Loading threat actor…
FusionCore is a financially motivated malware-as-a-service and hacker-for-hire group founded in 2022 by the malware developer Hydra. It develops and sells information stealers, ransomware, remote-access trojans, cryptocurrency miners, crypters, and droppers, and provides malware-distribution services. Its AnthraXXXLocker ransomware affiliate program supplies ransomware and victim-management software. Known associates include NecroSys, developer of SarinLocker, Typhon Stealer, Kratos Dropper, and Ambien RAT; DanielNusradin, developer of the RootFinder malware family; InsaniumDev, developer of GoldenMine; and SysKey, an administrator and malware developer. FusionCore's malware portfolio includes Typhon-R Stealer, RootFinder Stealer, RootFinder RAT, RootFinder Ransomware, Cryptonic Crypter, GoldenMine, ApolloRAT, SarinLocker, and Strontium Stealer. Its malware is primarily developed in C++, C#, and Go. Product instructions and accessible builders lower the technical expertise required by customers. Target selection largely depends on customers and affiliates; reported targets include Lindesberg Municipality in Sweden and an information-security company in Asia Pacific. Phishing is its principal documented initial-access vector. Its information stealers collect passwords, browser cookies, autofill records, payment information, browsing history, and system and network information. Strontium Stealer additionally supports keylogging and desktop screenshots. Associated malware uses startup-folder persistence, obfuscation, sandbox and debugger checks, security-tool interference, self-deletion, and encrypted command-and-control communications. Stolen information can be transmitted through Telegram bots. Its ransomware encrypts victim files, while SarinLocker also deletes volume shadow copies to inhibit recovery and can erase decryption keys from memory to complicate forensic recovery. GoldenMine uses NBMiner and XMRig for unauthorized CPU and GPU cryptocurrency mining.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
17 malware families attributed to this actor across reporting.
12 additional families tracked in Mallory.
20 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as another malware-as-a-service operator in introductory background. The report provides no specific campaign, malware family, victim, geographic attribution, or operational technique for FusionCore.
Founded in 2022, FusionCore develops and sells information stealers, remote-access trojans, ransomware, cryptocurrency miners, crypters and droppers. It operates malware-as-a-service and hacker-for-hire businesses, provides malware-distribution services, and runs the AnthraXXXLocker ransomware affiliate program. Phishing is identified as its primary initial-access vector. Reported targets include Lindesberg Municipality in Sweden and an unnamed information-security company in Asia Pacific; broader targeting depends on customers and affiliates. The report assesses European operations with medium confidence but does not establish a specific source country or state sponsor. Some capabilities, including claims of undetectability, are vendor claims by the malware operators rather than independently established findings. VIPERA ransomware was announced as forthcoming, while LockBit 3.0 was used in a Cryptonic demonstration rather than a documented FusionCore ransomware attack.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.