3 malware familiesExploits CVEs in the wild

admin@338

Also known asadmin@338

admin@338 is a threat actor tracked under the name admin@338. The provided content associates the group with spearphishing using malicious Microsoft Office, including Microsoft Word, attachments and attempts to get victims to launch those files. The actor is also described as exploiting client software vulnerabilities for execution, specifically Microsoft Word CVE-2012-0158. Post-compromise activity in the content is tied to LOWBALL malware, after which admin@338 used Windows command shell commands to execute follow-on actions, including creating a file containing a list of commands to run on the compromised host, renaming a tool to audiodg.exe for masquerading, collecting operating system information with ver and systeminfo, collecting local network configuration with ipconfig /all, obtaining information about services with net start, and gathering information about files and directories. The content maps admin@338 to ATT&CK techniques including Windows Command Shell, Malicious File Execution, and System Network Configuration Discovery.

Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial

MITRE ATT&CK

Tradecraft

29 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

5 of 15 tactics33 techniques×N= number of intelligence reports citing this technique

MITRE ATT&CK

TA0001

Initial Access

1 technique

T1566

Phishing

T1566.001×23

Spearphishing Attachment

T1566.002×4

Spearphishing Link

TA0002

Execution

4 techniques

T1059×3

Command and Scripting Interpreter

T1059.001×2

PowerShell

T1059.003×4

Windows Command Shell

T1129

Shared Modules

T1203×5

Exploitation for Client Execution

T1204

User Execution

T1204.001

Malicious Link

T1204.002×11

Malicious File

TA0004

Privilege Escalation

1 technique

T1068

Exploitation for Privilege Escalation

TA0005

Stealth

3 techniques

T1036×2

Masquerading

T1036.005

Match Legitimate Resource Name or Location

T1036.008

Masquerade File Type

T1218

System Binary Proxy Execution

T1218.011

Rundll32

T1564

Hide Artifacts

T1564.006

Run Virtual Instance

TA0007

Discovery

10 techniques

T1007

System Service Discovery

T1016×6

System Network Configuration Discovery

T1018

Remote System Discovery

T1046

Network Service Discovery

T1049×2

System Network Connections Discovery

T1069

Permission Groups Discovery

T1069.001×4

Local Groups

T1069.002

Domain Groups

T1082×11

System Information Discovery

T1083×5

File and Directory Discovery

T1087

Account Discovery

T1087.001×2

Local Account

T1087.002×2

Domain Account

T1482

Domain Trust Discovery

ARSENAL

Associated malware families

3 malware families attributed to this actor across reporting.

FamilyContextEvidenceLast seen

LOWBALLactors used the following command following exploitation of a machine with LOWBALL malware to obtain information about services: net start >> %temp%\download6Mar 18, 2026

BUBBLEWRAPWe observed the threat group upload a second stage malware, known as BUBBLEWRAP (also known as Backdoor.APT.FakeWinHTTPHelper) to their Dropbox account...1Mar 8, 2026

Poison Ivy...typically using publicly available RATs such as PoisonIvy...1Mar 8, 2026

WEAPONIZED

Associated vulnerabilities

2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.

CVE-2012-0158MSCOMCTL.OCX ListView/TreeView ActiveX Remote Code ExecutionIn the wildEvidence3

...has exploited client software vulnerabilities for execution, such as Microsoft Word CVE-2012-0158...

CVE-2025-9491Microsoft Windows LNK File UI Misrepresentation Remote Code Execution VulnerabilityIn the wildEvidence2

This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.

IOCS

Observables

41 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.

41 IOCsView more in app

IOC values are gated. View more in Mallory for domains, IPs, hashes, and other artifacts, or pipe them straight into your SIEM.

ACTIVITY FEED

Recent activity

20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

20 SOURCESView more in app

splunk researchNews

Apr 13, 2026

Detection: Windows Remote Image Load | Splunk Security Content

Listed as a threat actor associated with the remote image load detection analytic; no actor-specific activity details are provided.

splunk researchNews

Apr 13, 2026

Detection: Windows Binary Execution from an Archive | Splunk Security Content

Listed as a threat actor associated with the malicious file execution technique detected by this analytic.

splunk researchNews

Apr 13, 2026

Detection: Windows WinPEAS PowerShell Script Execution | Splunk Security Content

Listed as a threat actor associated with WinPEAS-related post-exploitation/reconnaissance activity in the detection metadata.

splunk researchNews

Apr 13, 2026

Detection: Windows Suspicious QEMU Execution | Splunk Security Content

Listed as a threat actor associated with the observed use of QEMU and the -nographic flag to install a rogue Linux virtual machine for persistence and initial access.

+131 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.

Start free trial

Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping29

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal3

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs2

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables41

Domains, IPs, and hashes tied to this actor, refreshed continuously.