R-003↗︎
APT41: A Dual Espionage and Cyber Crime Operation
Foundational Mandiant research into a prolific group conducting state-sponsored espionage alongside financially motivated activity.
Security research · Threat intelligence
Chi-en Ashley
Shen
$ codex
› tell me about Chi-en Ashley Shen
codex
沈祈恩 is a cybersecurity researcher and technical leader from Taiwan 🇹🇼. She is currently at Cisco Talos, with APT and threat-intelligence experience at Google TAG and Mandiant, plus global conference and women-in-security leadership.
沈祈恩 is a cybersecurity researcher and technical leader from Taiwan 🇹🇼. She is currently at Cisco Talos, with APT and threat-intelligence experience at Google TAG and Mandiant, plus global conference and women-in-security leadership.
SECURITY RESEARCH // ASHLEY SHEN
01 Threat Intelligence Research
02 Malware analysis
01 / UPCOMING EVENTS
Next,
on the calendar.
2026UP NEXT
Securing the Agentic Era
Speaker · Nov 12 · 09:00–15:00 · Resilient Studios
2026UPCOMING
Eyes on the Edge: From an In-the-Wild AitM Framework to an IP-Camera Vulnerability Chain
30-minute briefing · Dec 9–10 program · Session slot TBA
2027UPCOMING
Black Hat Asia 2027
Attending · Feb 28–Mar 3 · Marina Bay Sands
02 / RESEARCH
UAT-6275SILENT LYNX
Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations
Talos and Recorded Future trace UAT-6275 activity targeting CIS government organizations through exposed infrastructure, custom reverse shells and a WinRAR exploit.
Read the analysis
FEATURED RESEARCH
R-018↗︎
China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor
A Rust backdoor uses Microsoft 365 Outlook and OneDrive as dead drops in an espionage campaign across Asia.
R-017↗︎
New Lua-based malware “LucidRook” targets Taiwanese organizations
A multi-stage stager combining a Lua interpreter with Rust-compiled libraries and layered anti-analysis.
R-015↗︎
Microsoft Patch Tuesday: November 2025
63 vulnerabilities, an exploited Windows Kernel flaw and associated Snort coverage.
R-014↗︎
Modeling compartmentalized threats
Extending the Diamond Model to represent multi-actor intrusion chains and relationships.
R-013↗︎
Redefining initial access brokers
A taxonomy for financially motivated, state-sponsored and opportunistic initial access groups.
R-012↗︎
ToyMaker, an initial access broker working with double-extortion gangs
Following a compromise from the LAGTOY backdoor to a Cactus ransomware handoff.
R-011↗︎
SoK: On the Offensive Potential of AI
A systematic analysis of offensive-AI capabilities across research and expert practice.
R-010↗︎
Remote code execution in the WeChat custom browser
Analysis of a lingering V8 type-confusion vulnerability in WeChat’s WebView component.
R-009↗︎
APT41 targets a Taiwanese research institute
ShadowPad, Cobalt Strike and a tailored loader in a government-affiliated compromise.
R-008↗︎
Unveiling SneakyChef’s SpiceRAT
Two infection chains using LNK and HTA files to target government agencies.
R-007↗︎
SugarGh0st campaigns across EMEA and Asia
Expanded targeting and an additional SFX RAR infection chain attributed to SneakyChef.
R-006↗︎
Cloud Run abuse in LATAM-focused campaigns
Astaroth, Mekotio and Ousaban delivered through high-volume malicious email campaigns.
R-005↗︎
New SugarGh0st RAT targets Uzbekistan and South Korea
Discovery and analysis of a customized Gh0st RAT variant in targeted campaigns.
R-002↗︎
Spear phishing targets Ukraine government and military
RATVERMIN, QUASARRAT and infrastructure with a potential link to the Luhansk region.
R-001↗︎
Flexible malicious OpenXML document detection
A framework for detecting weaponized Office OpenXML documents used in APT attacks.
REFERENCES / CITED EXPERTISE
EXTERNAL PROFILE · 2019
32 Influential Malware Analysis Professionals
↗︎
A historical community profile recognizing my malware-analysis and threat-intelligence work.
