diff --git a/galaxy.html b/galaxy.html
index f277d82..4a97e79 100644
--- a/galaxy.html
+++ b/galaxy.html
@@ -7425,6 +7425,48 @@ Ransomware is a cluster galaxy available in JSON format at <a href="https://gith
 </tbody>
 </table>
 </div>
+<div class="sect2">
+<h3 id="_wannacry"><a class="anchor" href="#_wannacry"></a><a class="link" href="#_wannacry">WannaCry</a></h3>
+<div class="paragraph">
+<p>According to numerous open-source reports, a widespread ransomware campaign is affecting various organizations with reports of tens of thousands of infections in as many as 74 countries, including the United States, United Kingdom, Spain, Russia, Taiwan, France, and Japan. The software can run in as many as 27 different languages.  The latest version of this ransomware variant, known as WannaCry, WCry, or Wanna Decryptor, was discovered the morning of May 12, 2017, by an independent security researcher and has spread rapidly over several hours, with initial reports beginning around 4:00 AM EDT, May 12, 2017. Open-source reporting indicates a requested ransom of .1781 bitcoins, roughly $300 U.S.</p>
+</div>
+<div class="paragraph">
+<p>WannaCry is also known as:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p>WannaCrypt</p>
+</li>
+<li>
+<p>WannaCry</p>
+</li>
+<li>
+<p>WanaCrypt0r</p>
+</li>
+<li>
+<p>WCrypt</p>
+</li>
+<li>
+<p>WCRY</p>
+</li>
+</ul>
+</div>
+<table class="tableblock frame-all grid-all spread">
+<caption class="title">Table 279. Table References</caption>
+<colgroup>
+<col style="width: 100%;">
+</colgroup>
+<tbody>
+<tr>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Links</p></td>
+</tr>
+<tr>
+<td class="tableblock halign-left valign-top"><p class="tableblock"><a href="https://gist.github.com/rain-1/989428fa5504f378b993ee6efbc0b168">https://gist.github.com/rain-1/989428fa5504f378b993ee6efbc0b168</a></p></td>
+</tr>
+</tbody>
+</table>
+</div>
 </div>
 </div>
 <div class="sect1">
@@ -7459,7 +7501,7 @@ TDS is a cluster galaxy available in JSON format at <a href="https://github.com/
 <p>Keitaro TDS is among the mostly used TDS in drive by infection chains</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 279. Table References</caption>
+<caption class="title">Table 280. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -7479,7 +7521,7 @@ TDS is a cluster galaxy available in JSON format at <a href="https://github.com/
 <p>Sutra TDS was dominant from 2012 till 2015</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 280. Table References</caption>
+<caption class="title">Table 281. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -7509,7 +7551,7 @@ TDS is a cluster galaxy available in JSON format at <a href="https://github.com/
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 281. Table References</caption>
+<caption class="title">Table 282. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -7529,7 +7571,7 @@ TDS is a cluster galaxy available in JSON format at <a href="https://github.com/
 <p>BossTDS</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 282. Table References</caption>
+<caption class="title">Table 283. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -7549,7 +7591,7 @@ TDS is a cluster galaxy available in JSON format at <a href="https://github.com/
 <p>BlackHat TDS is sold underground.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 283. Table References</caption>
+<caption class="title">Table 284. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -7640,7 +7682,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 284. Table References</caption>
+<caption class="title">Table 285. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -7677,7 +7719,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 285. Table References</caption>
+<caption class="title">Table 286. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -7710,7 +7752,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 286. Table References</caption>
+<caption class="title">Table 287. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -7730,7 +7772,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <div class="sect2">
 <h3 id="_dust_storm"><a class="anchor" href="#_dust_storm"></a><a class="link" href="#_dust_storm">Dust Storm</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 287. Table References</caption>
+<caption class="title">Table 288. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -7750,7 +7792,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <p>Adversary targeting dissident groups in China and its surroundings.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 288. Table References</caption>
+<caption class="title">Table 289. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -7844,7 +7886,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 289. Table References</caption>
+<caption class="title">Table 290. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -7892,7 +7934,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 290. Table References</caption>
+<caption class="title">Table 291. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -7928,7 +7970,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 291. Table References</caption>
+<caption class="title">Table 292. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -7982,7 +8024,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 292. Table References</caption>
+<caption class="title">Table 293. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -7999,7 +8041,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <div class="sect2">
 <h3 id="_apt_16"><a class="anchor" href="#_apt_16"></a><a class="link" href="#_apt_16">APT 16</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 293. Table References</caption>
+<caption class="title">Table 294. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -8044,7 +8086,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 294. Table References</caption>
+<caption class="title">Table 295. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -8086,7 +8128,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 295. Table References</caption>
+<caption class="title">Table 296. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -8116,7 +8158,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 296. Table References</caption>
+<caption class="title">Table 297. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -8173,7 +8215,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 297. Table References</caption>
+<caption class="title">Table 298. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -8230,7 +8272,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 298. Table References</caption>
+<caption class="title">Table 299. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -8272,7 +8314,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 299. Table References</caption>
+<caption class="title">Table 300. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -8305,7 +8347,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 300. Table References</caption>
+<caption class="title">Table 301. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -8335,7 +8377,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <div class="sect2">
 <h3 id="_hurricane_panda"><a class="anchor" href="#_hurricane_panda"></a><a class="link" href="#_hurricane_panda">Hurricane Panda</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 301. Table References</caption>
+<caption class="title">Table 302. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -8383,7 +8425,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 302. Table References</caption>
+<caption class="title">Table 303. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -8428,7 +8470,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 303. Table References</caption>
+<caption class="title">Table 304. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -8464,7 +8506,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 304. Table References</caption>
+<caption class="title">Table 305. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -8494,7 +8536,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 305. Table References</caption>
+<caption class="title">Table 306. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -8511,7 +8553,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <div class="sect2">
 <h3 id="_night_dragon"><a class="anchor" href="#_night_dragon"></a><a class="link" href="#_night_dragon">Night Dragon</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 306. Table References</caption>
+<caption class="title">Table 307. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -8556,7 +8598,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 307. Table References</caption>
+<caption class="title">Table 308. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -8595,7 +8637,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 308. Table References</caption>
+<caption class="title">Table 309. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -8622,7 +8664,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 309. Table References</caption>
+<caption class="title">Table 310. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -8655,7 +8697,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 310. Table References</caption>
+<caption class="title">Table 311. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -8688,7 +8730,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 311. Table References</caption>
+<caption class="title">Table 312. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -8705,7 +8747,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <div class="sect2">
 <h3 id="_roaming_tiger"><a class="anchor" href="#_roaming_tiger"></a><a class="link" href="#_roaming_tiger">Roaming Tiger</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 312. Table References</caption>
+<caption class="title">Table 313. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -8722,7 +8764,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <div class="sect2">
 <h3 id="_hiddenlynx"><a class="anchor" href="#_hiddenlynx"></a><a class="link" href="#_hiddenlynx">HiddenLynx</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 313. Table References</caption>
+<caption class="title">Table 314. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -8765,7 +8807,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <div class="sect2">
 <h3 id="_apt_3102"><a class="anchor" href="#_apt_3102"></a><a class="link" href="#_apt_3102">APT.3102</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 314. Table References</caption>
+<caption class="title">Table 315. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -8807,7 +8849,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 315. Table References</caption>
+<caption class="title">Table 316. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -8844,7 +8886,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 316. Table References</caption>
+<caption class="title">Table 317. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -8864,7 +8906,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <p>A group targeting dissident groups in China and at the boundaries.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 317. Table References</caption>
+<caption class="title">Table 318. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -8903,7 +8945,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 318. Table References</caption>
+<caption class="title">Table 319. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -8936,7 +8978,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 319. Table References</caption>
+<caption class="title">Table 320. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -8978,7 +9020,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 320. Table References</caption>
+<caption class="title">Table 321. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -9017,7 +9059,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 321. Table References</caption>
+<caption class="title">Table 322. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -9056,7 +9098,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 322. Table References</caption>
+<caption class="title">Table 323. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -9086,7 +9128,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 323. Table References</caption>
+<caption class="title">Table 324. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -9122,7 +9164,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 324. Table References</caption>
+<caption class="title">Table 325. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -9176,7 +9218,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 325. Table References</caption>
+<caption class="title">Table 326. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -9269,7 +9311,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 326. Table References</caption>
+<caption class="title">Table 327. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -9341,7 +9383,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 327. Table References</caption>
+<caption class="title">Table 328. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -9404,7 +9446,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 328. Table References</caption>
+<caption class="title">Table 329. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -9455,7 +9497,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 329. Table References</caption>
+<caption class="title">Table 330. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -9494,7 +9536,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 330. Table References</caption>
+<caption class="title">Table 331. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -9514,7 +9556,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <p>We will refer to the gang behind the malware as TeleBots. However it’s important to say that these attackers, and the toolset used, share a number of similarities with the BlackEnergy group, which conducted attacks against the energy industry in Ukraine in December 2015 and January 2016. In fact, we think that the BlackEnergy group has evolved into the TeleBots group.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 331. Table References</caption>
+<caption class="title">Table 332. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -9547,7 +9589,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 332. Table References</caption>
