Archive of publicly available threat/cybercrime INTel reports (mostly APT Reports but not limited to). Useful as a reference when you emulate/simulate threat actors on a daily basis. Please create an issue if I'm missing a relevant Report.
Warning: If you are looking for every type of publicly available documents and notes related to APTs have a look at APTnotes and aptnotes. Unfortunately the way they store and sort their data doesn't work for me anymore.
Note: You can also find a page with an attempt to sort these reports by APT group name, based on the ThaiCert Threat Actor Encyclopedia and the Group pages of the MITRE ATT&CK team. This is work in progress and you can find it here: APT-Groups.
Depending on what you are looking for, you may also find this page useful.
| Title | Month | Source |
|---|---|---|
| The Evolution of the FIN7 JSSLoader | Jan | Morphisec |
| A wild Kobalos appears: Tricksy Linux malware goes after HPCs | Feb | ESET |
| Lazarus targets defense industrywith ThreatNeedle | Feb | Kaspersky |
| LazyScripter: From Empire to double RAT | Feb | MalwareBytes |
| Technical Analysis of Babuk Ransomware | Feb | McAfee |
| Title | Month | Source |
|---|---|---|
| W32.Stuxnet Dossier | Feb | Symantec |
| Global Energy Cyberattacks: Night Dragon | Feb | McAfee |
| Stuxnet Under the Microscope | Apr | ESET |
| Advanced Persistent Threats: A Decade in Review | Jun | Command Five Pty Ltd |
| The Lurid Downloader | Aug | Trend Micro |
| Revealed: Operation Shady Rat | Aug | McAfee |
| Enter the Cyber-dragon | Sep | Vanity Fair |
| SK Hack by an Advanced Persistent Threat | Sep | Command Five Pty Ltd |
| Alleged APT Intrusion Set: "1.php" Group | Oct | Zscaler |
| The Nitro Attacks: Stealing Secrets From The Chemical Industry | Oct | Symantec |
| Title | Month | Source |
|---|---|---|
| The Command Structure Of The Aurora Botnet | Jan | Damballa |
| Operation Aurora: Detect, Diagnose, Respond | Jan | HBGary |
| Operation Aurora | Feb | HBGary |
| Combating Aurora | Jan | McAfee |
| In-Depth Analysis Of Hydraq: The Face Of Cyberwar Enemies Unfolds | Mar | CA |
| Shadows In The Cloud: Investigating Cyber Espionage 2.0 | Apr | Shadowserver |
| The Msupdater Trojan And Ongoing Targeted Attacks | Sep | Zscaler |
| Title | Month | Source |
|---|---|---|
| Tracking GhostNet: Investigating a Cyber Espionage Network | Mar | TheSecDevGroup |
| DECLAWING THE DRAGON: WHY THE U.S. MUST COUNTER CHINESE CYBER-WARRIORS | Jun | NA |
| Capability of the People\92s Republic of China to Conduct Cyber Warfare and Computer Network Exploitation | Oct | Northrop Grumman |
| Russian Cyberwar on Georgia | Nov | georgiaupdate.gov.ge |