CITED EXPERT · ATLANTIC COUNCIL · 2025
Crash (Exploit) and Burn
↗︎
Expert interview cited on restrictions affecting Chinese researchers and East Asian security-conference ecosystems.
CO-AUTHORED RESEARCH PAPER · DIRECT PDF
SoK: On the Offensive Potential of AI
↗︎
A systematic analysis of offensive AI across academic research, security briefings, public perspectives and expert knowledge.
RESEARCH REFERENCE · CSS CYBER DEFENSE PROJECT
A One-Sided Affair: Japan and the People’s Republic of China in Cyberspace
↗︎
Independent regional context on China–Japan cyber activity, including a dedicated Icefog/Dagger Panda analysis.
03 / SPEAKING
Research,
out loud.
2026
Break the Silence: Tracking Silent Lynx Through Exposed Infrastructure
With Julian-Ferdinand Vögele · Oct 14 · 17:00
2026
Steam & Steel: The Chronicles of the Cyberverse
Speaker · Oct 8–9 · Invite only · Talk details shared on-site
2026
It’s Me, Myself and (A)I: Hunting UAT-11587’s Cloud-Abuse Campaigns Across Asia
Solo briefing · Sept 16–19 · on-site only
2026
Break the Silence: Tracking Silent Lynx Through Exposed Infrastructure
With Julian-Ferdinand Vögele · Aug 31 · 09:50
2026
Building a Shared Digital Defense for Civil Society
Panel · July 20 · 15:30 Taipei time
2026
Knife Cutting the Edge: Dissecting A Gateway Surveillance & MitM Framework
Jan 25 · 1:00–1:20 p.m. ET · Disco In The Dark
2026
Knife Cutting the Edge: Dissecting A Gateway Surveillance & MitM Framework
Presentation · Jan 22 · 10:40–11:20
2025
Knife Cutting the Edge: Dissecting a Modular Gateway Implant for Domestic Surveillance
Solo briefing · Sept 17–20 · on-site only
2025
Redefining IABs: Impacts of Compartmentalization on Threat Tracking & Modeling
Aug 22 · 17:30 SGT · recorded session
2025
Hacking the Status Quo: Tales From Leading Women in Cybersecurity
Leadership panel with Valentina Palmiotti, Kymberlee Price and Natalie Silvanovich
2025
Exploit Hunter: How We Turn Your 0day into Nday
International Conference on Cyber Conflict · May 27–30
2025
Redefining IABs: Impacts of Compartmentalization on Threat Tracking & Modeling
With Vitor Ventura · May 9
2025
Exploit Hunter: How We Turn Your 0day into Nday
Mar 15 · 10:50–11:20
2024
Jumping Hurdles to Verify Vulnerabilities on Chinese Instant Messaging
Solo briefing · Sept 18–21
2024
Follow the Moonshine: Unravelling Poison Carp’s Trail to a Chinese Mercenary’s Arsenal
Mobile surveillance, infrastructure pivots and mercenary attribution · May 9
Expand complete speaking archive+15
2021
YouTube Botnets Abuse Cloud
Cloud-service abuse and botnet infrastructure
2021
Threat Hunting and Campaign Tracking
Oct 16 · 14:35
2020
From Threat Hunting to Campaign Tracking
Workshop · with Steve Su
2020
Fighting Against the Cookie Monster
Threat research briefing
2020
Locknote: Conclusions and Key Takeaways From Day 1
Oct 1 · panel
2019
Into the Fog: The Return of ICEFOG APT
Campaign tracking and malware evolution · authored slide deck
2019
Into the Fog: The Return of ICEFOG APT
Technical Track · Oct 9 · full recording
2019
Into the Fog: The Return of ICEFOG APT
Oct 10 · 13:30 · presentation deck
2019
Cyber Threat Landscape in Japan
