Loading threat actor…
SneakyChef is a China-based cyberespionage threat actor active since at least August 2023. It has targeted government entities across Asia and Europe, the Middle East, and Africa (EMEA), including operations involving SugarGh0st malware. SneakyChef has also been linked to SpiceRAT, a remote-access trojan capable of downloading and executing binaries and arbitrary commands. Its activity is assessed as espionage-oriented and focused on government targets.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
1 indicator attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a previously identified China-linked activity cluster associated with SpiceRAT overlap relevant to SilkParasite attribution context.
Referenced only because SpiceRAT has been attributed to this actor, serving as background context for SilkParasite attribution.
China-based espionage group publicly linked by Cisco Talos to SpiceRAT. The article does not attribute SilkParasite itself to SneakyChef.
CTI Roundup: Busy Days for Threat Actors ONNX Store, Boolka, & SneakyChef | Tanium
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.