Sowbug
Sowbug is a threat actor tracked in the provided content under the name Sowbug. The content associates Sowbug with credential access, execution, discovery, and collection activity. Specifically, Sowbug has used the Windows command line during intrusions, including Windows Command Shell activity (T1059.003). It has masqueraded tools as legitimate Windows or Adobe Reader software, including use of the filename adobecms.exe and the directory CSIDL_APPDATA\microsoft\security. For discovery, Sowbug obtained victim OS version and hardware configuration (T1082), performed file and directory discovery (T1083), and is associated with network share discovery (T1135). For collection, Sowbug identified and extracted Word documents from a file server, including by using commands containing *.doc and *.docx and by searching for documents within a specific date range, then bundled extracted documents into a RAR archive. The content also associates Sowbug with credential access techniques including unsecured credentials (T1552) and OS credential dumping (T1003). No additional aliases or sub-groups beyond "sowbug" are directly provided in the content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
21 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a threat actor associated with the Network Share Discovery technique (T1135).
Listed as a threat actor associated with Windows Command Shell execution behavior relevant to this detection.
Referenced as a threat actor associated with credential access behavior, specifically techniques involving unsecured credentials and OS credential dumping in the context of LAPS password gathering via PowerShell.
Listed as a threat actor associated with WinPEAS-related post-exploitation/reconnaissance activity in the detection metadata.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.