Loading threat actor…
Alibaba2044 is a threat actor associated with a malicious spam campaign targeting users in Italy on December 14, 2022. The campaign distributed PureLogs, a commercial .NET information stealer developed by the separate actor PureCoder. Alibaba2044's geographic origin, organizational affiliations, and sector-specific targeting are not established. The campaign used emails linking to password-protected ZIP archives, with the password supplied in the message. The archives contained a Windows Cabinet file disguised as a batch file. Opening this stage dropped and executed a .NET loader that decrypted an embedded payload in memory and loaded PureLogs through .NET reflection. This delivery chain used archive protection, file-type masquerading, and encrypted payloads to conceal the malware. PureLogs supports collection and exfiltration of browser passwords, cookies, browsing history, autofill information, cryptocurrency-wallet data, and application credentials and tokens. Its targets include messaging, email, gaming, and VPN applications. The campaign also incorporated system-information discovery, file and directory discovery, and automated data collection.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
12 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
1 malware family Mallory has associated with this actor across public reporting.
12 indicators attributed to this actor. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.