Revealing threats in the shadow · with Oleg Bondarenko
2018/17
Nation-State Moneymule’s Hunting Season
APT attacks targeting financial institutions
2017
A Deep Dive Into the Digital Weapons of the North Korean Cyber Army
With Moonbeom Park · presentation deck
2017/16
Catching the Golden Snitch
Leveraging threat-intelligence platforms to defend against cyber attacks
2017
Respond Before Incident
How we rescued and secured an APT target
2016/15
Let’s Play Hide and Seek in the Cloud
The APT malware favored in cloud services · with Belinda Lai
2015
Failures of the Security Industry in the Last Decade
Lessons learned from hundreds of cyber-espionage breaches
%20--%3e%3csvg%20version='1.1'%20id='Camada_1'%20xmlns='http://www.w3.org/2000/svg'%20xmlns:xlink='http://www.w3.org/1999/xlink'%20x='0px'%20y='0px'%20viewBox='0%200%20467.4%20185.7'%20style='enable-background:new%200%200%20467.4%20185.7;'%20xml:space='preserve'%3e%3cstyle%20type='text/css'%3e%20.st0{fill-rule:evenodd;clip-rule:evenodd;fill:%23FF8000;}%20.st1{fill-rule:evenodd;clip-rule:evenodd;fill:%23FFFFFF;}%20.st2{clip-path:url(%23SVGID_00000176762192859716538330000003283279457200871060_);fill-rule:evenodd;clip-rule:evenodd;fill:%23FFFFFF;}%20.st3{clip-path:url(%23SVGID_00000176762192859716538330000003283279457200871060_);fill:%23FFFFFF;}%20%3c/style%3e%3cpolygon%20class='st0'%20points='216.9,35.2%20213.8,54.4%20187.2,54.4%20190.3,35.2%20'/%3e%3cpolygon%20class='st1'%20points='184.3,72.7%20174.9,130.5%20201.5,130.5%20210.8,72.7%20'/%3e%3cg%3e%3cdefs%3e%3crect%20id='SVGID_1_'%20width='467.4'%20height='185.7'/%3e%3c/defs%3e%3cclipPath%20id='SVGID_00000091720655726036426620000002706978467550239366_'%3e%3cuse%20xlink:href='%23SVGID_1_'%20style='overflow:visible;'/%3e%3c/clipPath%3e%3cpath%20style='clip-path:url(%23SVGID_00000091720655726036426620000002706978467550239366_);fill-rule:evenodd;clip-rule:evenodd;fill:%23FFFFFF;'%20d='%20M306.3,72.7c0.4,3.3,1.3,5.9,2.8,8.5c2.7,4.5,6.6,8.2,11.2,12.1c1.5,1.1,2.9,2.3,3.8,3.7c1.1,1.4,1.6,3,1.2,5.3%20c-0.7,4.2-5.2,6.3-8.9,6.3c-6.8,0-12.4-5.3-15.1-10.6l-4.9,29.8c5.9,2.5,12.6,3.9,19.4,3.9c18.6,0,33.7-14.1,36.6-31.8%20c1.2-7.2,0.3-12.2-2.1-16.5c-2.2-4-5.5-7.1-10-10.6h-34V72.7z'/%3e%3cpolygon%20style='clip-path:url(%23SVGID_00000091720655726036426620000002706978467550239366_);fill-rule:evenodd;clip-rule:evenodd;fill:%23FFFFFF;'%20points='%20363.8,130.5%20390.4,130.5%20399.7,72.7%20373.1,72.7%20'/%3e%3cpath%20style='clip-path:url(%23SVGID_00000091720655726036426620000002706978467550239366_);fill-rule:evenodd;clip-rule:evenodd;fill:%23FFFFFF;'%20d='%20M341.5,35.3c-16.7,0-26.8,9-31.7,19.2h108.7l3.1-19.2H341.5z'/%3e%3cpath%20style='clip-path:url(%23SVGID_00000091720655726036426620000002706978467550239366_);fill-rule:evenodd;clip-rule:evenodd;fill:%23FFFFFF;'%20d='%20M293.6,54.5c-2.4-14.9-16.3-19.2-35-19.2h-25.8l-3.2,19.2H293.6z'/%3e%3cpath%20style='clip-path:url(%23SVGID_00000091720655726036426620000002706978467550239366_);fill-rule:evenodd;clip-rule:evenodd;fill:%23FFFFFF;'%20d='%20M292,72.7h-27h-11.4h-26.9l-9.3,57.8h26.3l6.4-39.8h0.3l8.3,39.8h28.9l-13.3-39.8C283.3,87.4,289.1,80.7,292,72.7'/%3e%3cpath%20style='clip