+<caption class="title">Table 333. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -9580,7 +9622,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 333. Table References</caption>
+<caption class="title">Table 334. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -9597,7 +9639,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <div class="sect2">
 <h3 id="_buhtrap"><a class="anchor" href="#_buhtrap"></a><a class="link" href="#_buhtrap">BuhTrap</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 334. Table References</caption>
+<caption class="title">Table 335. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -9646,7 +9688,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <p>Adversary targeting manufacturing and industrial organizations.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 335. Table References</caption>
+<caption class="title">Table 336. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -9682,7 +9724,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 336. Table References</caption>
+<caption class="title">Table 337. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -9709,7 +9751,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 337. Table References</caption>
+<caption class="title">Table 338. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -9739,7 +9781,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 338. Table References</caption>
+<caption class="title">Table 339. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -9798,7 +9840,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 339. Table References</caption>
+<caption class="title">Table 340. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -9831,7 +9873,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 340. Table References</caption>
+<caption class="title">Table 341. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -9861,7 +9903,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 341. Table References</caption>
+<caption class="title">Table 342. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -9891,7 +9933,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 342. Table References</caption>
+<caption class="title">Table 343. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -9924,7 +9966,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 343. Table References</caption>
+<caption class="title">Table 344. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -9957,7 +9999,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 344. Table References</caption>
+<caption class="title">Table 345. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -9987,7 +10029,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 345. Table References</caption>
+<caption class="title">Table 346. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10026,7 +10068,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 346. Table References</caption>
+<caption class="title">Table 347. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10049,7 +10091,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <p>Proofpoint researchers recently uncovered evidence of an advanced persistent threat (APT) against Indian diplomatic and military resources. Our investigation began with malicious emails sent to Indian embassies in Saudi Arabia and Kazakstan but turned up connections to watering hole sites focused on Indian military personnel and designed to drop a remote access Trojan (RAT) with a variety of data exfiltration functions.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 347. Table References</caption>
+<caption class="title">Table 348. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10069,7 +10111,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <p>Scarlet Mimic is a threat group that has targeted minority rights activists. This group has not been directly linked to a government source, but the group&#8217;s motivations appear to overlap with those of the Chinese government. While there is some overlap between IP addresses used by Scarlet Mimic and Putter Panda, it has not been concluded that the groups are the same.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 348. Table References</caption>
+<caption class="title">Table 349. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10092,7 +10134,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <p>Poseidon Group is a Portuguese-speaking threat group that has been active since at least 2005. The group has a history of using information exfiltrated from victims to blackmail victim companies into contracting the Poseidon Group as a security firm.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 349. Table References</caption>
+<caption class="title">Table 350. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10125,7 +10167,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 350. Table References</caption>
+<caption class="title">Table 351. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10161,7 +10203,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 351. Table References</caption>
+<caption class="title">Table 352. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10197,7 +10239,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 352. Table References</caption>
+<caption class="title">Table 353. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10227,7 +10269,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 353. Table References</caption>
+<caption class="title">Table 354. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10256,7 +10298,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <p>GCMAN is a threat group that focuses on targeting banks for the purpose of transferring money to e-currency services.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 354. Table References</caption>
+<caption class="title">Table 355. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10276,7 +10318,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <p>Suckfly is a China-based threat group that has been active since at least 2014</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 355. Table References</caption>
+<caption class="title">Table 356. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10296,7 +10338,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <p>FIN is a group targeting financial assets including assets able to do financial transaction including PoS.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 356. Table References</caption>
+<caption class="title">Table 357. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10332,7 +10374,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 357. Table References</caption>
+<caption class="title">Table 358. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10352,7 +10394,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <p>Iranian threat agent OilRig has been targeting multiple organisations in Israel and other countries in the Middle East since the end of 2015.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 358. Table References</caption>
+<caption class="title">Table 359. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10372,7 +10414,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <p>Beginning in late 2012, a carefully orchestrated attack campaign we call Volatile Cedar has been targeting individuals, companies and institutions worldwide. This campaign, led by a persistent attacker group, has successfully penetrated a large number of targets using various attack techniques, and specifically, a custom-made malware implant codenamed Explosive .</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 359. Table References</caption>
+<caption class="title">Table 360. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10411,7 +10453,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <p>Microsoft Threat Intelligence identified similarities between this recent attack and previous 2012 attacks against tens of thousands of computers belonging to organizations in the energy sector. Microsoft Threat Intelligence refers to the activity group behind these attacks as TERBIUM, following our internal practice of assigning rogue actors chemical element names.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 360. Table References</caption>
+<caption class="title">Table 361. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10450,7 +10492,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 361. Table References</caption>
+<caption class="title">Table 362. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10483,7 +10525,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 362. Table References</caption>
+<caption class="title">Table 363. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10506,7 +10548,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <p>NEODYMIUM is an activity group that is known to use a backdoor malware detected by Microsoft as Wingbird. This backdoor’s characteristics closely match FinFisher, a government-grade commercial surveillance package. Data about Wingbird activity indicate that it is typically used to attack individual computers instead of networks.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 363. Table References</caption>
+<caption class="title">Table 364. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10526,7 +10568,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <p>A threat group that has been active for at least seven years has used malware, phishing and disinformation tactics to target activists, journalists, politicians and public figures in various Latin American countries.  The threat actor, dubbed Packrat based on its preference for remote access Trojans (RATs) and because it has used the same infrastructure for several years, has been analyzed by Citizen Lab researchers John Scott-Railton, Morgan Marquis-Boire, and Claudio Guarnieri, and Cyphort researcher Marion Marschalek, best known for her extensive analysis of state-sponsored threats.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 364. Table References</caption>
+<caption class="title">Table 365. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10546,7 +10588,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <p>Symantec telemetry identified Cadelle and Chafer activity dating from as far back as July 2014, however, it’s likely that activity began well before this date. Command-and-control (C&amp;C) registrant information points to activity possibly as early as 2011, while executable compilation times suggest early 2012. Their attacks continue to the present day. Symantec estimates that each team is made up of between 5 and 10 people.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 365. Table References</caption>
+<caption class="title">Table 366. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10566,7 +10608,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <p>Symantec telemetry identified Cadelle and Chafer activity dating from as far back as July 2014, however, it’s likely that activity began well before this date. Command-and-control (C&amp;C) registrant information points to activity possibly as early as 2011, while executable compilation times suggest early 2012. Their attacks continue to the present day. Symantec estimates that each team is made up of between 5 and 10 people.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 366. Table References</caption>
+<caption class="title">Table 367. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10586,7 +10628,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <p>The PassCV group continues to be one of the most successful and active threat groups that leverage a wide array of stolen Authenticode-signing certificates.  Snorre Fagerland of Blue Coat Systems first coined the term PassCV in a blog post. His post provides a good introduction to the group and covers some of the older infrastructure, stolen code-signing certificate reuse, and other connections associated with the PassCV malware. There are several clues alluding to the possibility that multiple groups may be utilizing the same stolen signing certificates, but at this time SPEAR believes the current attacks are more likely being perpetrated by a single group employing multiple publicly available Remote Administration Tools (RATs).  The PassCV group has been operating with continued success and has already started to expand their malware repertoire into different off-the-shelf RATs and custom code. SPEAR identified eighteen previously undisclosed stolen Authenticode certificates. These certificates were originally issued to companies and individuals scattered across China, Taiwan, Korea, Europe, the United States and Russia.  In this post we expand the usage of the term ‘PassCV’ to encompass the malware mentioned in the Blue Coat Systems report, as well as the APT group behind the larger C2 infrastructure and stolen Authenticode certificates. We’d like to share some of our findings as they pertain to the stolen certificates, command and control infrastructure, and some of the newer custom RATs they’ve begun development on.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 367. Table References</caption>
+<caption class="title">Table 368. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10663,7 +10705,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <p>The Equation Group is a highly sophisticated threat actor described by its discoverers at Kaspersky Labs as one of the most sophisticated cyber attack groups in the world, operating alongside but always from a position of superiority with the creators of Stuxnet and Flame</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 368. Table References</caption>
+<caption class="title">Table 369. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10683,7 +10725,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <p>Greenbug was discovered targeting a range of organizations in the Middle East including companies in the aviation, energy, government, investment, and education sectors.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 369. Table References</caption>
