Loading threat actor…
Rhadamanthys is a cybercriminal infostealer malware operation associated with credential theft and data exfiltration. It has been significant enough to be targeted by Europol-led Operation Endgame, which disrupted infrastructure used by Rhadamanthys alongside VenomRAT and the Elysium botnet. Publicly available facts in this context support Rhadamanthys as a malware service or criminal operation involved in stealing information from compromised systems, but do not provide high-confidence attribution to a specific country, operator identity, victim geography, or industry focus. Known naming in this context is limited to Rhadamanthys.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Rhadamanthys is a malware family used for credential theft and botnet operations, supporting cybercrime infrastructure for remote access and data theft.
Rhadamanthys is an infostealer malware used to steal credentials and sensitive information from victims, which can then be used for further attacks such as ransomware or cryptocurrency theft.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.