Loading threat actor…
th3bug is a Poison Ivy-linked intrusion cluster identified through shared malware configuration and infrastructure patterns in targeted attacks observed between 2008 and 2013. The cluster is associated with the use of the Poison Ivy remote access trojan and appears to have favored strategic web compromises, including watering-hole style operations that leveraged browser and Java exploits, rather than relying primarily on spear-phishing. Reported victimology indicates broad multi-sector targeting with a preference for higher education and health care organizations. Through Poison Ivy, the activity set is associated with capabilities including initial access, persistence, keylogging, credential theft, post-exploitation, and exfiltration. The designation refers to a campaign cluster rather than a formally attributed nation-state unit, and high-confidence public attribution to a specific government or country is not established from the available facts.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
6 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
18 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.