+<caption class="title">Table 370. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10703,7 +10745,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <p>Unit 42 threat researchers have recently observed a threat group distributing new, custom developed malware. We have labelled this threat group the Gamaredon Group and our research shows that the Gamaredon Group has been active since at least 2013.  In the past, the Gamaredon Group has relied heavily on off-the-shelf tools. Our new research shows the Gamaredon Group have made a shift to custom-developed malware. We believe this shift indicates the Gamaredon Group have improved their technical capabilities.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 370. Table References</caption>
+<caption class="title">Table 371. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10733,7 +10775,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 371. Table References</caption>
+<caption class="title">Table 372. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10753,7 +10795,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <p>Barium is one of the groups using Winnti.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 372. Table References</caption>
+<caption class="title">Table 373. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10783,7 +10825,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 373. Table References</caption>
+<caption class="title">Table 374. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10803,7 +10845,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <p>Sima is a group of suspected Iranian origin targeting Iranians in diaspora.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 374. Table References</caption>
+<caption class="title">Table 375. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10833,7 +10875,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 375. Table References</caption>
+<caption class="title">Table 376. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10853,7 +10895,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <p>Groundbait is a group targeting anti-government separatists in the self-declared Donetsk and Luhansk People’s Republics.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 376. Table References</caption>
+<caption class="title">Table 377. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10873,7 +10915,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <p>Longhorn has been active since at least 2011. It has used a range of back door Trojans in addition to zero-day vulnerabilities to compromise its targets. Longhorn has infiltrated governments and internationally operating organizations, in addition to targets in the financial, telecoms, energy, aerospace, information technology, education, and natural resources sectors. All of the organizations targeted would be of interest to a nation-state attacker.  Longhorn has infected 40 targets in at least 16 countries across the Middle East, Europe, Asia, and Africa. On one occasion a computer in the United States was compromised but, following infection, an uninstaller was launched within hours, which may indicate this victim was infected unintentionally.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 377. Table References</caption>
+<caption class="title">Table 378. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10893,7 +10935,7 @@ Threat actor is a cluster galaxy available in JSON format at <a href="https://gi
 <p>The Callisto Group  is an advanced threat actor whose known targets include military personnel, government officials, think tanks, and journalists in Europe and the South Caucasus. Their primary interest appears to be gathering intelligence related to foreign and security policy in the Eastern Europe and South Caucasus regions.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 378. Table References</caption>
+<caption class="title">Table 379. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -10957,7 +10999,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 379. Table References</caption>
+<caption class="title">Table 380. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -11002,7 +11044,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 380. Table References</caption>
+<caption class="title">Table 381. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -11024,7 +11066,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </div>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 381. Table References</caption>
+<caption class="title">Table 382. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -11044,7 +11086,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>A password sthealing tool regularly used by attackers</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 382. Table References</caption>
+<caption class="title">Table 383. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -11077,7 +11119,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 383. Table References</caption>
+<caption class="title">Table 384. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -11100,7 +11142,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>In March 2016, Unit 42 observed this new Poison Ivy variant we’ve named SPIVY being deployed via weaponized documents leveraging CVE-2015-2545.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 384. Table References</caption>
+<caption class="title">Table 385. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -11127,7 +11169,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 385. Table References</caption>
+<caption class="title">Table 386. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -11157,7 +11199,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 386. Table References</caption>
+<caption class="title">Table 387. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -11193,7 +11235,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 387. Table References</caption>
+<caption class="title">Table 388. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -11223,7 +11265,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 388. Table References</caption>
+<caption class="title">Table 389. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -11253,7 +11295,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 389. Table References</caption>
+<caption class="title">Table 390. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -11292,7 +11334,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 390. Table References</caption>
+<caption class="title">Table 391. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -11337,7 +11379,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 391. Table References</caption>
+<caption class="title">Table 392. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -11370,7 +11412,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 392. Table References</caption>
+<caption class="title">Table 393. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -11400,7 +11442,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 393. Table References</caption>
+<caption class="title">Table 394. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -11439,7 +11481,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 394. Table References</caption>
+<caption class="title">Table 395. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -11469,7 +11511,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 395. Table References</caption>
+<caption class="title">Table 396. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -11486,7 +11528,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <div class="sect2">
 <h3 id="_hi_zor"><a class="anchor" href="#_hi_zor"></a><a class="link" href="#_hi_zor">Hi-ZOR</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 396. Table References</caption>
+<caption class="title">Table 397. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -11513,7 +11555,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 397. Table References</caption>
+<caption class="title">Table 398. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -11552,7 +11594,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 398. Table References</caption>
+<caption class="title">Table 399. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -11600,7 +11642,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 399. Table References</caption>
+<caption class="title">Table 400. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -11636,7 +11678,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 400. Table References</caption>
+<caption class="title">Table 401. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -11672,7 +11714,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 401. Table References</caption>
+<caption class="title">Table 402. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -11708,7 +11750,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 402. Table References</caption>
+<caption class="title">Table 403. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -11738,7 +11780,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 403. Table References</caption>
+<caption class="title">Table 404. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -11758,7 +11800,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Backdoor attribued to APT1</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 404. Table References</caption>
+<caption class="title">Table 405. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -11794,7 +11836,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 405. Table References</caption>
+<caption class="title">Table 406. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -11814,7 +11856,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>RARSTONE is a Remote Access Tool (RAT) discovered early 2013 by TrendMicro, it’s characterized by a great affinity with the other RAT know as Plug is and was used in April for phishing campaigns that followed the dramatic attack to the Boston Marathon.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 406. Table References</caption>
+<caption class="title">Table 407. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -11844,7 +11886,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 407. Table References</caption>
+<caption class="title">Table 408. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -11867,7 +11909,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Backdoor user by he Naikon APT group</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 408. Table References</caption>
+<caption class="title">Table 409. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -11903,7 +11945,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 409. Table References</caption>
+<caption class="title">Table 410. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -11936,7 +11978,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 410. Table References</caption>
+<caption class="title">Table 411. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -11985,7 +12027,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 411. Table References</caption>
+<caption class="title">Table 412. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12024,7 +12066,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 412. Table References</caption>
+<caption class="title">Table 413. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12064,7 +12106,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <div class="sect2">
 <h3 id="_cmstar"><a class="anchor" href="#_cmstar"></a><a class="link" href="#_cmstar">CMStar</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 413. Table References</caption>
+<caption class="title">Table 414. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12091,7 +12133,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 414. Table References</caption>
+<caption class="title">Table 415. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12121,7 +12163,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 415. Table References</caption>
+<caption class="title">Table 416. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12151,7 +12193,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 416. Table References</caption>
+<caption class="title">Table 417. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12181,7 +12223,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 417. Table References</caption>
+<caption class="title">Table 418. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12201,7 +12243,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Blackshades Remote Access Tool targets Microsoft Windows operating systems. Authors were arrested in 2012 and 2014.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 418. Table References</caption>
+<caption class="title">Table 419. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12240,7 +12282,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 419. Table References</caption>
+<caption class="title">Table 420. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12279,7 +12321,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 420. Table References</caption>
+<caption class="title">Table 421. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12318,7 +12360,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 421. Table References</caption>
+<caption class="title">Table 422. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12348,7 +12390,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 422. Table References</caption>
+<caption class="title">Table 423. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12384,7 +12426,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 423. Table References</caption>
+<caption class="title">Table 424. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12417,7 +12459,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 424. Table References</caption>
+<caption class="title">Table 425. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12450,7 +12492,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>RAT initially written in VB.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 425. Table References</caption>
+<caption class="title">Table 426. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12523,7 +12565,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 426. Table References</caption>
+<caption class="title">Table 427. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12618,7 +12660,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 427. Table References</caption>
+<caption class="title">Table 428. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12635,7 +12677,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <div class="sect2">
 <h3 id="_t9000"><a class="anchor" href="#_t9000"></a><a class="link" href="#_t9000">T9000</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 428. Table References</caption>
