| Title | Year/Month | Source |
|---|---|---|
| Duqu 2.0: A Comparison To Duqu | 2015/Jun | CrySyS Lab |
| The Duqu 2.0 Technical Details | 2015/Jun | Kaspersky |
| Stuxnet 0.5: The Missing Link | 2013/Feb | Symantec |
| The Miniduke Mystery: Pdf 0-Day Government Spy Assembler 0X29A Micro Backdoor | 2013/Feb | Kaspersky |
| Miniduke: Indicators | 2013/Feb | CrySyS Lab |
| Skywiper (A.K.A. Flame A.K.A. Flamer): A Complex Malware For Targeted Attacks | 2012/Mar | CrySyS Lab |
| Have I Got Newsforyou: Analysis Of Flamer C&C Server | 2012/May | Symantec |
| W32.Stuxnet Dossier | 2011/Feb | Symantec |
| Stuxnet Under the Microscope | 2011/Apr | ESET |
Others:
- https://news.yahoo.com/revealed-how-a-secret-dutch-mole-aided-the-us-israeli-stuxnet-cyber-attack-on-iran-160026018.html
- https://www.virustotal.com/gui/file/38cdb4dbddf9c9b682d47dcbcd79f61fddf7f237fdfc3ee17bddbac061944e06/detection
- http://37.156.146.163/PUB/SANS/SANS%20508%20DVD/example-memory-images/
- https://news.ycombinator.com/item?id=2212922
- https://github.com/Laurelai/decompile-dump
- http://laurelai.info/index.php/hbgary-wanted-to-suppress-stuxnet-research/
- https://www.wired.com/2015/02/kapersky-discovers-equation-group/
- https://www.wired.com/2015/06/kaspersky-finds-new-nation-state-attack-network/
| Title | Year/Month | Source |
|---|---|---|
| The Untold Story of the 2018 Olympics Cyberattack, the Most Deceptive Attack in History (Sandworm) | 2019/Oct | Wired |
| Here's the Evidence That Links Russia's Most Brazen Cyberattacks (Sandworm) | 2019/Nov | Wired |
| The Untold Story of NotPetya, the Most Devastating Cyberattack in History (Sandworm) | 2018/Aug | Wired |
| How an Entire Nation Became Russia's Test Lab for Cyberwar (Sandworm) | 2017/Jun | Wired |
| CrashOverride: Analysis of the Threat to Electric Grid Operations | 2017/Jun | Dragos |
| WIN32/INDUSTROYER A new threat for industrial control systems | 2017/Jun | ESET |
| BLACKENERGY & QUEDAGH The convergence of crimeware and APT attacks | 2014/Oct | F-Secure |
Others:
- https://www.fireeye.com/blog/threat-research/2016/01/ukraine-and-sandworm-team.html
- https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-january-voodoo-bear/
- https://www.crowdstrike.com/blog/when-worlds-collide-the-impact-of-cyber-threats-crossing-over-to-the-physical-world/
- https://longform.org/posts/longform-podcast-372-andy-greenberg (mirrored)
- https://www.bloomberg.com/news/features/2019-12-03/merck-cyberattack-s-1-3-billion-question-was-it-an-act-of-war
- https://www.nybooks.com/articles/2019/12/19/drums-of-cyberwar/
- https://www.wired.com/story/sandworm-kremlin-most-dangerous-hackers/
- https://www.wired.com/story/sandworm-android-malware/
- https://darknetdiaries.com/episode/54/ (mirrored)
| Title | Year/Month | Source |
|---|---|---|
| Tildeb: Analyzing the 18-year-old Implant from the Shadow Brokers Leak | 2018/Dec | TrendMicro |
| Equation Group: Questions And Answers | 2015/Feb | Kaspersky |
Others:
- PRIVATE
| Title | Year/Month | Source |
|---|---|---|
| Equation Group: Questions And Answers | 2015/Feb | Kaspersky |
| Regin: Top-Tier Espionage Tool Enables Stealthy Surveillance | 2014/Nov | Symantec |
| W32/Regin, Stage #1 | 2014/Dec | F-Secure |
| W64/Regin, Stage #1 | 2014/Dec | F-Secure |
Others:
