Arkbird SOLG (DailyIOC)

Repository

https://github.com/StrangerealIntel/DailyIOC

Commit

a873ff1298c43705e9c67286f3014f4300dd04f7

Retrieved

2026-09-27

Licence

No licence (all rights reserved)

Published

Metadata

Why

No LICENSE file in the repository and no licence statement in its README (checked 2026-09-29). Without a grant, the rules are all rights reserved: metadata and an upstream link only.

Rules from Arkbird SOLG (DailyIOC)

• ARKBIRD_SOLG_APT_APT28_Downdelph_Feb_2021_1Metadata only

  Detect Downdelph used by APT28 group

  APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-02-18
• ARKBIRD_SOLG_APT_APT29_Polyglotduke_Mar_2021_1Metadata only

  Detect PolyglotDuke implant used by APT29 group

  APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-03-08
• ARKBIRD_SOLG_APT_APT34_Dustman_Apr_2021_1Metadata only

  Detect the Installer of Dustman wiper used by APT34

  APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-04-28
• ARKBIRD_SOLG_APT_Gelsemium_Gelsemine_June_2021_1Metadata only

  Detect Gelsemine malware (Dropper - Variant 1)

  APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-06-12
• ARKBIRD_SOLG_APT_Gelsemium_Gelsevirine_June_2021_1Metadata only

  Detect Gelsevirine malware (Main Plug-in)

  APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-06-12
• ARKBIRD_SOLG_APT_Puzzlemaker_Implant_Jun_2021_1Metadata only

  Detect the implant of the PuzzleMaker group

  APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-06-10
• ARKBIRD_SOLG_APT_Puzzlemaker_Launcher_Jun_2021_1Metadata only

  Detect the launcher of the PuzzleMaker group

  APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-06-10
• ARKBIRD_SOLG_APT_Tardigrade_Nov_2021_1Metadata only

  Detect Tardigrade loader

  APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-11-22
• ARKBIRD_SOLG_MAL_Bazarloader_Oct_2021_1Metadata only

  Detect BazarLoader implant

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-10-30
• ARKBIRD_SOLG_MAL_Beacon_Vermilion_Strike_Sep_2021_1Metadata only

  Detect the windows version of the beacon of Vermilion Strike implant

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-09-14
• ARKBIRD_SOLG_MAL_Cadelspy_Stealer_May_2021_1Metadata only

  Detect Cadelspy stealer

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-05-30
• ARKBIRD_SOLG_MAL_Cobaltstrike_Oct_2021_1Metadata only

  Detect Cobalt Strike implant

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-10-30
• ARKBIRD_SOLG_MAL_Emotet_Nov_2021_1Metadata only

  Detect Emotet loader

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-11-15
• ARKBIRD_SOLG_MAL_Jssloader_Jun_2021_1Metadata only

  Detect JSSLoader malware

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-06-04
• ARKBIRD_SOLG_MAL_Loader_Lockfile_Aug_2021_1Metadata only

  Detect loader used by lockerfile group

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-08-28
• ARKBIRD_SOLG_MAL_Luna_Stealer_Apr_2021_1Metadata only

  Detect Luna stealer (also Mercurial Grabber)

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-08-29
• ARKBIRD_SOLG_MAL_Mailo_Jun_2021_1Metadata only

  Detect the Mach-O malware

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-06-09
• ARKBIRD_SOLG_MAL_Milum_Jul_2021_1Metadata only

  Detect Milum malware

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-07-08
• ARKBIRD_SOLG_MAL_Nglite_Nov_2021_1Metadata only

  Detect NGLite backdoor (version A)

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-11-09
• ARKBIRD_SOLG_MAL_Nglite_Nov_2021_2Metadata only

  Detect NGLite backdoor (version B)

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-11-08
• ARKBIRD_SOLG_MAL_Phoenix_Stealer_Jun_2021_1Metadata only

  Detect the Phoenix Stealer

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-11-01
• ARKBIRD_SOLG_Mal_Plugx_Thor_July_2021_1Metadata only

  Detect Thor variant of PlugX (Variant 1)

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-07-27
• ARKBIRD_SOLG_MAL_Powerpool_Jul_2021_2Metadata only

  Detect PowerPool malware (ALPC exploit variant)