+<caption class="title">Table 429. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12662,7 +12704,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 429. Table References</caption>
+<caption class="title">Table 430. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12679,7 +12721,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <div class="sect2">
 <h3 id="_taidoor"><a class="anchor" href="#_taidoor"></a><a class="link" href="#_taidoor">Taidoor</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 430. Table References</caption>
+<caption class="title">Table 431. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12696,7 +12738,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <div class="sect2">
 <h3 id="_swisyn"><a class="anchor" href="#_swisyn"></a><a class="link" href="#_swisyn">Swisyn</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 431. Table References</caption>
+<caption class="title">Table 432. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12713,7 +12755,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <div class="sect2">
 <h3 id="_rekaf"><a class="anchor" href="#_rekaf"></a><a class="link" href="#_rekaf">Rekaf</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 432. Table References</caption>
+<caption class="title">Table 433. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12734,7 +12776,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <div class="sect2">
 <h3 id="_skeletonkey"><a class="anchor" href="#_skeletonkey"></a><a class="link" href="#_skeletonkey">SkeletonKey</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 433. Table References</caption>
+<caption class="title">Table 434. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12751,7 +12793,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <div class="sect2">
 <h3 id="_skyipot"><a class="anchor" href="#_skyipot"></a><a class="link" href="#_skyipot">Skyipot</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 434. Table References</caption>
+<caption class="title">Table 435. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12768,7 +12810,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <div class="sect2">
 <h3 id="_spindest"><a class="anchor" href="#_spindest"></a><a class="link" href="#_spindest">Spindest</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 435. Table References</caption>
+<caption class="title">Table 436. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12793,7 +12835,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <div class="sect2">
 <h3 id="_pcclient_rat"><a class="anchor" href="#_pcclient_rat"></a><a class="link" href="#_pcclient_rat">PCClient RAT</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 436. Table References</caption>
+<caption class="title">Table 437. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12814,7 +12856,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <div class="sect2">
 <h3 id="_mongall"><a class="anchor" href="#_mongall"></a><a class="link" href="#_mongall">Mongall</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 437. Table References</caption>
+<caption class="title">Table 438. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12831,7 +12873,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <div class="sect2">
 <h3 id="_ned_worm"><a class="anchor" href="#_ned_worm"></a><a class="link" href="#_ned_worm">NeD Worm</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 438. Table References</caption>
+<caption class="title">Table 439. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12848,7 +12890,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <div class="sect2">
 <h3 id="_newct"><a class="anchor" href="#_newct"></a><a class="link" href="#_newct">NewCT</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 439. Table References</caption>
+<caption class="title">Table 440. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12865,7 +12907,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <div class="sect2">
 <h3 id="_nflog"><a class="anchor" href="#_nflog"></a><a class="link" href="#_nflog">Nflog</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 440. Table References</caption>
+<caption class="title">Table 441. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12882,7 +12924,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <div class="sect2">
 <h3 id="_janicab"><a class="anchor" href="#_janicab"></a><a class="link" href="#_janicab">Janicab</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 441. Table References</caption>
+<caption class="title">Table 442. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12909,7 +12951,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 442. Table References</caption>
+<caption class="title">Table 443. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12926,7 +12968,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <div class="sect2">
 <h3 id="_jolob"><a class="anchor" href="#_jolob"></a><a class="link" href="#_jolob">Jolob</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 443. Table References</caption>
+<caption class="title">Table 444. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12943,7 +12985,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <div class="sect2">
 <h3 id="_isspace"><a class="anchor" href="#_isspace"></a><a class="link" href="#_isspace">IsSpace</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 444. Table References</caption>
+<caption class="title">Table 445. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -12979,7 +13021,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <div class="sect2">
 <h3 id="_htran"><a class="anchor" href="#_htran"></a><a class="link" href="#_htran">Htran</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 445. Table References</caption>
+<caption class="title">Table 446. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13006,7 +13048,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 446. Table References</caption>
+<caption class="title">Table 447. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13041,7 +13083,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 447. Table References</caption>
+<caption class="title">Table 448. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13074,7 +13116,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 448. Table References</caption>
+<caption class="title">Table 449. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13091,7 +13133,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <div class="sect2">
 <h3 id="_ctrat"><a class="anchor" href="#_ctrat"></a><a class="link" href="#_ctrat">CTRat</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 449. Table References</caption>
+<caption class="title">Table 450. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13118,7 +13160,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 450. Table References</caption>
+<caption class="title">Table 451. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13151,7 +13193,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 451. Table References</caption>
+<caption class="title">Table 452. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13181,7 +13223,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <div class="sect2">
 <h3 id="_fysbis"><a class="anchor" href="#_fysbis"></a><a class="link" href="#_fysbis">Fysbis</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 452. Table References</caption>
+<caption class="title">Table 453. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13198,7 +13240,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <div class="sect2">
 <h3 id="_hikit"><a class="anchor" href="#_hikit"></a><a class="link" href="#_hikit">Hikit</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 453. Table References</caption>
+<caption class="title">Table 454. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13228,7 +13270,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 454. Table References</caption>
+<caption class="title">Table 455. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13245,7 +13287,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <div class="sect2">
 <h3 id="_ruckguv"><a class="anchor" href="#_ruckguv"></a><a class="link" href="#_ruckguv">Ruckguv</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 455. Table References</caption>
+<caption class="title">Table 456. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13262,7 +13304,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <div class="sect2">
 <h3 id="_herher_trojan"><a class="anchor" href="#_herher_trojan"></a><a class="link" href="#_herher_trojan">HerHer Trojan</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 456. Table References</caption>
+<caption class="title">Table 457. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13279,7 +13321,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <div class="sect2">
 <h3 id="_helminth_backdoor"><a class="anchor" href="#_helminth_backdoor"></a><a class="link" href="#_helminth_backdoor">Helminth backdoor</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 457. Table References</caption>
+<caption class="title">Table 458. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13296,7 +13338,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <div class="sect2">
 <h3 id="_hdroot"><a class="anchor" href="#_hdroot"></a><a class="link" href="#_hdroot">HDRoot</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 458. Table References</caption>
+<caption class="title">Table 459. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13313,7 +13355,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <div class="sect2">
 <h3 id="_irongate"><a class="anchor" href="#_irongate"></a><a class="link" href="#_irongate">IRONGATE</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 459. Table References</caption>
+<caption class="title">Table 460. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13330,7 +13372,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <div class="sect2">
 <h3 id="_shimrat"><a class="anchor" href="#_shimrat"></a><a class="link" href="#_shimrat">ShimRAT</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 460. Table References</caption>
+<caption class="title">Table 461. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13360,7 +13402,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 461. Table References</caption>
+<caption class="title">Table 462. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13393,7 +13435,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <div class="sect2">
 <h3 id="_foozer"><a class="anchor" href="#_foozer"></a><a class="link" href="#_foozer">Foozer</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 462. Table References</caption>
+<caption class="title">Table 463. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13410,7 +13452,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <div class="sect2">
 <h3 id="_winids"><a class="anchor" href="#_winids"></a><a class="link" href="#_winids">WinIDS</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 463. Table References</caption>
+<caption class="title">Table 464. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13427,7 +13469,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <div class="sect2">
 <h3 id="_downrange"><a class="anchor" href="#_downrange"></a><a class="link" href="#_downrange">DownRange</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 464. Table References</caption>
+<caption class="title">Table 465. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13444,7 +13486,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <div class="sect2">
 <h3 id="_mad_max"><a class="anchor" href="#_mad_max"></a><a class="link" href="#_mad_max">Mad Max</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 465. Table References</caption>
+<caption class="title">Table 466. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13464,7 +13506,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Crimson is malware used as part of a campaign known as Operation Transparent Tribe that targeted Indian diplomatic and military victims</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 466. Table References</caption>
+<caption class="title">Table 467. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13484,7 +13526,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Operation Groundbait based on our research into the Prikormka malware family. This includes detailed technical analysis of the Prikormka malware family and its spreading mechanisms, and a description of the most noteworthy attack campaigns.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 467. Table References</caption>
+<caption class="title">Table 468. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13504,7 +13546,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>This whitepaper details a malicious program we identify as NanHaiShu. Based on our analysis, the threat actor behind this malware targets government and private-sector organizations.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 468. Table References</caption>
+<caption class="title">Table 469. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13524,7 +13566,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Umbreon (sharing the same name as the Pokémon) targets Linux systems, including systems running both Intel and ARM processors, expanding the scope of this threat to include embedded devices as well.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 469. Table References</caption>
+<caption class="title">Table 470. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13544,7 +13586,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Odinaff is typically deployed in the first stage of an attack, to gain a foothold onto the network, providing a persistent presence and the ability to install additional tools onto the target network. These additional tools bear the hallmarks of a sophisticated attacker which has plagued the financial industry since at least 2013–Carbanak. This new wave of attacks has also used some infrastructure that has previously been used in Carbanak campaigns.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 470. Table References</caption>
+<caption class="title">Table 471. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13574,7 +13616,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 471. Table References</caption>
