Loading threat actor…
The March 23 Movement (M23) is an armed insurgent group operating in eastern Democratic Republic of the Congo, principally in North Kivu and South Kivu. It emerged in 2012 following the collapse of arrangements to integrate members of the National Congress for the Defense of the People into the Congolese armed forces, and resumed major operations in 2021 after a prolonged period of relative inactivity. M23 has fought the Armed Forces of the Democratic Republic of the Congo and allied armed groups, seized and administered territory, controlled strategic transport routes and border crossings, and established local taxation and permit systems. M23 has controlled mineral-rich areas, including the Rubaya mining region, and derives operational resources from exploitation and taxation of mineral extraction and trade, as well as local businesses and transportation. Its activities have affected critical-mineral supply chains involving coltan, tantalum, cobalt, and other minerals. The group has also been associated with efforts to influence the information environment through social-media and messaging-platform disinformation, including material intended to shape perceptions of the conflict and facilitate recruitment. M23 has faced allegations of disrupting navigation signals, interfering with telecommunications infrastructure, and manipulating or bypassing mineral-traceability processes in areas under its physical control. Rwanda has repeatedly been accused by Congolese, United Nations, and foreign-government representatives of supporting M23; Rwanda denies these allegations.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An eastern DRC insurgent group combining territorial control and conflict-mineral exploitation with GPS interference, social-media disinformation, and manipulation or bypass of digital mineral-traceability data. It finances operations through coercive taxation, illicit mineral trade, and trade-based money laundering.
Armed rebel group operating in eastern Democratic Republic of the Congo, controlling key defensive positions and affecting regional security dynamics tied to critical minerals competition.
Armed rebel movement active in eastern DRC, engaged in clashes with Congolese government and allied forces, controlling territory and strategic assets such as the Rubaya mine, participating in ceasefire and peace-talk processes, and accused of looting, taxation at roadblocks, and interference with telecommunications infrastructure.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.