Loading threat actor…
Meteor is a destructive malware family associated with data destruction and system recovery inhibition rather than conventional espionage or financially motivated ransomware operations. It has been observed using native Windows administrative utilities to impair recovery on compromised systems, including deleting boot identifiers with BCDEdit and removing Volume Shadow Copies through built-in tools such as VSSAdmin and WMIC. These actions are consistent with anti-recovery and destructive post-compromise behavior intended to make restoration more difficult after impact on the victim environment. High-confidence reporting in the available evidence supports Meteor’s use of recovery-inhibition techniques, but does not establish broader targeting patterns, geographic attribution, or a fuller operational profile.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.