+<caption class="title">Table 472. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13604,7 +13646,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 472. Table References</caption>
+<caption class="title">Table 473. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13652,7 +13694,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 473. Table References</caption>
+<caption class="title">Table 474. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13690,7 +13732,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 474. Table References</caption>
+<caption class="title">Table 475. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13725,7 +13767,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 475. Table References</caption>
+<caption class="title">Table 476. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13745,7 +13787,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>The Necurs botnet is a distributor of many pieces of malware, most notably Locky.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 476. Table References</caption>
+<caption class="title">Table 477. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13782,7 +13824,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 477. Table References</caption>
+<caption class="title">Table 478. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13808,7 +13850,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Vawtrak is an information stealing malware family that is primarily used to gain unauthorised access to bank accounts through online banking websites.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 478. Table References</caption>
+<caption class="title">Table 479. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13828,7 +13870,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Empire is a pure PowerShell post-exploitation agent built on cryptologically-secure communications and a flexible architecture. Empire implements the ability to run PowerShell agents without needing powershell.exe, rapidly deployable post-exploitation modules ranging from key loggers to Mimikatz, and adaptable communications to evade network detection, all wrapped up in a usability-focused framework</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 479. Table References</caption>
+<caption class="title">Table 480. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13848,7 +13890,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Beginning in late 2012, a carefully orchestrated attack campaign we call Volatile Cedar has been targeting individuals, companies and institutions worldwide. This campaign, led by a persistent attacker group, has successfully penetrated a large number of targets using various attack techniques, and specifically, a custom-made malware implant codenamed Explosive.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 480. Table References</caption>
+<caption class="title">Table 481. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13868,7 +13910,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>The actors used a new version of “KeyBoy,” a custom backdoor first disclosed by researchers at Rapid7 in June 2013. Their work outlined the capabilities of the backdoor, and exposed the protocols and algorithms used to hide the network communication and configuration data</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 481. Table References</caption>
+<caption class="title">Table 482. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13901,7 +13943,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 482. Table References</caption>
+<caption class="title">Table 483. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13937,7 +13979,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 483. Table References</caption>
+<caption class="title">Table 484. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13961,7 +14003,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>BlackEnergy is a trojan which has undergone significant functional changes since it was first publicly analysed by Arbor Networks in 2007. It has evolved from a relatively simple DDoS trojan into a relatively sophisticated piece of modern malware with a modular architecture, making it a suitable tool for sending spam and for online bank fraud, as well as for targeted attacks. BlackEnergy version 2, which featured rootkit techniques, was documented by SecureWorks in 2010. The targeted attacks recently discovered are proof that the trojan is still alive and kicking in 2014.  We provide a technical analysis of the BlackEnergy family, focusing on novel functionality and the differences introduced by new lite variants. We describe the most notable aspects of the malware, including its techniques for bypassing UAC, defeating the signed driver requirement in Windows and a selection of BlackEnergy2 plug-ins used for parasitic file infections, network discovery and remote code execution and data collection.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 484. Table References</caption>
+<caption class="title">Table 485. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -13991,7 +14033,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 485. Table References</caption>
+<caption class="title">Table 486. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14026,7 +14068,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 486. Table References</caption>
+<caption class="title">Table 487. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14046,7 +14088,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <div class="sect2">
 <h3 id="_chthonic"><a class="anchor" href="#_chthonic"></a><a class="link" href="#_chthonic">Chthonic</a></h3>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 487. Table References</caption>
+<caption class="title">Table 488. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14066,7 +14108,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>GeminiDuke is malware that was used by APT29 from 2009 to 2012.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 488. Table References</caption>
+<caption class="title">Table 489. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14099,7 +14141,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 489. Table References</caption>
+<caption class="title">Table 490. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14122,7 +14164,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Shifu is a Banking Trojan first discovered in 2015. Shifu is based on the Shiz source code which incorporated techniques used by Zeus. Attackers use Shifu to steal credentials for online banking websites around the world, starting in Russia but later including the UK, Italy, and others.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 490. Table References</caption>
+<caption class="title">Table 491. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14142,7 +14184,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>The new variant of the Shiz Trojan malware targets mission-critical enterprise resource planning (ERP) applications — particularly SAP users.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 491. Table References</caption>
+<caption class="title">Table 492. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14184,7 +14226,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 492. Table References</caption>
+<caption class="title">Table 493. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14204,7 +14246,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Shamoon,[a] also known as Disttrack, is a modular computer virus discovered by Seculert[1] in 2012, targeting recent NT kernel-based versions of Microsoft Windows. The virus has been used for cyber espionage in the energy sector.[2][3][4] Its discovery was announced on 16 August 2012 by Symantec,[3] Kaspersky Lab,[5] and Seculert.[6] Similarities have been highlighted by Kaspersky Lab and Seculert between Shamoon and the Flame malware.[5][6]</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 493. Table References</caption>
+<caption class="title">Table 494. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14224,7 +14266,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>According to MalwareHunterTeam and other researchers that have looked at the malware&#8217;s source code, GhostAdmin seems to be a reworked version of CrimeScene, another botnet malware family that was active around 3-4 years ago.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 494. Table References</caption>
+<caption class="title">Table 495. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14244,7 +14286,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Two Italians referred to as the “Occhionero brothers” have been arrested and accused of using malware and a carefully-prepared spear-phishing scheme to spy on high-profile politicians and businessmen. This case has been called “EyePyramid”, which we first discussed last week. (Conspiracy theories aside, the name came from a domain name and directory path that was found during the research.)</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 495. Table References</caption>
+<caption class="title">Table 496. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14264,7 +14306,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>LuminosityLink is a malware family costing $40 that purports to be a system administration utility</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 496. Table References</caption>
+<caption class="title">Table 497. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14294,7 +14336,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 497. Table References</caption>
+<caption class="title">Table 498. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14317,7 +14359,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Most recently, we have observed the same group targeting military and aerospace interests in Russia and Belarus. Since the summer of 2016, this group began using a new downloader known as ZeroT to install the PlugX remote access Trojan (RAT) and added Microsoft Compiled HTML Help (.chm) as one of the initial droppers delivered in spear-phishing emails.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 498. Table References</caption>
+<caption class="title">Table 499. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14337,7 +14379,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Cylance dubbed this family of malware StreamEx, based upon a common exported function used across all samples ‘stream’, combined with the dropper functionality to append ‘ex’ to the DLL file name.  The StreamEx family has the ability to access and modify the user’s file system, modify the registry, create system services, enumerate process and system information, enumerate network resources and drive types, scan for security tools such as firewall products and antivirus products, change browser security settings, and remotely execute commands. The malware documented in this post was predominantly 64-bit, however, there are 32-bit versions of the malware in the wild.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 499. Table References</caption>
+<caption class="title">Table 500. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14357,7 +14399,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 500. Table References</caption>
+<caption class="title">Table 501. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14377,7 +14419,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 501. Table References</caption>
+<caption class="title">Table 502. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14397,7 +14439,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 502. Table References</caption>
+<caption class="title">Table 503. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14417,7 +14459,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 503. Table References</caption>
+<caption class="title">Table 504. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14437,7 +14479,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 504. Table References</caption>
+<caption class="title">Table 505. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14457,7 +14499,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 505. Table References</caption>
+<caption class="title">Table 506. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14477,7 +14519,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 506. Table References</caption>
+<caption class="title">Table 507. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14497,7 +14539,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 507. Table References</caption>
+<caption class="title">Table 508. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14517,7 +14559,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 508. Table References</caption>
+<caption class="title">Table 509. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14537,7 +14579,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 509. Table References</caption>
+<caption class="title">Table 510. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14557,7 +14599,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 510. Table References</caption>
+<caption class="title">Table 511. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14577,7 +14619,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 511. Table References</caption>
+<caption class="title">Table 512. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14597,7 +14639,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 512. Table References</caption>
+<caption class="title">Table 513. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14617,7 +14659,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 513. Table References</caption>
+<caption class="title">Table 514. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14637,7 +14679,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 514. Table References</caption>
+<caption class="title">Table 515. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14657,7 +14699,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 515. Table References</caption>
+<caption class="title">Table 516. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14677,7 +14719,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 516. Table References</caption>
