Loading threat actor…
Greedy Sponge is a financially motivated cybercrime group associated with campaigns targeting organizations in Mexico. It has been linked to malspam operations delivering AllaKore RAT and SystemBC, indicating an intrusion set focused on malware-enabled initial access and follow-on remote control of compromised systems. Reported activity suggests a crimeware-oriented operator using email-based social engineering to gain footholds and deploy commodity or widely available malware for post-compromise access and potential data theft or broader criminal monetization. No high-confidence evidence in the available reporting supports ransomware operations, nation-state sponsorship, or a broader victimology beyond Mexican organizations.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
5 malware families attributed to this actor across reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Financially motivated group targeting Mexican organizations; delivers modified AllaKore RAT and SystemBC; associated with PureRAT and Hijack Loader proliferation per the referenced report title/summary.
Financially motivated activity targeting Mexico using malspam to deliver remote access tooling.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.