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-07-09
• ARKBIRD_SOLG_MAL_Pseudomanuscrypt_Dec_2021_1Metadata only

  Detect PseudoManuscrypt loader dropped by the installer

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-12-16
• ARKBIRD_SOLG_MAL_Skinnyboy_Implant_Jun_2021_1Metadata only

  Detect SkinnyBoy Implant

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-06-05
• ARKBIRD_SOLG_MAL_Windealer_Oct_2021_2Metadata only

  Detect modules from WinDealer implant

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-10-30
• ARKBIRD_SOLG_RAN_Conti_Dec_2021_1Metadata only

  Detect Conti ransomware (v3)

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-12-16
• ARKBIRD_SOLG_RAN_Conti_May_2021_2Metadata only

  Detect unpacked Conti ransomware (May 2021)

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-05-20
• ARKBIRD_SOLG_RAN_ELF_Darkside_Apr_2021_1Metadata only

  Detect the ELF version of Darkside ransomware

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-05-01
• ARKBIRD_SOLG_RAN_ELF_Hellokitty_Aug_2021_1Metadata only

  Detect HelloKitty ransomware

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-08-14
• ARKBIRD_SOLG_RAN_ELF_Revil_Jun_2021_1Metadata only

  Detect the ELF version of REvil ransomware

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-06-28
• ARKBIRD_SOLG_RAN_Nemty_June_2021_1Metadata only

  Detect Nemty ransomware

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-06-12
• ARKBIRD_SOLG_RAN_Piton_Nov_2021_1Metadata only

  Detect Piton variant (rebuild from the Babuk leaks)

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-11-03
• ARKBIRD_SOLG_RAN_PYSA_Sept_2021_1Metadata only

  Detect the PYSA ransomware

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-09-23
• ARKBIRD_SOLG_RAN_Yanluowang_Dec_2021_1Metadata only

  Detect Yanluowang ransomware

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-12-17
• ARKBIRD_SOLG_APT_MAL_Donot_Loader_June_2020_1Metadata only

  Detect loader malware used by APT Donot for drops the final stage

  APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-06-22
• ARKBIRD_SOLG_APT_Sidewinder_Nov_2020_1Metadata only

  Detect Sidewinder DLL decoder algorithm

  APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-11-14
• ARKBIRD_SOLG_ATM_Dispcashbr_May_2021_1Metadata only

  Detect the DispCashBR ATM malware

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-05-14
• ARKBIRD_SOLG_Loa_JS_Gootkit_Nov_2020_1Metadata only

  Detect JS loader used on the Gootkit killchain (November 2020)

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-11-21
• ARKBIRD_SOLG_Loader_JAVA_Kinsing_Aug_2020_Variant_B_1Metadata only

  Detect Kinsing Variant B

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-08-28
• ARKBIRD_SOLG_MAL_Moriya_May_2021_1Metadata only

  Detect Moriya rootkit used in the TunnelSnake operation

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-05-07
• ARKBIRD_SOLG_MAL_Moriya_May_2021_2Metadata only

  Detect Moriya rootkit used in the TunnelSnake operation

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-05-26
• ARKBIRD_SOLG_Ran_Buran_Oct_2020_1Metadata only

  Detect Buran ransomware

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-11-05
• ARKBIRD_SOLG_Ran_Egregor_Oct_2020_1Metadata only

  Detect Egregor / Maze ransomware by Maze blocks

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-10-29
• ARKBIRD_SOLG_Ran_Egregor_Sept_2020_1Metadata only

  Detect Egregor ransomware (variant Sept2020)

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-10-07
• ARKBIRD_SOLG_RAN_Fuxsocy_May_2021_1Metadata only

  Detect FuxSocy ransomware

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-05-09
• ARKBIRD_SOLG_RAN_Mountlocker_May_2021_1Metadata only

  Detect the Mountlocker ransomware

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-05-12
• ARKBIRD_SOLG_APT_Sidewinder_NET_Loader_Aug_2020_1Metadata only

  Detected the NET loader used by SideWinder group (August 2020)

  APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-08-24
• ARKBIRD_SOLG_APT_APT_34_Maildrop_Mar_2021_1Metadata only

  Detect MailDrop malware used by APT34

  APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-04-03
• ARKBIRD_SOLG_APT_Gelsemium_Gelsenicine_June_2021_1Metadata only

