Technical Twitter of QiAnXin Technology, leading Chinese security vendor. It is operated by RedDrip Team which focuses on malware, APT and threat intelligence.
Joined April 2018
- Tweets489
- Following29
- Followers16.7K
- Likes6
Pinned Tweet
#APT_Digital_Weapon
We have categorized #IOCs, mostly #APT related, from public resources and sample details are available on #VT. The #GitHub project will keep updated and hope to help the security community fight against malware and targeted attack.
github.com/RedDrip7/APT_Digi…
QiAnXin 2026 Mid-Year Cybersecurity Threat Report is released. APT groups double down on supply chains & edge devices, ransomware goes encryption-less, and AI agents emerge as a new attack surface. 199 reports, 84 actors, 37 in-the-wild vulns analyzed. 👇
ti.qianxin.com/uploads/2026/…
🚨 Free AI threat analyst from QiAnXin. Built on 10yr data + QGPT. Chat-to-judge, covers all IOCs, APT, logs. automated workflows, 32+ scenarios. Saves 70% time. Try now: expert.qianxin.com
#Cybersecurity #AI #ThreatHunting
It seems that #APT #Donot also used .ACCDR files for initial access. Executed codes are similar to previous samples.
0ecfdece9402c4f8732a4581baf4a927
3c0f8dc931cdc76c9d101b41c258a4dc
mtsspk[.net
hxxps://mtsspk[.net/TrDGjfgtxkdl3Pl47enr/
#APT #Patchwork #Spyder added codes to detect running environment.
3f4221dacc105466932db94b9b210b84
hxxp://cloudwindowapps[.com/enclose-pdf
#APT #OceanLotus sample created in 2025 was uploaded to VT last month. DLL decrypts and executes shellcode in memory. C2 seems to be inactive now.
8c13ce3a5f579a4fb4d25222412b775a
152.32.144[.]5:443
#APT #Patchwork
2d31067df7ccbcd6eaef1025098ed928 (dll)
sandtribes[.org
Similar to previous samples
#APT #Patchwork
076ab63979336e827abc96fcd4fbf534 (lnk)
e066b5a875d08507832fc7ed29a7aa30 (dll)
b7c2b4d14112356a3d327e99ee97d627
adskochbus[.org
theserveunity[.org
#APT #MysteriousElephant
96b15bb9ce8ef7c41b708b1620029d99 (chm)
91693c2d5a4b7d090fe06cc7382dfc18 (exe)
188.214.33[.]170:443
#Malware #SmartLoader disguised using OpenClaw-related topics
Threat actor built malicious Github repo on the basis of a legimate one.
Report: mp.weixin.qq.com/s/q-86GR8g_…
hxxp://89.169.12[.235/api/
hxxp://213.176.73[.145/api/
hxxp://213.176.73[.162/api/
Related #APT malware (DLL written in Rust)
9a95078a7a5f1045c61fe95ab308ec3f
a70e0e057bb9cc33913ca035fb3a1138
hxxps://support.cc-cvbs-sco.workers[.dev:443/api/analytics/collect
hxxps://cms.bahria-edu.workers[.dev:443/api/analytics/collect
Suspected #APT #Sidewinder
VBA macros in .xls downloads EXE + malicous DLL (Rust trojan). Cloudflare workers domain is abused for C2 infra.
753bb1b5d8b879f478babb21ed4d9696 (xls)
f310ee836f88cc43d3939f8a88b20495 (dll)
*.goldibrowhoami.workers[.dev
*.desco-gov-bd.workers[.dev
