| ID | Votes | Profile Description |
|---|---|---|
| Carberp | 1 | Carberp is a notable malware that has been widely used and modified by various threat actors. Its source code, which was leaked in 2013, has become the basis for a multitude of other malicious software due to its sophisticated design and capabilities. The malware can infiltrate systems through dubio |
| ID | Type | Votes | Profile Description |
|---|---|---|---|
| ADVSTORESHELL | Unspecified | 1 | None |
| JHUHUGIT | Unspecified | 1 | Jhuhugit is a type of malware that was used in Sofacy attacks as a first-stage implant. It became relatively popular and was also used with a Java zero-day in July 2015. The Sofacy group, which utilized jhuhugit, expanded their arsenal in 2013 by adding more backdoors and tools, including CORESHELL, |
| Splm | Unspecified | 1 | SPLM, also known as XAgent or CHOPSTICK, is a sophisticated malware variant deployed by the Sofacy group. The group, notorious for its cyber espionage campaigns, expanded its arsenal in 2013, adding SPLM among other backdoors and tools such as CORESHELL, JHUHUGIT, AZZY, and more. These campaigns hav |
| Azzy | Unspecified | 1 | Azzy is a malware implant developed by the Sofacy group, known for its malicious activities aimed at exploiting and damaging computer systems. Earlier this year, we identified a new release of the Azzy implant that was largely undetected by anti-malware products at the time. This version first appea |
| XTunnel | Unspecified | 1 | XTunnel is a type of malware used by threat groups to gain secure access to compromised environments through a back connection created by the malware to a command and control (C2) server. IRON TWILIGHT, a known threat group, installed XTunnel as a Coreshell child process on an already compromised sy |
| ID | Type | Votes | Profile Description |
|---|---|---|---|
| Sofacy | Unspecified | 1 | Sofacy is a threat actor group that has been observed using multiple languages to create variants of the Zebrocy Trojan and Cannon. In one campaign, they relied heavily on filenames to lure victims into launching weaponized documents. The group packed only Delphi variants in an attempt to increase e |
| Sofacy Group | Unspecified | 1 | The Sofacy Group, also known as APT28, Fancy Bear, Pawn Storm, Sednit, BlueDelta, and STRONTIUM, is a significant threat actor in the global cybersecurity landscape. Active since at least 2007, this group has targeted governments, militaries, and security organizations worldwide. The group's activit |
| APT28 | Unspecified | 1 | APT28, also known as Fancy Bear, is a threat actor linked to Russia and has been involved in numerous cyber espionage campaigns. The group is notorious for its sophisticated tactics, techniques, and procedures (TTPs). Recently, NATO and the EU formally condemned APT28's activities, acknowledging the |
| IRON TWILIGHT | Unspecified | 1 | IRON TWILIGHT is a threat actor believed to be associated with the GRU, Russia's military intelligence agency. This association has been suggested by various researchers, including those from CrowdStrike and CTU, based on the characteristics of the group's activities. The group became particularly a |
| ID | Type | Votes | Profile Description |
|---|---|---|---|
No associations to display |