+<caption class="title">Table 517. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14697,7 +14739,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 517. Table References</caption>
+<caption class="title">Table 518. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14717,7 +14759,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 518. Table References</caption>
+<caption class="title">Table 519. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14737,7 +14779,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 519. Table References</caption>
+<caption class="title">Table 520. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14757,7 +14799,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 520. Table References</caption>
+<caption class="title">Table 521. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14777,7 +14819,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 521. Table References</caption>
+<caption class="title">Table 522. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14797,7 +14839,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 522. Table References</caption>
+<caption class="title">Table 523. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14817,7 +14859,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 523. Table References</caption>
+<caption class="title">Table 524. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14837,7 +14879,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 524. Table References</caption>
+<caption class="title">Table 525. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14857,7 +14899,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 525. Table References</caption>
+<caption class="title">Table 526. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14877,7 +14919,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 526. Table References</caption>
+<caption class="title">Table 527. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14897,7 +14939,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 527. Table References</caption>
+<caption class="title">Table 528. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14917,7 +14959,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 528. Table References</caption>
+<caption class="title">Table 529. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14937,7 +14979,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 529. Table References</caption>
+<caption class="title">Table 530. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14957,7 +14999,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 530. Table References</caption>
+<caption class="title">Table 531. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14977,7 +15019,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 531. Table References</caption>
+<caption class="title">Table 532. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -14997,7 +15039,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Remote Access Trojan</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 532. Table References</caption>
+<caption class="title">Table 533. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15017,7 +15059,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool mainly written in python.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 533. Table References</caption>
+<caption class="title">Table 534. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15037,7 +15079,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Linux Arm malware spread via RFIs in cgi-bin scripts.  This backdoor executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 534. Table References</caption>
+<caption class="title">Table 535. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15057,7 +15099,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>KHRAT is a small backdoor that has three exports (functions), namely, K1, K2, and K3. K1 checks if the current user is an administrator. If not, it uninstalls itself by calling the K2 function.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 535. Table References</caption>
+<caption class="title">Table 536. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15077,7 +15119,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>The Trochilus RAT is a threatening RAT (Remote Access Trojan) that may evade many anti-virus programs. The Trochilus RAT is currently being used as part of an extended threat campaign in South East Asia. The first appearance of the Trochilus RAT in this campaign, which has been active since August of 2015, was first detected in the summer of 2015. The Trochilus RAT is currently being used against civil society organizations and government computers in the South East Asia region, particularly in attacks directed towards the government of Myanmar.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 536. Table References</caption>
+<caption class="title">Table 537. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15097,7 +15139,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>The MoonWind sample used for this analysis was compiled with a Chinese compiler known as BlackMoon, the same compiler used for the BlackMoon banking Trojan. While a number of attributes match the BlackMoon banking Trojan, the malware is not the same. Both malware families were simply compiled using the same compiler, and it was the BlackMoon artifacts that resulted in the naming of the BlackMoon banking Trojan. But because this new sample is different from the BlackMoon banking Trojan,</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 537. Table References</caption>
+<caption class="title">Table 538. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15130,7 +15172,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 538. Table References</caption>
+<caption class="title">Table 539. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15150,7 +15192,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>The trojan serves as a backdoor. It can be controlled remotely.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 539. Table References</caption>
+<caption class="title">Table 540. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15173,7 +15215,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>The AURIGA malware family shares a large amount of functionality with the BANGAT backdoor.  The malware family contains functionality for keystroke logging, creating and killing processes, performing file system and registry modifications, spawning interactive command shells, performing process injection, logging off the current user or shutting down the local machine.  The AURIGA malware contains a driver component which is used to inject the malware DLL into other processes.  This driver can also perform process and IP connection hiding.  The malware family will create a copy of cmd.exe to perform its C2 activity, and replace the "Microsoft corp" strings in the cmd.exe binary with different values.  The malware family typically maintains persistence through installing itself as a service.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 540. Table References</caption>
+<caption class="title">Table 541. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15193,7 +15235,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>The BANGAT malware family shares a large amount of functionality with the AURIGA backdoor.  The malware family contains functionality for keylogging, creating and killing processes, performing filesystem and registry modifications, spawning interactive command shells, performing process injection, logging off the current user or shutting down the local machine.  In addition, the malware also implements a custom VNC like protocol which sends screenshots of the desktop to the C2 server and accepts keyboard and mouse input.  The malware communicates to its C2 servers using SSL, with self signed SSL certificates.  The malware family will create a copy of cmd.exe to perform its C2 activity, and replace the "Microsoft corp" strings in the cmd.exe binary with different values.  The malware family typically maintains persistence through installing itself as a service.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 541. Table References</caption>
+<caption class="title">Table 542. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15213,7 +15255,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>BISCUIT provides attackers with full access to an infected host.  BISCUIT capabilities include launching an interactive command shell, enumerating servers on a Windows network, enumerating and manipulating process, and transferring files.  BISCUIT communicates using a custom protocol, which is then encrypted using SSL.  Once installed BISCUIT will attempt to beacon to its command/control servers approximately every 10 or 30 minutes.  It will beacon its primary server first, followed by a secondary server. All communication is encrypted with SSL (OpenSSL 0.9.8i).</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 542. Table References</caption>
+<caption class="title">Table 543. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15233,7 +15275,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>BOUNCER will load an extracted DLL into memory, and then will call the DLL&#8217;s dump export.  The dump export is called with the parameters passed via the command line to the BOUNCER executable.  It requires at least two arguments, the IP and port to send the password dump information.  It can accept at most five arguments, including a proxy IP, port and an x.509 key for SSL authentication.  The DLL backdoor has the capability to execute arbitrary commands, collect database and server information, brute force SQL login credentials, launch arbitrary programs, create processes and threads, delete files, and redirect network traffic.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 543. Table References</caption>
+<caption class="title">Table 544. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15253,7 +15295,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>This family of malware uses Google Calendar to retrieve commands and send results. It retrieves event feeds associated with Google Calendar, where each event contains commands from the attacker for the malware to perform. Results are posted back to the event feed. The malware authenticates with Google using the hard coded email address and passwords. The malware uses the deprecated ClientLogin authentication API from Google. The malware is registered as a service dll as a persistence mechanism. Artifacts of this may be found in the registry.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 544. Table References</caption>
+<caption class="title">Table 545. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15273,7 +15315,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>The COMBOS malware family is an HTTP based backdoor.  The backdoor is capable of file upload, file download, spawning a interactive reverse shell, and terminating its own process.  The backdoor may decrypt stored Internet Explorer credentials from the local system and transmit the credentials to the C2 server.  The COMBOS malware family does not have any persistence mechanisms built into itself.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 545. Table References</caption>
+<caption class="title">Table 546. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15303,7 +15345,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 546. Table References</caption>
+<caption class="title">Table 547. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15323,7 +15365,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Members of this malware family are backdoors that provide file downloading, process listing, process killing, and reverse shell capabilities.  This malware may also add itself to the Authorized Applications list for the Windows Firewall.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 547. Table References</caption>
+<caption class="title">Table 548. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15343,7 +15385,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Members of this family of malware are utilities designed to extract email messages and attachments from Outlook PST files. One part of this utility set is an executable, one is a dll. The malware may create a registry artifact related to the executable.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 548. Table References</caption>
+<caption class="title">Table 549. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15363,7 +15405,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>This family of malware is a utility designed to upload files to Google Docs. Nearly all communications are with docs.google.com are SSL encrypted. The malware does not use Google&#8217;s published API to interact with their services. The malware does not currently work with Google Docs. It does not detect HTTP 302 redirections and will get caught in an infinite loop attempting to parse results from Google that are not present.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 549. Table References</caption>
+<caption class="title">Table 550. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15393,7 +15435,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 550. Table References</caption>
+<caption class="title">Table 551. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15423,7 +15465,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 551. Table References</caption>
+<caption class="title">Table 552. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15443,7 +15485,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Members of this family are full featured backdoors that communicates with a Web-based Command &amp; Control (C2) server over SSL. Features include interactive shell, gathering system info, uploading and downloading files, and creating and killing processes, Malware in this family usually communicates with a hard-coded domain using SSL on port 443. Some members of this family rely on launchers to establish persistence mechanism for them. Others contains functionality that allows it to install itself, replacing an existing Windows service, and uninstall itself. Several variants use %SystemRoot%\Tasks or %WinDir%\Tasks as working directories, additional malware artifacts may be found there.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 552. Table References</caption>
