Loading threat actor…
Cybercriminals are financially motivated malicious actors that conduct a broad range of opportunistic and targeted intrusions for theft, fraud, and unauthorized access. Reported activity includes software supply chain compromise through poisoned dependencies aimed at .NET cryptocurrency developers, resulting in theft of digital assets, as well as phishing-led malware delivery using cache smuggling techniques that place payloads in browser cache to evade traditional download-based detections. Cybercriminal operations have also incorporated generative AI to improve the scale and credibility of phishing, social engineering, reconnaissance, and basic malware-development workflows. Observed uses of AI include crafting convincing lures, automating malicious tasks, gathering open-source intelligence on targets, and assisting with scripting and code debugging. In the cited activity, targeting centered on cryptocurrency developers and theft of assets rather than espionage or destructive outcomes.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
27 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cybercriminals conducted a supply chain attack by distributing poisoned dependencies, specifically targeting .NET crypto developers through fake package downloads.
Cybercriminals are leveraging a new phishing attack technique called cache smuggling to deliver zero-download malware payloads via the browser cache.
Cybercriminals are using generative AI tools to enhance phishing campaigns, automate malicious activities, and assist in malware development. They are also developing and selling tools that aid in vulnerability research, reconnaissance, and exploit writing. Their use of AI is expected to continue growing, with increased automation and sophistication in attacks.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.