- https://theintercept.com/2014/11/24/secret-regin-malware-belgacom-nsa-gchq/
- https://www.symantec.com/connect/blogs/regin-top-tier-espionage-tool-enables-stealthy-surveillance
- https://www.spiegel.de/international/europe/nsa-spied-on-european-union-offices-a-908590.html
- https://www.wired.com/2015/02/kapersky-discovers-equation-group/
- https://web.archive.org/web/20170214165250/http://2014.hack.lu/archive/2014/hacklu-joker-presentation.pdf
- http://www.m3forum.net/m3forum/archive/index.php/t-498929.html
- https://medium.com/@botherder/everything-we-know-of-nsa-and-five-eyes-malware-e8eac172d3b5
- https://www.virustotal.com/gui/file/4d6cebe37861ace885aa00046e2769b500084cc79750d2bf8c1e290a1c42aaff/detection
- https://firstlook.org/wp-uploads/sites/1/regin.zip
Source: https://magazine.atavist.com/the-mastermind
Others:
- https://www.wired.com/story/was-bitcoin-created-by-this-international-drug-dealer-maybe/
- https://news.bitcoin.com/satoshi-nakamoto-paul-le-roux-start-bitcoin-mining-business/
- https://news.bitcoin.com/the-many-facts-pointing-to-paul-le-roux-being-satoshi-nakamoto/
- https://medium.com/@fbonomi/paul-le-roux-has-nothing-to-do-with-bitcoin-f534890430db
Others:
- https://www.fastcompany.com/90417865/new-botnet-nabbed-victims-by-sending-30000-sextortion-emails-per-hour
- https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Others:
- https://www.bankinfosecurity.com/russia-busts-nine-more-lurk-malware-suspects-a-9679
- https://www.zdnet.com/article/notorious-cyber-crime-gang-behind-global-bank-hacking-spree-returns-with-new-attacks/
- https://securityaffairs.co/wordpress/67262/cyber-crime/wannacry-lurk-group.html
- https://labs.sentinelone.com/reversing-rig-exploit-kit-infection-chain-internals-exploits/
- https://securelist.com/the-hunt-for-lurk/75944/
-
LORD OF THE FLIES: AN OPEN-SOURCE INVESTIGATION INTO SAUD AL-QAHTANI
-
https://www.nytimes.com/2018/11/14/world/middleeast/saudi-arabia-crown-prince-loyalists.html
-
https://archive.fo/20181030152706/https://www.spa.gov.sa/viewfullstory.php?lang=en&newsid=1756908
-
https://www.thedailybeast.com/how-the-saudis-made-jeff-bezos-public-enemy-1
-
https://www.vice.com/en_us/article/v74v34/saudi-arabia-hacked-jeff-bezos-phone-technical-report
| Title | Year/Month | Source |
|---|---|---|
| Hi-Tech Crime Trends 2019/2020 | 2019/Dec | Group IB |
| Kaspersky Security Bulletin: Advanced threat predictions for 2020 | 2019/Dec | Kaspersky |
| ESET Cybersecurity Trends 2020 | 2019/Dec | ESET |
| The Invisible Digital Threat: Mobile AD Fraud 2019 Report | 2019 | SecureD |
| CrowdStrike Global Threat Report | 2020 | CrowdStrike |
| Legal Considerations when Gathering Online Cyber Threat Intelligence and Purchasing Data from Illicit Sources | 2020 | CCIPS |
| The 2020 State of Crypto Crime: Everything you need to know about darknet markets, exchange hacks, money laundering and more | 2020 | ChainAnalysis |
- I Was a Cybercrook for the FBI
- https://blog.google/technology/safety-security/update-state-sponsored-activity/
- https://blog.google/technology/safety-security/threat-analysis-group/protecting-users-government-backed-hacking-and-disinformation/
- https://www.zdnet.com/google-amp/article/google-details-its-fight-against-the-bread-joker-malware-operation/