTscan",
				"Naikon",
				"NetEagle",
				"Neteagle_Scout",
				"NewCore RAT",
				"Orangeade",
				"PlugX",
				"Quarks PwDump",
				"RARSTONE",
				"RainyDay",
				"RedDelta",
				"RoyalRoad",
				"Sacto",
				"Sandboxie",
				"ScoutEagle",
				"Shipshape",
				"Sisfader",
				"Sisfader RAT",
				"Sogu",
				"SslMM",
				"Sys10",
				"TIGERPLUG",
				"TVT",
				"TeamViewer",
				"Thoper",
				"WinMM",
				"Xamtrav",
				"XsFunction",
				"ZRLnk",
				"nbtscan",
				"nokian",
				"norton",
				"xsControl",
				"xsPlus"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "a2912fc0-c34e-4e4b-82e9-665416c8fe32",
			"created_at": "2023-04-20T02:01:50.979595Z",
			"updated_at": "2026-04-10T02:00:02.913011Z",
			"deleted_at": null,
			"main_name": "Naikon",
			"aliases": [
				"BRONZE STERLING",
				"G0013",
				"PLA Unit 78020",
				"OVERRIDE PANDA",
				"Camerashy",
				"BRONZE GENEVA",
				"G0019",
				"Naikon"
			],
			"source_name": "MISPGALAXY:Naikon",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "9f1ce7e3-77cd-4af0-bedb-1643f55c9baf",
			"created_at": "2022-10-25T15:50:23.31611Z",
			"updated_at": "2026-04-10T02:00:05.370146Z",
			"deleted_at": null,
			"main_name": "Naikon",
			"aliases": [
				"Naikon"
			],
			"source_name": "MITRE:Naikon",
			"tools": [
				"ftp",
				"netsh",
				"WinMM",
				"Systeminfo",
				"RainyDay",
				"RARSTONE",
				"HDoor",
				"Sys10",
				"SslMM",
				"PsExec",
				"Tasklist",
				"Aria-body"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "578e92ed-3eda-45ef-b4bb-b882ec3dbb62",
			"created_at": "2025-08-07T02:03:24.604463Z",
			"updated_at": "2026-04-10T02:00:03.798481Z",
			"deleted_at": null,
			"main_name": "BRONZE GENEVA",
			"aliases": [
				"APT30 ",
				"BRONZE STERLING ",
				"CTG-5326 ",
				"Naikon ",
				"Override Panda ",
				"RADIUM ",
				"Raspberry Typhoon"
			],
			"source_name": "Secureworks:BRONZE GENEVA",
			"tools": [
				"Lecna Downloader",
				"Nebulae",
				"ShadowPad"
			],
			"source_id": "Secureworks",
			"reports": null
		}
	],
	"ts_created_at": 1775446586,
	"ts_updated_at": 1775792147,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/ed23f33adf8d0338fa7d95ac9444d616eaf303ab.pdf",
		"text": "https://archive.orkl.eu/ed23f33adf8d0338fa7d95ac9444d616eaf303ab.txt",
		"img": "https://archive.orkl.eu/ed23f33adf8d0338fa7d95ac9444d616eaf303ab.jpg"
	}
}