Loading threat actor…
Void Banshee is an advanced persistent threat group targeting organizations and individuals in North America, Europe, and Southeast Asia for information theft and financial gain. Its documented 2024 campaigns deployed the Atlantida information stealer by chaining the Windows MSHTML vulnerabilities CVE-2024-38112 and CVE-2024-43461 before they were patched. The group distributed malicious internet shortcuts disguised as PDF books through spearphishing links, cloud-sharing services, Discord, online libraries, and compromised websites. Exploitation invoked the disabled Internet Explorer component rather than a modern browser, while deceptive filename presentation concealed the executable nature of malicious HTML applications and encouraged victims to open them. Void Banshee's multistage infection chain used VBScript, PowerShell, an obfuscated .NET loader, and Donut shellcode to execute Atlantida in memory through injection into a legitimate .NET utility process. Defense-evasion measures included encrypted script content, loader obfuscation, hidden console windows, and manipulation of browser windows. Atlantida harvested browser passwords and authentication cookies, cryptocurrency wallet and extension data, messaging and gaming application data, file-transfer connection information, desktop documents, screenshots, and system information. Collected information was compressed into an archive and exfiltrated to attacker-controlled infrastructure.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
17 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
4 malware families attributed to this actor across reporting.
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
CVE-2024-38112 was used as part of an attack chain by the advanced persistent threat (APT) group Void Banshee. The threat actor leveraged the vulnerability to execute malicious code by abusing the MHTML protocol handler and x-usc directives through internet shortcut (URL) files.
The HTA files utilized a different zero-day tracked as CVE-2024-43461 to hide the HTA file extension and make the file appear as a PDF when Windows prompted users as to whether it should be opened.
7 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Void Banshee is known for exploiting MSHTML spoofing vulnerabilities to deliver the Atlantida Stealer malware.
Referenced as having exploited a Windows MSHTML (Internet Explorer engine) zero-day (CVE-2024-38112) in the wild; the article suggests CVE-2024-43573 may be similar and notes prior use of multiple MSHTML flaws in the same attack set.
Financially motivated group conducting information-stealing malware campaigns targeting various sectors, including financial, technology, and government organizations, primarily for data theft and financial gain.
An APT group targeting organizations in North America, Europe, and Southeast Asia for data theft and financial gain. The reported campaign chained two Windows zero-day vulnerabilities to deceive users into opening malicious HTA files and install the Atlantida information stealer, which steals passwords, authentication cookies, and cryptocurrency wallets.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.