APT_REPORT - Interesting APT Report Collection And Some Special

项目说明

APT_REPORT collected by

Interesting apt report & sample & malware & technology & intellegence collection

APT Group for country

Threat Actor Groups Tracked by Palo Alto Networks Unit 42

Sample

Group123

▶ScarCruft continues to e har

(May 13, 2019)

▶Group123 Attempts to attack 'printing paper' APT disguised as a guide to organization and conferences

(May 2 , 2019)

▶Group123, APT attack impersonating Unification Ministry, spread malicious 代码 to Google Drive

(April 22 , 2019)

▶ group123 APT organization, 'Operation High Expert'

(April 2 , 2019)

▶ Rocketman APT Campaign Returned to Operation Holiday Wiper

(Jan 23, 2019)

▶ 'Operation Blackbird', the mobile in of the '

(Dec 13, 2018)

▶ group123 'Operation Korean Sword' is underway

(Nov. 16, 2018)

▶ group123 Group's latest APT campaign - 'Operation Rocket Man'

(Aug. 22, 2018)

▶ group123, Flash Player Zero-Day (C) Attack Attention

(Feb 02, 2018)

▶ 'group123' group 'survey on the total number of discovery of separated families in North and South'

(July 28, 2014)

▶ Rocketman APT campaign, 'Operation Golden Bird'

(March 20, 2013)

▶ Korea In The Crosshairs

(Jan 16, 2018)

▶FreeMilk: A Highly Targeted Spear Phishing Campaign

(Oct 5, 2017)

baby related kimsuky

▶BabyShark Malware Part Two – Attacks Continue Using KimJongRAT and PCRat (April 26, 2019)

▶Operation Giant Baby, a giant threat (March 28, 2019)

▶ Malicious 代码 installed with coin purse program(Alibaba) (March 15, 2019)

▶ New BabyShark Malware Targets U.S. National Security Think Tanks (Feb. 22, 2019)

▶ Korea's latest APT attack, Operation Mystery Baby Attention! (Feb 11, 2018)

▶ Returned to Korea as Operation Baby Coin, APT attacker, o target in 2010 (Apr. 19, 2014)

kimsuky

▶Kimsuky, Blue House Green Support / Sangchunjae Estimate

▶Kimsuky, cyber security bureau Cryptographic Cases (May 28 , 2019)

▶Kimsuky, Korea Cryptographic Exchange Event Impersonation APT Attack (May 28 , 2019)

▶Kimsuky 'Fake striker' APT campaign aimed at Korea (May 20 , 2019)

▶ Analysis of "Smoke Screen" in APT campaign aimed at Korea and America (April 17 , 2019)

▶ Encrypted APT attack, Kimsuky organization's 'smoke screen' PART 2 (May 13 , 2019)

▶ Kimsuky Organization, Operation Stealth Power Silence Operation (April 3 , 2019)

▶ Kimsuky Organization, Watering Hole Started "Operation Low Kick"(March 21, 2019)

Jaku

▶ Sili: Inside North Korea’s Anti-Virus (May 1, 2018)

Lazarus

▶Lazarus Group Goes 'Fileless'，an implant w/ remote download & in-memory execution

▶LAZARUS APT TARGETS MAC USERS WITH POISONED WORD DOCUMENT

Konni

▶Konni's APT Group conducts attacks with Russian-North Korean trade and economic in documents

▶APT Campaign 'Konni' & 'Kimsuky' find commonality in organizations (June 10, 2019)

▶Korean Kusa Konni Organization, Blue Sky Utilizing 'Amadey' Russia Botnet (May 16, 2019)

▶The Konni APT Campaign and 'Operation Hunter Adonis' (Jan 1 ,2019)

Oceanlotus

▶Threat Spotlight: Ratsnif - New 网络 from OceanLotus (July 1, 2019)

▶Analysis report on the attack on mobile devices by Oceanlotus (May 24, 2019)

▶ Oceanlotus in the first quarter of 2019 for the attack technology of China.(April 24, 2019)

▶ Deobfuscating APT32 Flow Graphs with Cutter and Radare2 (April 24, 2019)

▶ OceanLotus Steganography Malware Analysis White Paper (April 2 , 2019)

▶OceanLotus: macOS malware update(April 9 , 2019)

APT28

▶ CB TAU Threat Intelligence Notification: Hunting APT28 Downloaders (April 5 , 2019)

Turla

▶ A dive into Turla PowerShell usage (May 29 , 2019)

tick

▶ tick group new campaign, attack north korean and japan

(April 1 , 2019)

Winnti

▶ bayer-says-has-detected-contained-cyber-attack (April 5 , 2019)

Middle East Asia

Muddywater

▶ Recent MuddyWater-associated BlackWater campaign shows signs of new anti-detection techniques(May 20,2019)

ZooPark

▶ APT-C-38 attack activity re (May 27,2019)

APT Group for finance

CARBANAK

▶ CARBANAK Week Part One: A Rare Occurrence (April 22, 2019)

londonblue (Nigeria)

▶ E Tactics: London Blue Starts Spoofing Target Domains (April 4 , 2019)
PDF is in the folder

Fin6

▶ Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware(April 5 , 2019)

Fin7

▶ On the Hunt for FIN7: Pursuing an Enigmatic and E Global Criminal Operation (August 01, 2018)

项目信息

开发语言：Python

Star 数：3096

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Interesting APT Report Collection And Some Special IOCs展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。