legion
Legion is described in the provided content in two contexts: as a cloud infostealer/cloud attack tool family, and as a pro-Russian criminal or hacktivist group linked to disruptive activity. In the malware context, Legion is grouped with AlienFox, GreenBot, and Predator as a cloud attack tool or malware family that shares Androxgh0st-derived code. It is characterized as a cloud infostealer with functional and design similarities to FBot, and the content assesses that the Legion maintainer may have adapted code from FBot. Related samples reportedly used the robertkalinkin.com website to authenticate PayPal API requests. In the geopolitical context, the content mentions a 'Legion Hacktivist Group' and states that Norway's National Security Authority previously linked a pro-Russian group known as Legion to DDoS attacks that disrupted important websites and online services. Based on the provided content alone, Legion is associated with cloud credential theft/account abuse tooling and, separately, with pro-Russian disruptive DDoS activity; the relationship between these references is not established in the source material.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Software & Services
- Financial Services
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cloud infostealer related to FBot, sharing similar functionality for scraping URLs for PHP configuration and targeting cloud/service credentials.
Legion is a pro-Russian criminal group known for conducting DDoS attacks against important websites and online services, disrupting operations as part of broader Russian-aligned cyber activities.
Legion Hacktivist Group
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.