Loading threat actor…
COMpfun is a malware cluster associated with espionage activity and assessed with medium-to-low confidence to be linked to the Russia-aligned Turla advanced persistent threat. Activity tied to COMpfun has targeted diplomatic bodies in Europe and has used themed lure documents such as spoofed visa applications for delivery. Related tooling includes a Trojan with strong code similarities to COMpfun and malware exhibiting overlapping code with Reductor. Observed COMpfun-related malware supports host and network reconnaissance, keylogging, screenshot capture, and collection of system location data. It also monitors removable media and can infect USB devices to facilitate propagation. Command-and-control tasking has been implemented through encoded HTTP status codes, reflecting an emphasis on covert control and defense evasion. The cluster is best characterized as a cyber-espionage capability set focused on diplomatic targets, with post-compromise surveillance, data collection, and stealthy persistence-oriented tradecraft rather than financially motivated operations.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.