-path:url(%23SVGID_00000091720655726036426620000002706978467550239366_);fill:%23FFFFFF;'%20d='M262.5,141.8%20c2.8,16.1-13.5,21-21.9,21.6c-23.4,1.7-61.3-9.3-96.7-30.8c-3.6-2.2-7.1-4.4-10.4-6.7l5.9-32h25.2l3.5-21.3l-25.2,0.1l2.9-18.3%20l25.2-0.1l3.2-19.2H121l-11.8,72.5c-28-24.2-41.7-49.2-33.1-66.8C80.4,32,89,29.6,108.9,30.4c-24.8-8.6-57.3-8.3-65.2,5.2%20C31.1,57,59.3,103.7,126.2,140.7c59.6,33,110.5,40.4,130.9,27c2.5-1.6,4.6-4.3,5.6-6.1C265.3,157.3,266.5,149,262.5,141.8'/%3e%3c/g%3e%3c/svg%3e)
'%3e%3cpath%20d='M129.31%20107.023h34.157V130H34.7673C15.8587%20130%200%20112.465%200%2091.907V38.093C0%2017.5349%2015.2488%200%2034.7673%200H163.467v22.9767H40.2568c-8.5393%200-15.8587%207.8605-15.8587%2017.5349v48.9768c0%209.6744%207.3194%2017.5346%2015.8587%2017.5346H129.31ZM218.974%20130c-18.908%200-34.767-17.535-34.767-38.093V38.093C184.207%2017.5349%20199.456%200%20218.974%200h103.692c18.909%200%2034.767%2017.5349%2034.767%2038.093v53.814c0%2021.163-15.248%2038.093-34.767%2038.093H218.974Zm113.451-40.5116V40.5116c0-9.6744-7.319-17.5349-15.858-17.5349h-92.713c-8.539%200-15.859%207.8605-15.859%2017.5349v48.9768c0%209.6744%207.32%2017.5346%2015.859%2017.5346h92.713c8.539%200%2015.858-7.8602%2015.858-17.5346ZM378.172%200h135.409c18.909%200%2034.767%2017.5349%2034.767%2038.093v53.814c0%2021.163-15.248%2038.093-34.767%2038.093H378.172V0ZM523.95%2089.4884V40.5116c0-9.6744-7.319-17.5349-15.858-17.5349H402.57v84.0463h105.522c8.539%200%2015.858-7.8602%2015.858-17.5346Zm44.527-51.3954C568.477%2017.5349%20584.335%200%20603.244%200h127.48v22.9767H609.343c-8.539%200-15.858%207.8605-15.858%2017.5349v13.3023h137.239v22.9768H593.485V90.093c0%209.6744%207.319%2017.535%2015.858%2017.535h121.381v22.977h-127.48c-18.909%200-34.767-17.535-34.767-38.0934V38.093ZM922.247%20130h-132.97V0h132.97c18.908%200%2034.767%2017.5349%2034.767%2038.093%200%2020.5582-3.66%2019.3489-9.759%2026.6047v.6046c6.099%207.2558%209.759%2016.3256%209.759%2026.6047%200%2021.163-15.249%2038.093-34.767%2038.093Zm9.759-88.8837v-5.4419c0-6.6511-4.88-12.093-10.979-12.093H813.675V53.814h107.352c6.099%200%2010.979-5.4419%2010.979-12.0931v-.6046ZM813.675%2076.7907v30.2323h107.352c6.099%200%2010.979-5.442%2010.979-12.0928v-5.4418c0-6.6512-4.88-12.093-10.979-12.093H813.675v-.6047ZM1011.91%20130c-5.49%200-10.98-1.209-15.248-4.233-1.22-.604-2.439-1.209-3.049-1.814-9.76-7.255-15.859-19.348-15.859-32.046V0h24.396v89.4884c0%209.6744%207.32%2017.5346%2015.86%2017.5346H1140V130h-128.09Zm303.75-40.5116V0h24.4v91.907c0%2021.163-15.25%2038.093-34.77%2038.093H1201.6c-18.91%200-34.76-17.535-34.76-38.093V0h24.39v89.4884c0%209.6744%207.32%2017.5346%2015.86%2017.5346h92.72c8.53%200%2015.85-7.8602%2015.85-17.5346Zm42.09-51.3954c0-20.5581%2015.86-38.093%2034.77-38.093H1520v22.9767h-121.38c-8.54%200-15.86%207.8605-15.86%2017.5349v13.3023H1520v22.9768h-137.24V90.093c0%209.6744%207.32%2017.535%2015.86%2017.535H1520v22.977h-127.48c-18.91%200-34.77-17.535-34.77-38.0934V38.093Z'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='a'%3e%3cpath%20fill='%23fff'%20d='M0%200h1520v130H0z'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
04 / MEDIA
Conversations
& transmissions.
