CyberSIXT Search

hitcon.orgPDF

Sailing_the_Seven_SEAs_Deep_Dive_into_Polaris_Arsenal_and_Intelligence_Insights.pdf

Read the original on hitcon.org (new tab)

Excerpt

◆ they/them

◆ Occupation

◆ Threat Intelligence Researcher

@ TeamT5

◆ Interested in...

◆ Windows internals

◆ .NET

◆ Anything and everything!

AGENDA

whoami01

Arsenal Overview03 Malware Overview04

Introduction02

Changes05 Summary / Findings06

Introduction

◆Chinese-based APT group

active since 2011

◆Aliases

◆ Mustang Panda

◆ Twill Typhoon

◆ Earth Preta

◆Targets

◆ PH, MM, TH, TW, and other Asian

countries

◆ Countries related to EU

Arsenal Overview

◆ 2019- ~ now

◆ Heavy focus on PlugX and USB

spreadability

◆ PlugX Fast (THOR) / MiniPlug / PlugDisk

◆ UDiskShell

◆ 2022 ~ now

◆ NoFive

◆ TOnePipeShell / TOneDisk

◆…

The opening of the report, shown for reference. The full report, with its figures and indicators, is published by hitcon.org on hitcon.org.

Mentioned in the excerpt

MUSTANG PANDA TeamT5

On the same topics

Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRatMalwarebytes · Published 5 Jan 2021
Kazuar (Malware Family)Malpedia · Added 18 Oct
Chinese Nation-State Hackers Target U.S in Operation TradeSecret, Report Claimseweek.com · Published 6 Apr 2017
Taiwan High-Tech Ecosystem Targeted by Foreign APT Group:Medium · Published 10 Jun 2022