+<caption class="title">Table 553. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15465,7 +15507,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </div>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 553. Table References</caption>
+<caption class="title">Table 554. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15487,7 +15529,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </div>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 554. Table References</caption>
+<caption class="title">Table 555. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15507,7 +15549,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>This family of malware is a backdoor that tunnels its connection through a preconfigured proxy. The malware communicates with a remote command and control server over HTTPS via the proxy. The malware installs itself as a Windows service with a service name supplied by the attacker but defaults to IPRIP if no service name is provided during install.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 555. Table References</caption>
+<caption class="title">Table 556. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15527,7 +15569,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>LIGHTBOLT is a utility with the ability to perform HTTP GET requests for a list of user-specified URLs. The responses of the HTTP requests are then saved as MHTML files, which are added to encrypted RAR files. LIGHTBOLT has the ability to use software certificates for authentication.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 556. Table References</caption>
+<caption class="title">Table 557. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15547,7 +15589,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>LIGHTDART is a tool used to access a pre-configured web page that hosts an interface to query a database or data set. The tool then downloads the results of a query against that web page to an encrypted RAR file. This RAR file (1.rar) is renamed and uploaded to an attacker controlled FTP server, or uploaded via an HTTP POST with a .jpg extension. The malware will execute this search once a day. The target webpage usually contains information useful to the attacker, which is updated on a regular basis. Examples of targeted information include weather information or ship coordinates.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 557. Table References</caption>
+<caption class="title">Table 558. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15567,7 +15609,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>LONGRUN is a backdoor designed to communicate with a hard-coded IP address and provide the attackers with a custom interactive shell.  It supports file uploads and downloads, and executing arbitrary commands on the compromised machine.  When LONGRUN executes, it first loads configuration data stored as an obfuscated string inside the PE resource section. The distinctive string thequickbrownfxjmpsvalzydg is used as part of the input to the decoding algorithm.  When the configuration data string is decoded it is parsed and treated as an IP and port number.  The malware then connects to the host and begins interacting with it over a custom protocol.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 558. Table References</caption>
+<caption class="title">Table 559. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15587,7 +15629,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>This family of malware will beacon out at random intervals to the remote attacker. The attacker can run programs, execute arbitrary commands, and easily upload and download files. This IOC looks for both the dropper file and the backdoor.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 559. Table References</caption>
+<caption class="title">Table 560. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15607,7 +15649,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>This malware utility is a set of two files that operate in conjunction to extract email messages and attachments from an Exchange server. In order to operate successfully, these programs require authentication credentials for a user on the Exchange server, and must be run from a machine joined to the domain that has Microsoft Outlook installed (or equivalent software that provides the Microsoft 'Messaging API' (MAPI) service).</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 560. Table References</caption>
+<caption class="title">Table 561. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15630,7 +15672,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>This family of malware consists of backdoors that attempt to fetch encoded commands over HTTP. The malware is capable of downloading a file, downloading and executing a file, executing arbitrary shell commands, or sleeping a specified interval.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 561. Table References</caption>
+<caption class="title">Table 562. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15650,7 +15692,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>The NEWSREELS malware family is an HTTP based backdoor.  When first started, NEWSREELS decodes two strings from its resources section. These strings are both used as C2 channels, one URL is used as a beacon URL (transmitting) and the second URL is used to get commands (receiving).  The NEWSREELS malware family is capable of performing file uploads, downloads, creating processes or creating an interactive reverse shell.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 562. Table References</caption>
+<caption class="title">Table 563. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15670,7 +15712,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>The SEASALT malware family communicates via a custom binary protocol.  It is capable of gathering some basic system information, file system manipulation, file upload and download, process creation and termination, and spawning an interactive reverse shell.  The malware maintains persistence by installing itself as a service.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 563. Table References</caption>
+<caption class="title">Table 564. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15690,7 +15732,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>STARSYPOUND provides an interactive remote shell over an obfuscated communications channel.  When it is first run, it loads a string (from the executable PE resource section) containing the beacon IP address and port.  The malware sends the beacon string "<strong>(SY)# &lt;HOSTNAME&gt;" to the remote system, where &lt;HOSTNAME&gt; is the hostname of the victim system.  The remote host responds with a packet that also begins with the string "</strong>(SY)# cmd". This causes the malware to launch a new cmd.exe child process. Further communications are forwarded to the cmd.exe child process to execute. The commands sent to the shell and their responses are obfuscated when sent over the network.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 564. Table References</caption>
+<caption class="title">Table 565. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15710,7 +15752,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>This family of malware provides a backdoor over the network to the attackers. It is configured to connect to a single host and offers file download over HTTP, program execution, and arbitrary execution of commands through a cmd.exe instance.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 565. Table References</caption>
+<caption class="title">Table 566. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15742,7 +15784,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 566. Table References</caption>
+<caption class="title">Table 567. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15762,7 +15804,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>The TARSIP malware family is a backdoor which communicates over encoded information in HTTPS headers.  Typical TARSIP malware samples will only beacon out to their C2 servers if the C2 DNS address resolves to a specific address.  The capability of TARSIP backdoors includes file uploading, file downloading, interactive command shells, process enumeration, process creation, process termination. The TARSIP-ECLIPSE family is distinguished by the presence of 'eclipse' in .pdb debug strings present in the malware samples. It does not provide a built in mechanism to maintain persistence.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 567. Table References</caption>
+<caption class="title">Table 568. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15782,7 +15824,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>The TARSIP malware family is a backdoor which communicates over encoded information in HTTPS headers.  Typical TARSIP malware samples will only beacon out to their C2 servers if the C2 DNS address resolves to a specific address.  The capability of TARSIP backdoors includes file uploading, file downloading, interactive command shells, process enumeration, process creation, process termination. The TARSIP-MOON family is distinguished by the presence of 'moon' in .pdb debug strings present in the malware samples.  It does not provide a built in mechanism to maintain persistence.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 568. Table References</caption>
+<caption class="title">Table 569. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15802,7 +15844,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>The WARP malware family is an HTTP based backdoor written in C++, and the majority of its code base is borrowed from source code available in the public domain.  Network communications are implemented using the same WWW client library (w3c.cpp) available from www.dankrusi.com/file_69653F3336383837.html.  The malware has system survey functionality (collects hostname, current user, system uptime, CPU speed, etc.) taken directly from the BO2K backdoor available from www.bo2k.com.  It also contains the hard disk identification code found at www.winsim.com/diskid32/diskid32.cpp.  When the WARP executing remote commands, the malware creates a copy of the ?%SYSTEMROOT%\system32\cmd.exe? file as '%USERPROFILE%\Temp\~ISUN32.EXE'.  The version signature information of the duplicate executable is zeroed out.  Some WARP variants maintain persistence through the use of DLL search order hijacking.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 569. Table References</caption>
+<caption class="title">Table 570. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15822,7 +15864,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. This family of malware  is capable of downloading and executing a file. All variants represented here are the same file with different MD5 signatures. This malware attempts to contact its C2 once a week (Thursday at 10:00 AM). It looks for commands inside a set of HTML tags, part of which are in the File Strings indicator term below.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 570. Table References</caption>
+<caption class="title">Table 571. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15842,7 +15884,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. This malware family is a only a downloader which operates over the HTTP protocol with a hard-coded URL. If directed, it has the capability to download, decompress, and execute compressed binaries.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 571. Table References</caption>
+<caption class="title">Table 572. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15864,7 +15906,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </div>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 572. Table References</caption>
+<caption class="title">Table 573. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15884,7 +15926,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The family of malware provides the attacker with an interactive command shell, the ability to upload and download files, execute commands on the system, list processes and DLLs, kill processes, and ping hosts on the local network. Responses to these commands are encrypted and compressed before being POSTed to the server. Some variants copy cmd.exe to Updatasched.exe in a temporary directory, and then may launch that in a process if an interactive shell is called. On initial invocation, the malware also attempts to delete previous copies of the Updatasched.exe file.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 573. Table References</caption>
+<caption class="title">Table 574. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15904,7 +15946,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. Members of this family of malware act only as downloaders and droppers for other malware. They communicate with a hard-coded C2 server, reading commands embedded in HTML comment fields. Some variants are executables which act upon execution, others are DLLs which can be attached to services or loaded through search order hijacking.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 574. Table References</caption>
+<caption class="title">Table 575. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15924,7 +15966,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands.  The WEBC2-DIV variant searches for the strings "div safe:" and " balance" to delimit encoded C2 information. If the decoded string begins with the letter "J" the malware will parse additional arguments in the decoded string to specify the sleep interval to use.  WEBC2-DIV is capable of downloading a file, downloading and executing a file, or sleeping a specified interval.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 575. Table References</caption>
+<caption class="title">Table 576. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15944,7 +15986,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. This malware is a variant on the GREENCAT family, using a fixed web C2. This family is a full featured backdoor which provides remote command execution, file transfer, process and service enumeration and manipulation.  It installs itself persistently through the current user&#8217;s registry Run key.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 576. Table References</caption>