  Detect Gelsenicine malware (Loader - Variant 1)

  APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-06-12
• ARKBIRD_SOLG_APT_Gelsemium_Gelsenicine_June_2021_2Metadata only

  Detect Gelsenicine malware (Loader - Variant 2)

  APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-06-12
• ARKBIRD_SOLG_APT_Lazarus_Jun_2021_1Metadata only

  Detect a variant of NukeSped malware

  APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-06-19
• ARKBIRD_SOLG_APT_Turla_Comrat_Chinch_V4_Jan_2021_1Metadata only

  Detect ComRAT V4 (Chinch) used by APT Turla group

  APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-01-23
• ARKBIRD_SOLG_EXP_CVE_2021_1647_Apr_2021_1Metadata only

  Detect CVE-2021-1647 tool

  ExploitArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-05-04
• ARKBIRD_SOLG_EXP_CVE_2021_41379_Nov_2021_1Metadata only

  Detect exploit tool using CVE-2021-41379

  ExploitArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-11-26
• ARKBIRD_SOLG_EXP_CVE_2021_41379_Nov_2021_2Metadata only

  Detect exploit tool using CVE-2021-41379 (variant 2)

  ExploitArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-11-26
• ARKBIRD_SOLG_EXP_CVE_2021_41379_Nov_2021_3Metadata only

  Detect exploit tool using CVE-2021-41379 (variant 3)

  ExploitArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-11-26
• ARKBIRD_SOLG_MAL_Boombox_May_2021_1Metadata only

  Detect BoomBox malware

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-05-28
• ARKBIRD_SOLG_MAL_ELF_Bioset_Jul_2021_1Metadata only

  Detect the Bioset malware

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-07-02
• ARKBIRD_SOLG_MAL_ELF_Specter_Jul_2021_1Metadata only

  Detect the Specter malware

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-07-02
• ARKBIRD_SOLG_MAL_Killproc_Aug_2021_1Metadata only

  Detect KillProc driver used by Night Dragon for kill process before encryption

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-08-27
• ARKBIRD_SOLG_MAL_Klingon_Jun_2021_1Metadata only

  Detect the Klingon RAT

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-06-19
• ARKBIRD_SOLG_MAL_Milan_Aug_2021_1Metadata only

  Detect Milian backdoor used by Hexane group (aka Siamesekitten)

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-08-18
• ARKBIRD_SOLG_MAL_Nativezone_May_2021_1Metadata only

  Detect NativeZone malware

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-05-28
• ARKBIRD_SOLG_MAL_OSX_Wizardupdate_Oct_2021_1Metadata only

  Detect WizardUpdate installer on OSX system

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-10-22
• ARKBIRD_SOLG_MAL_Polazert_Apr_2021_1Metadata only

  Detect Polazert stealer

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-04-11
• ARKBIRD_SOLG_MAL_Queenofclubs_Jul_2021_1Metadata only

  Detect QueenOfClubs malware

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-07-09
• ARKBIRD_SOLG_MAL_Queenofhearts_Jul_2021_1Metadata only

  Detect QueenOfHearts malware

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-07-09
• ARKBIRD_SOLG_MAL_Redxor_Feb_2021_1Metadata only

  Detect RedXor backdoor (Feb 2021)

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-03-14
• ARKBIRD_SOLG_MAL_Shark_Aug_2021_1Metadata only

  Detect Shark backdoor used by Hexane group (aka Siamesekitten)

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-08-18
• ARKBIRD_SOLG_MAL_Sidoh_Stealer_Aug_2021_1Metadata only

  Detect Sidoh Stealer used by RYUK group

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-08-31
• ARKBIRD_SOLG_Mal_Xcaon_Jul_2021_1Metadata only

  Detect the xCaon malware

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-07-01
• ARKBIRD_SOLG_MAL_Zstealer_Nov_2021_1Metadata only

  Detect ZStealer stealer used by Void Balaur group

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-11-11
• ARKBIRD_SOLG_RAN_ALPHV_Dec_2021_1Metadata only

  Detect AlphV ransomware (Nov and Dec 2021)

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-12-09
• ARKBIRD_SOLG_RAN_Haron_Aug_2021_1Metadata only

  Detect Haron locker

  GenericArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-08-09
• ARKBIRD_SOLG_RAN_Nitro_Aug_2021_1Metadata only