FEATURED RECORDING · YOUTUBE
Hacking the Status Quo
Leading women in cybersecurity at Black Hat USA 2025.
Open on YouTube ↗︎
WATCH / VIDEO ARCHIVE
BLACK HAT ASIA · 2020Day One Locknote & Key Takeaways
CONFIDENCE 2019 · SAME TALK, FULL RECORDINGInto the Fog: The Return of ICEFOG APT
BLACK HAT ASIA · 2018Nation-State Moneymule’s Hunting Season
FIREEYE CYBER DEFENSE SUMMIT · 2019The Return of ICEFOG APT
TROOPERS · 2016Let’s Play Hide and Seek in the Cloud
INTERVIEWS / IN THE NEWS
THE HACKER NEWSRAVIE LAKSHMANAN · RESEARCH COVERAGE
UAT-10362 targets Taiwanese NGOs with LucidRook malware↗︎
THE HACKER NEWSRAVIE LAKSHMANAN · ROUTER RESEARCH
DKnife targets routers for traffic hijacking and malware delivery↗︎
DARK READINGELIZABETH MONTALBANO · PROFILE
Women Who “Hacked the Status Quo” talk security careers↗︎
COMPUTER WEEKLYALEX SCROXTON · APT41 COVERAGE
Chinese cyber attack sparks alert over six-year-old Microsoft vulnerability↗︎
CYBERSCOOPAJ VICENS · RESEARCH COVERAGE
Chinese-aligned group targeted government agencies across EMEA and Asia↗︎
BLEEPINGCOMPUTERBILL TOULAS · VULNERABILITY CREDIT
Google fixes fifth Chrome zero-day exploited in the wild that year↗︎
THE RECORDCATALIN CIMPANU · GOOGLE TAG
Google unmasks phishing and malware campaign targeting YouTube users↗︎
SKY NEWSTOM CHESHIRE · INTERVIEW
North Korea is hacking soaring Bitcoin exchanges, researchers say↗︎
EWEEKSEAN MICHAEL KERNER · INTERVIEW
Researcher provides insight into North Korea cyber-army tactics↗︎
05 / PODCASTS
Behind
the microphone.
12 EPISODES · 2020—2021 · 中文
MY ORIGINAL SERIES
我們與駭的距離The Hacks Between Us
I created this series to open up the world of hackers, threat research and practical security for a Mandarin-speaking audience.
資安工程師突然想開 podcast? 追駭客也是一種工作？GUEST CONVERSATIONS
07 / GALLERY
Public work,
in pictures.
08 / COMMUNITY
Giving back to the community.
HITCON GIRLS
Taiwan’s first information-security community for women.
RHACKLETTE
A Swiss security community for FINTA.
BLACK HAT
Reviewing and shaping security-research programming.
HITCON
Supporting strong technical content for Taiwan’s security community.
09 / EXPERIENCE
From regional signals
to global intelligence.
2023—NOW
CISCO TALOS
Security Research Engineering Technical Leader
Emerging threats, nation-state operations, financially motivated crime and spyware campaigns.
2026—NOW
PREVIOUS
THREAT ANALYSIS GROUP
Security Engineer
Hunted zero-day exploits used in the wild and tracked botnet activity.
