Loading threat actor…
Reddot is referenced as a ransomware threat actor associated with malicious script execution through Windows Script Host, specifically the use of encoded JScript via COM-based execution to run attacker-controlled code. Reported tradecraft includes abusing script interpreters for execution, potential evasion of security controls such as AMSI bypass or disablement, and follow-on actions that can support persistence. The available information directly supports only a limited characterization of Reddot as a ransomware-associated actor tied to script-based execution and defense-evasion behavior; no high-confidence attribution, victimology, geographic origin, or broader operational profile is established from the available facts.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.