  Detect Nitro ransomware

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-08-12
• ARKBIRD_SOLG_Tool_Efspotatoe_Aug_2021_1Metadata only

  Detect custom .NET variant EFSPotatoe tool

  Hack toolArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-08-27
• ARKBIRD_SOLG_Tool_Efspotatoe_Aug_2021_2Metadata only

  Detect EFSPotatoe tool (Generic rule)

  Hack toolArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-08-27
• ARKBIRD_SOLG_APT_Chimera_Sept_2020_1Metadata only

  Detect Cobalt Strike agent used by Chimera

  APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-10-03
• ARKBIRD_SOLG_APT_Evilnum_LNK_Jul_2021_1Metadata only

  Detect LNK file used by EvilNum group

  APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-07-13
• ARKBIRD_SOLG_APT_MAL_NK_Lazarus_Nukesped_June_2020_1Metadata only

  Detect NukeSped malware used by APT Lazarus

  APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-06-11
• ARKBIRD_SOLG_APT_NK_Lazarus_Stealer_Generic_June_2020_1Metadata only

  Detect stealers used by Lazarus APT by common strings

  APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG, James_inthe_box· 2020-06-23
• ARKBIRD_SOLG_APT_NK_Lazarus_Stealer_Keylog_June_2020_1Metadata only

  Detect keylog malware used by Lazarus APT

  APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG, James_inthe_box· 2020-06-23
• ARKBIRD_SOLG_MAL_ELF_Rotajakiro_May_2021_1Metadata only

  Detect the ELF version of RotaJakiro

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-05-07
• ARKBIRD_SOLG_MAL_Netfilter_Dropper_Jun_2021_1Metadata only

  Detect the dropper of Netfilter rootkit

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-06-18
• ARKBIRD_SOLG_RAN_Matrix_Sep_2020_1Metadata only

  Detect MATRIX ransomware

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-10-15
• ARKBIRD_SOLG_MAL_Envyscout_May_2021_1Metadata only

  Detect EnvyScout downloader

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-05-28
• ARKBIRD_SOLG_Tool_Screencapture_Jul_2021_1Metadata only

  Detect Screen Capture utility

  Hack toolArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-07-09
• ARKBIRD_SOLG_APT_NK_Lazarus_Implant_June_2020_1Metadata only

  Detect Lazarus implant June 2020

  APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-06-28
• ARKBIRD_SOLG_Backdoor_APT_Nazar_April_2020_1Metadata only

  Detect strings used by APT Nazar

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-04-29
• ARKBIRD_SOLG_MAL_Kpot_Oct_2020_1Metadata only

  Detect KPot stealer (new variant October 2020)

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-10-17
• ARKBIRD_SOLG_Malware_Casbaneiro_MSIMetadata only

  Detect MSIPackage used by Casbaneiro

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-06-05
• ARKBIRD_SOLG_Ran_Onyxlocker_Nov_2020_1Metadata only

  Detect OnyxLocker ransomware

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-11-18
• ARKBIRD_SOLG_MAL_Skinnyboy_Launcher_Jun_2021_1Metadata only

  Detect the Launcher of SkinnyBoy

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-06-05
• ARKBIRD_SOLG_RAN_Avoslocker_July_2021_1Metadata only

  Detect AvosLocker ransomware

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-07-23
• ARKBIRD_SOLG_RAN_Decaf_Nov_2021_1Metadata only

  Detect Decaf ransomware (unpacked UPX)

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-11-01
• ARKBIRD_SOLG_APT_Donot_Downloader_May_2021_1Metadata only

  Detect the trojan downloader used by Donot group

  APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-05-09
• ARKBIRD_SOLG_APT_Kimsuky_Aug_2020_1Metadata only

  Detect Gold Dragon used by Kimsuky APT group

  APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-08-31
• ARKBIRD_SOLG_Mal_Stealer_NET_Redline_Aug_2020_1Metadata only

  Detect Redline Stealer (August 2020)

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-08-24
• ARKBIRD_SOLG_Ran_Mount_Locker_Nov_2020_1Metadata only

  Detect Mount Locker ransomware (November 2020 variant)

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-11-20
• ARKBIRD_SOLG_Ran_Pay2Key_Nov_2020_1Metadata only