PREVIOUS
'%20xlink:href='%23a'%20/%3e%3cuse%20transform='translate(138.83749,0)'%20xlink:href='%23n'%20/%3e%3cpath%20d='m%20288.53187,47.75%20-4.79999,0%200,-21.66%20-12,0%200,-3.78%2028.86,0%200,3.78%20-12.06001,0%200,21.66%20z'%20id='t'%20style='fill:%23960a2c'%20/%3e%3cpath%20d='m%20305.23936,18.50075%20-0.7525,0%200,1.4375%200.7525,0%20c%200.4075,0%200.70125,-0.05%200.87875,-0.15%200.17625,-0.10125%200.2675,-0.285%200.2675,-0.54875%200,-0.495%20-0.38125,-0.73875%20-1.14625,-0.73875%20m%200.11875,-0.41125%20c%201.1,0%201.6525,0.37125%201.6525,1.11%200,0.28125%20-0.0838,0.515%20-0.255,0.70875%20-0.16625,0.1875%20-0.3975,0.30375%20-0.6875,0.34125%20l%200.895,1.8475%20-0.695,0%20-0.84625,-1.7575%20-0.935,0%200,1.7575%20-0.59875,0%200,-4.0075%201.47,0%20z%20m%202.99625,2.07875%20c%200,-0.87875%20-0.295,-1.61125%20-0.88625,-2.2025%20-0.6125,-0.60875%20-1.34625,-0.9125%20-2.21625,-0.9125%20-0.8525,0%20-1.57125,0.2975%20-2.15875,0.8925%20-0.62125,0.62875%20-0.93625,1.36375%20-0.93625,2.21%200,0.8425%200.3075,1.57125%200.915,2.1825%200.60875,0.605%201.3375,0.90875%202.18,0.90875%200.84875,0%201.585,-0.3075%202.21625,-0.9225%200.59125,-0.5775%200.88625,-1.29625%200.88625,-2.15625%20m%20-3.1025,-3.495%20c%200.97625,0%201.805,0.3375%202.47375,1.01875%200.675,0.675%201.00875,1.4975%201.00875,2.46375%200,0.9725%20-0.33375,1.7875%20-1.00125,2.44%20-0.71,0.68125%20-1.535,1.02625%20-2.48125,1.02625%20-0.955,0%20-1.7725,-0.345%20-2.45375,-1.02625%20-0.6825,-0.67875%20-1.0225,-1.49%20-1.0225,-2.44%200,-0.94625%200.3475,-1.775%201.0425,-2.48%200.655,-0.66875%201.465,-1.0025%202.43375,-1.0025'%20id='(R)'%20style='fill:%23960a2c'%20/%3e%3c/svg%3e)
Global Research Team
Tracked APAC threat groups and co-authored major research on APT41 and ICEFOG.
FOUNDATION
TAIWAN
Co-founder & Senior Threat Analyst
Focused on targeted attacks, malware analysis and emerging cyber-espionage activity in APAC.
10 / OPEN CHANNEL
06 / SOCIAL MEDIA
Social
media.
Next Monday, I’ll be presenting research that @JulianVoeg and I worked on together at Day Zero 2026 in Las Vegas. See you in the desert! 🌵
LATEST VERIFIED ORIGINAL POST ↗︎Come get this super cool badge and see all the robots at the @RobotHackComm! #DC34
ROBOT HACKERS COMMUNITY · DEF CON 34 ↗︎Next Monday, I’ll be presenting research that @JulianVoeg and I worked on together at Day Zero 2026 in Las Vegas. See you in the desert! 🌵
@ashl3y_shenDay Zero Year 1 was a success! It was such an honor to present on the keynote stage this Monday at CrowdStrike’s first Day Zero Threat Research Summit. I really enjoyed the talks, the conversations, and the many people I had the chance to meet throughout the conference.
Chi En (Ashley) S.🔥 NEW research published: We uncover DKnife, a China-nexus gateway-monitoring framework that intercepts network traffic and delivers malware via routers and edge devices.
@ashl3y-shen.bsky.socialDay Zero Year 1 was a success! It was such an honor to present on the keynote stage this Monday at CrowdStrike’s first Day Zero Threat Research Summit. I really enjoyed the talks, the conversations, and the many people I had the chance to meet throughout the conference.
LINKEDIN · OWN POST, NOT A REPOST ↗︎