Loading threat actor…
Striker is a financially motivated cybercriminal operator associated with the Striker C2 framework and later linked to trojanized software distribution using signed remote-access payloads. The actor has been tied to infrastructure overlap with the GeorgeGinx/Striker cluster and the online handle "calipology." Activity attributed to Striker includes distribution of weaponized RustDesk installers masquerading as legitimate software, indicating an evolution from command-and-control framework operations into broader malware-enabled intrusion activity. Observed tradecraft includes initial access through trojanized software, use of remote access tooling for post-compromise control, and defense evasion through code signing. The actor has used signed payloads to increase trust and reduce user suspicion, and has operated exposed multi-service infrastructure consistent with active command-and-control and broader criminal operations. Reporting also noted a management panel suggestive of adjacent crypto-related fraud or bot-management activity, but that aspect is less certain than the malware distribution and C2 linkage. High-confidence attribution supports Striker as a cybercrime actor rather than a state-sponsored group. No specific victim geography or sector concentration is established at high confidence from the available facts.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
12 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.