Loading threat actor…
GroupCC is an APT41-related threat cluster associated with Cobalt Strike operations and command-and-control concealment. It uses Fastly's content delivery network to obscure the underlying addresses of command-and-control servers, including through a Python-based implementation. Its Cobalt Strike payloads share watermark and public-key metadata with Earth Baku and Earth Longzhi, two other APT41-related groups. GroupCC also shares a subtraction-and-XOR decryption algorithm pattern with Earth Longzhi's Symatic and CroxLoader malware loaders. These technical overlaps support its association with the broader APT41 ecosystem; Earth Baku and Earth Longzhi are related groups rather than established aliases of GroupCC.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
1 indicator attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An APT41-related group cited as a historical comparison for the use of Fastly CDN in attacker infrastructure. No participation in the Earth Estries campaign is established.
Mentioned as an APT41-related activity cluster previously observed using Fastly CDN to obscure C2 infrastructure, similar to infrastructure-hiding observed in this report.
A group believed to be an APT41 subgroup that shares Cobalt Strike metadata, loader decryption routines, and Fastly CDN-based C2 concealment tradecraft with Earth Longzhi.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.