Loading threat actor…
BadRory is an as-yet unattributed advanced persistent threat cluster identified in attacks against organizations in Russia beginning in late 2022. The activity is characterized by spear-phishing emails carrying Microsoft Office document attachments and a multi-stage infection chain that deploys a custom Trojan. The malware is designed to exfiltrate files and execute arbitrary commands on compromised systems, indicating an espionage-oriented objective with post-compromise remote tasking capability. Observed activity included two principal waves in October 2022 and April 2023. Victims included government entities, military contractors, universities, and hospitals in Russia, suggesting broad but selective targeting across public sector, defense-related, academic, and healthcare environments. The intrusion pattern reflects initial access via phishing, followed by staged malware delivery and post-exploitation actions centered on data theft and remote command execution. BadRory has not been confidently linked to any previously known threat actor, and no confirmed sub-groups or alternative widely used aliases are established beyond the campaign name itself.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.