+<caption class="title">Table 577. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15964,7 +16006,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands.  The WEBC2-HEAD variant communicates over HTTPS, using the system&#8217;s SSL implementation to encrypt all communications with the C2 server.  WEBC2-HEAD first issues an HTTP GET to the host, sending the Base64-encoded string containing the name of the compromised machine running the malware.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 577. Table References</caption>
+<caption class="title">Table 578. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -15984,7 +16026,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands.  The WEBC2-KT3 variant searches for commands in a specific comment tag.  Network traffic starting with *!Kt3+v| may indicate WEBC2-KT3 activity.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 578. Table References</caption>
+<caption class="title">Table 579. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -16004,7 +16046,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands.  The WEBC2-QBP variant will search for two strings in a HTML comment. The first will be "2010QBP " followed by " 2010QBP//--".  Inside these tags will be a DES-encrypted string.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 579. Table References</caption>
+<caption class="title">Table 580. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -16024,7 +16066,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. This family of malware will set itself up as a service and connect out to a hardcoded web page and read a modified base64 string from this webpage. The later versions of this malware supports three commands (earlier ones are just downloaders or reverse shells). The first commands will sleep the malware for N number of hours. The second command will download a binary from the encoded HTML comment and execute it on the infected host. The third will spawn an encoded reverse shell to an attacker specified location and port.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 580. Table References</caption>
+<caption class="title">Table 581. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -16044,7 +16086,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The WEBC2-TABLE variant looks for web pages containing 'background', 'align', and 'bgcolor' tags to be present in the requested Web page.  If the data in these tags are formatted correctly, the malware will decode a second URL and a filename.  This URL is then retrieved, written to the decoded filename and executed.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 581. Table References</caption>
+<caption class="title">Table 582. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -16064,7 +16106,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The WEBC2-TABLE variant looks for web pages containing 'background', 'align', and 'bgcolor' tags to be present in the requested Web page.  If the data in these tags are formatted correctly, the malware will decode a second URL and a filename.  This URL is then retrieved, written to the decoded filename and executed.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 582. Table References</caption>
+<caption class="title">Table 583. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -16084,7 +16126,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. Members of this family of malware provide remote command shell and remote file download and execution capabilities. The malware downloads a web page containing a crafted HTML comment that subsequently contains an encoded command. The contents of this command tell the malware whether to download and execute a program, launch a reverse shell to a specific host and port number, or to sleep for a period of time.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 583. Table References</caption>
+<caption class="title">Table 584. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -16104,7 +16146,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. Members of this family of backdoor malware talk to specific Web-based Command &amp; Control (C2) servers. The backdoor has a limited command set, depending on version. It is primarily a downloader, but it classified as a backdoor because it can accept a limited command set, including changing local directories, downloading and executing additional files, sleeping, and connecting to a specific IP &amp; port not initially included in the instruction set for the malware. Each version of the malware has at least one hardcoded URL to which it connects to receive its initial commands. This family of malware installs itself as a service, with the malware either being the executable run by the service, or the service DLL loaded by a legitimate service. The same core code is seen recompiled on different dates or with different names, but the same functionality. Key signatures include a specific set of functions (some of which can be used with the OS-provided rundll32.exe tool to install the malware as a service), and hardcoded strings used in communication with C2 servers to issue commands to the implant.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 584. Table References</caption>
+<caption class="title">Table 585. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -16124,7 +16166,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands.  The WEBC2-YAHOO variant enters a loop where every ten minutes it attempts to download a web page that may contain an encoded URL.  The encoded URL will be found in the pages returned inside an attribute named 'sb' or 'ex' within a tag named 'yahoo'.  The embedded link can direct the malware to download and execute files.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 585. Table References</caption>
+<caption class="title">Table 586. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -16144,7 +16186,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>HAYMAKER is a backdoor that can download and execute additional payloads in the form of modules. It also conducts basic victim profiling activity, collecting the computer name, running process IDs, %TEMP% directory path and version of Internet Explorer. It communicates encoded system information to a single hard coded command and control (C2) server, using the system’s default User-Agent string.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 586. Table References</caption>
+<caption class="title">Table 587. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -16164,7 +16206,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>BUGJUICE is a backdoor that is executed by launching a benign file and then hijacking the search order to load a malicious dll into it. That malicious dll then loads encrypted shellcode from the binary, which is decrypted and runs the final BUGJUICE payload. BUGJUICE defaults to TCP using a custom binary protocol to communicate with the C2, but can also use HTTP and HTTPs if directed by the C2. It has the capability to find files, enumerate drives, exfiltrate data, take screenshots and provide a reverse shell.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 587. Table References</caption>
+<caption class="title">Table 588. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -16184,7 +16226,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>SNUGRIDE is a backdoor that communicates with its C2 server through HTTP requests. Messages are encrypted using AES with a static key. The malware’s capabilities include taking a system survey, access to the filesystem, executing commands and a reverse shell. Persistence is maintained through a Run registry key.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 588. Table References</caption>
+<caption class="title">Table 589. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -16204,7 +16246,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>QUASARRAT is an open-source RAT available at <a href="https://github.com/quasar/QuasarRat" class="bare">https://github.com/quasar/QuasarRat</a> . The versions used by APT10 (1.3.4.0, 2.0.0.0, and 2.0.0.1) are not available via the public GitHub page, indicating that APT10 has further customized the open source version. The 2.0 versions require a dropper to decipher and launch the AES encrypted QUASARRAT payload. QUASARRAT is a fully functional .NET backdoor that has been used by multiple cyber espionage groups in the past.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 589. Table References</caption>
+<caption class="title">Table 590. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -16237,7 +16279,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </ul>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 590. Table References</caption>
+<caption class="title">Table 591. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -16263,7 +16305,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>LATENTBOT, a new, highly obfuscated BOT that has been in the wild since mid-2013. It has managed to leave hardly any traces on the Internet, is capable of watching its victims without ever being noticed, and can even corrupt a hard disk, thus making a PC useless.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 591. Table References</caption>
+<caption class="title">Table 592. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -16286,7 +16328,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Though we have not identified the targets, FINSPY is sold by Gamma Group to multiple nation-state clients, and we assess with moderate confidence that it was being used along with the zero-day to carry out cyber espionage.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 592. Table References</caption>
+<caption class="title">Table 593. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -16306,7 +16348,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>HackingTeam Remote Control System (RCS) Galileo hacking platform</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 593. Table References</caption>
+<caption class="title">Table 594. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -16506,7 +16548,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Unfortunately, it is time to meet 'Feodo'. Since august of this year when FireEye&#8217;s MPS devices detected this malware in the field, we have been monitoring this banking trojan very closely. In many ways, this malware looks similar to other famous banking trojans like Zbot and SpyEye.  Although my analysis says that this malware is not a toolkit and is in the hands of a single criminal group.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 594. Table References</caption>
+<caption class="title">Table 595. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -16526,7 +16568,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Palo Alto Networks has discovered a previously unknown remote access Trojan (RAT) that has been active for over two years. It has a very low volume in this two-year period, totaling roughly 27 total samples. The malware is delivered via an innovative and unique technique: a downloader we are calling Carp uses malicious macros in Microsoft Excel documents to compile embedded C# (C Sharp) Programming Language source code into an executable that in turn is run to deploy the Cardinal RAT malware family. These malicious Excel files use a number of different lures, providing evidence of what attackers are using to entice victims into executing them.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 595. Table References</caption>
+<caption class="title">Table 596. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -16546,7 +16588,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>The REDLEAVES implant consists of three parts: an executable, a loader, and the implant shellcode. The REDLEAVES implant is a remote administration Trojan (RAT) that is built in Visual C++ and makes heavy use of thread generation during its execution. The implant contains a number of functions typical of RATs, including system enumeration and creating a remote shell back to the C2.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 596. Table References</caption>
+<caption class="title">Table 597. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -16566,7 +16608,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 <p>Kazuar is a fully featured backdoor written using the .NET Framework and obfuscated using the open source packer called ConfuserEx. Unit 42 researchers have uncovered a backdoor Trojan used in an espionage campaign. The developers refer to this tool by the name Kazuar, which is a Trojan written using the Microsoft .NET Framework that offers actors complete access to compromised systems targeted by its operator. Kazuar includes a highly functional command set, which includes the ability to remotely load additional plugins to increase the Trojan’s capabilities. During our analysis of this malware we uncovered interesting code paths and other artifacts that may indicate a Mac or Unix variant of this same tool also exists. Also, we discovered a unique feature within Kazuar: it exposes its capabilities through an Application Programming Interface (API)  to a built-in webserver.  We suspect the Kazuar tool may be linked to the Turla threat actor group (also known as Uroburos and Snake), who have been reported to have compromised embassies, defense contractors, educational institutions, and research organizations across the globe. A hallmark of Turla operations is iterations of their tools and code lineage in Kazuar can be traced back to at least 2005. If the hypothesis is correct and the Turla threat group is using Kazuar, we believe they may be using it as a replacement for Carbon and its derivatives. Of the myriad of tools observed in use by Turla Carbon and its variants were typically deployed as a second stage backdoor within targeted environments and we believe Kazuar may now hold a similar role for Turla operations.</p>
 </div>
 <table class="tableblock frame-all grid-all spread">
-<caption class="title">Table 597. Table References</caption>
+<caption class="title">Table 598. Table References</caption>
 <colgroup>
 <col style="width: 100%;">
 </colgroup>
@@ -16585,7 +16627,7 @@ Tool is a cluster galaxy available in JSON format at <a href="https://github.com
 </div>
 <div id="footer">
 <div id="footer-text">
-Last updated 2017-05-07 12:00:44 CEST
+Last updated 2017-05-14 21:59:39 CEST
 </div>
 </div>
 </body>