NineBlog is a cyber threat actor first publicly documented by FireEye in August 2013, though observed activities date back to late 2012. The group is assessed with high confidence to be of Chinese origin. Its primary motivation is cyber espionage, with a specific focus on acquiring financial data and compromising government administration. NineBlog distinguishes itself through its consistent use of sophisticated social engineering tactics combined with encoded Visual Basic scripts to bypass security measures and achieve its objectives. The group has been observed targeting organizations across South Asia, Southeast Asia, and the Middle East.