Loading threat actor…
Hancitor is a malware operation and access-enablement threat actor best known for distributing malicious spam at scale to deliver malware and provide initial access to downstream criminal partners. It has been associated with phishing campaigns using themed lures such as business-document and e-signature notifications to compromise victims and establish footholds in corporate environments. Hancitor has been referenced as a spam-operator partner for other financially motivated intrusion sets, including use in campaigns that enabled Cuba ransomware access to enterprise networks through phishing emails. Based on available reporting, Hancitor’s most clearly supported role is large-scale initial access via malspam rather than operation of a ransomware brand itself. Its observed tradecraft includes phishing-based delivery and intrusion enablement for follow-on activity by partner groups. The available facts here do not directly support more specific attribution to a country of origin, a broader victim geography, or a fuller capability set beyond initial access through spam-driven phishing campaigns.
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
3 malware families Mallory has associated with this actor across public reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.