Loading threat actor…
Angryrebel is a named threat actor entry for which the available information does not provide corroborated attribution, operational history, victimology, tooling, or tradecraft specific to the actor itself. Although the name appears alongside numerous unrelated threat actor and malware references, no high-confidence facts establish Angryrebel’s origin, affiliations, targets, sectors, capabilities, or motivation. As a result, Angryrebel should presently be treated as an unresolved or insufficiently documented actor label pending reliable reporting that distinguishes it from other clusters or aliases.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
74 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as a threat actor observed in the broader ecosystem of exploitation activity around React/Next.js RSC vulnerabilities (React2Shell/CVE-2025-55182 and related CVEs) in the report’s aggregated 'Threat Details and IOCs' section.
Listed as one of multiple threat actors associated (in the report’s aggregation) with exploitation activity around React2Shell (CVE-2025-55182) and related campaigns/payload delivery.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.