  Detect Pay2Key ransomware

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-12-01
• ARKBIRD_SOLG_Ran_Ranzy_Locker_Nov_2020_1Metadata only

  Detect Ranzy Locker (RAAS)

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-11-19
• ARKBIRD_SOLG_Ran_Regretlocker_Oct_2020_1Metadata only

  Detect RegretLocker ransomware

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-11-04
• ARKBIRD_SOLG_MAL_Powerpool_Jul_2021_1Metadata only

  Detect PowerPool malware

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-07-09
• ARKBIRD_SOLG_MAL_Skinnyboy_Dropper_Jun_2021_1Metadata only

  Detect SkinnyBoy Dropper

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-05-01
• ARKBIRD_SOLG_MAL_Slothfulmedia_Jul_2021_1Metadata only

  Detect SlothfulMedia malware

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-07-09
• ARKBIRD_SOLG_RAN_ELF_Qnapcrypt_Aug_2021_2Metadata only

  Detect QNAPCrypt ransomware (x64 version)

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-08-11
• ARKBIRD_SOLG_RAN_Medusalocker_Aug_2021_1Metadata only

  Detect MedusaLocker ransomware

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-08-08
• ARKBIRD_SOLG_RAN_Medusalocker_July_2021_1Metadata only

  Detect MedusaLocker ransomware

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-07-25
• ARKBIRD_SOLG_MAL_Windealer_Oct_2021_1Metadata only

  Detect WinDealer implant

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-10-30
• ARKBIRD_SOLG_RAN_ELF_Qnapcrypt_Aug_2021_1Metadata only

  Detect QNAPCrypt ransomware (x86 version)

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-08-11
• ARKBIRD_SOLG_WIP_Meteorexpress_Aug_2021_1Metadata only

  Detect MeteorExpress/BreakWin wiper

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-08-06
• ARKBIRD_SOLG_RAN_Crylock_Oct_2020_1Metadata only

  Detect CryLock ransomware V2.0.0

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-10-14
• ARKBIRD_SOLG_APT_APT34_RDAT_July_2021_1Metadata only

  Detect RDAT used by APT34

  APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-07-15
• ARKBIRD_SOLG_APT_Molerats_Feb_2021_1Metadata only

  Detect Molerats implants

  APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-02-27
• ARKBIRD_SOLG_APT_Unknown_Middle_East_Feb_2020_1Metadata only

  Dectect unknown Middle East implants (retrohunt June 2020)

  APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-03-05
• ARKBIRD_SOLG_APT_NK_Lazarus_Stealer_Screencapture_June_2020_1Metadata only

  Detect ScreenCapture malware used by Lazarus APT

  APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG, James_inthe_box· 2020-06-23
• ARKBIRD_SOLG_Ran_Ruyk_Oct_2020_1Metadata only

  Detect RYUK ransomware (Sept_2020_V1)

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-10-25
• ARKBIRD_SOLG_SP_Vault7_SIG_F_Nov_2020_1Metadata only

  Detect open-source PasswordReminder recovery tools used by Chinese APT in the Past

  APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-11-30
• ARKBIRD_SOLG_APT_UNC2452_Webshell_Chopper_Mar_2021_1Metadata only

  Detect exploit listener in the exchange configuration for Webshell Chopper used by UNC2452 group

  APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-03-07
• ARKBIRD_SOLG_MAL_ELF_Rekoobe_Nov_2021_1Metadata only

  Detect the Rekoobe rootkit

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-11-10
• ARKBIRD_SOLG_MAL_Jackofhearts_Jul_2021_1Metadata only

  Detect JackOfHearts malware

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-07-09
• ARKBIRD_SOLG_MAL_Netfilter_May_2021_1Metadata only

  Detect Netfilter rootkit

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-06-18
• ARKBIRD_SOLG_MAL_Unknown_PE_Jul_2021_1Metadata only

  Detect unknown TA that focus russian people

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-07-14
• ARKBIRD_SOLG_APT_Turla_Bigboss_Apr_2021_1Metadata only

  Detects new BigBoss implants (SilentMoon/GoldenSky)

  APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-04-06
• ARKBIRD_SOLG_MAL_Keylogger_Jul_2021_1Metadata only

  Detect a keylogger used by IAmTheKing group

  MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-07-09