Threat actor

CTG-5938

Updated 8 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVEs0Associated

Malware7Families

ATT&CK0Techniques

IOCs0Tracked

Motivation: —

Also known asCTG-5938

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

Malware

Associated malware families

7 malware families Mallory has associated with this actor across public reporting.

FamilyContextEvidenceLast seen

ChChesTools QuasarRAT, RedLeaves, PoisonIvy, ChChes, QuasarRAT Loader, PlugX, ANEL, Cobalt Strike1Mar 18, 2026 Cobalt StrikeThird party reporting also suggests that the group has adopted tools including the ANEL backdoor and Cobalt Strike.1Mar 18, 2026 PlugXTools QuasarRAT, RedLeaves, PoisonIvy, ChChes, QuasarRAT Loader, PlugX, ANEL, Cobalt Strike1Mar 18, 2026 Poison IvyTools QuasarRAT, RedLeaves, PoisonIvy, ChChes, QuasarRAT Loader, PlugX, ANEL, Cobalt Strike1Mar 18, 2026 QuasarRATTools QuasarRAT, RedLeaves, PoisonIvy, ChChes, QuasarRAT Loader, PlugX, ANEL, Cobalt Strike1Mar 18, 2026

2 additional families tracked in Mallory.

Activity feed

Recent activity

No public activity tracked yet. Mallory keeps watching.

View more in app →

No public activity observed for this threat actor.

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what's public. Mallory adds the parts that aren't: whether this actor's tooling has touched your footprint, the IOCs they're burning right now, and the detections to deploy next.

Start Free Trial Open in App ↗

Target overlapMatch sector + geo + tech-stack targeting against your real footprint.

Tradecraft mappingMITRE ATT&CK techniques reported for this actor, grouped by tactic.

Associated malware7Families linked to this actor, with IOCs and behavior.

Associated CVEsCVEs linked to this actor, with the reporting behind each link.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

ObservablesDomains, IPs, and hashes tied to this actor, refreshed continuously.

Threat actor

CTG-5938

Updated 8 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVEs0Associated

Malware7Families

ATT&CK0Techniques

IOCs0Tracked

Motivation: —

Also known asCTG-5938

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

Malware

Associated malware families

7 malware families Mallory has associated with this actor across public reporting.

FamilyContextEvidenceLast seen

2 additional families tracked in Mallory.

Activity feed

Recent activity

No public activity tracked yet. Mallory keeps watching.

View more in app →

No public activity observed for this threat actor.

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what's public. Mallory adds the parts that aren't: whether this actor's tooling has touched your footprint, the IOCs they're burning right now, and the detections to deploy next.

Start Free Trial Open in App ↗

Target overlapMatch sector + geo + tech-stack targeting against your real footprint.

Tradecraft mappingMITRE ATT&CK techniques reported for this actor, grouped by tactic.

Associated malware7Families linked to this actor, with IOCs and behavior.

Associated CVEsCVEs linked to this actor, with the reporting behind each link.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

ObservablesDomains, IPs, and hashes tied to this actor, refreshed continuously.