Winnti – Computer Security Articles

Winnti APT group docks in Sri Lanka for new campaign

October 17, 2022 admin APT, c2, China, dboxagent, dropbox, India, keyplug, malware, sri lanka, Threat Intelligence, Winnti

Categories: Threat Intelligence

Tags: Winnti

Tags: APT

Tags: China

Tags: Sri Lanka

Tags: India

Tags: Keyplug

Tags: malware

Tags: dropbox

Tags: C2

Tags: DBoxAgent

In this research paper, we document a new campaign we attribute to the Winnti APT group. The victims are located in Sri Lanka at a point in time where the country is going through economic hardship while China makes headlines for docking on of its special vessels there.

Microsoft Security

Detecting threat actors in recent German industrial attacks with Windows Defender ATP

January 25, 2017 admin Advanced persistent threats, advanced threat protection, BARIUM, LEAD, Uncategorized, Windows 10 Creators Update, Windows Defender ATP, Winnti

When a Germany-based industrial conglomerate disclosed in December 2016 that it was breached early that year, the breach was revealed to be a professionally run industrial espionage attack. According to the German press, the intruders used the Winnti family of malware as their main implant, giving them persistent access to the conglomerate’s network as early…