Loading threat actor…
cyb0rg is an unaffiliated threat actor publicly associated with the leak of data reportedly originating from the North Korea-linked Kimsuky espionage group. Public reporting identifies cyb0rg alongside another actor, Saber, in connection with the exposure of that material. No high-confidence evidence is available here to attribute cyb0rg to a specific country, define a stable organizational structure, identify consistent victimology, or characterize a broader operational toolkit, intrusion lifecycle, or long-term campaign history. Based on the available facts, cyb0rg is best described as a distinct actor involved in the public disclosure of allegedly stolen or leaked data tied to a known state-linked espionage ecosystem, but with insufficient corroborated detail to assess whether the actor is primarily an intrusion operator, broker, hacktivist, or data-leak facilitator.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.