Threat actor

Moonscape

Updated 4 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVEs0Associated

Malware2Families

ATT&CK0Techniques

IOCs0Tracked

Motivation: —

Also known asmoonscape

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

Arsenal

Associated malware families

2 malware families attributed to this actor across reporting.

FamilyContextEvidenceLast seen

LibCMDThese variants of the malware also contain another embedded .NET DLL, internally referred to as LibCMD from the original filename LibCMD.dll... This is a small file, whose purpose is simply to start cmd.exe and connect to stdin/stdout. The file contains a tampered PE link timestamp. It is never saved to disk; instead, it is loaded dynamically in memory as a .NET assembly and executed.1Jun 14, 2026 PicassoLoaderAnalysis of Dwnldr.dll shows that it is a DLL file with a .NET assembly embedded inside. The file is protected with ConfuserEx... The DLL file hosts a payload that appears to be a simplified variant of PicassoDownloader, a malware family also linked to Ghostwriter activity... Analysis of techniques used by threat actors can often be helpful in establishing the origin of the attack and the malware it uses. In this case... allowing us to establish a medium confidence link between them and a malware cluster known as PicassoLoader, a downloader toolkit.1Jun 14, 2026

Activity feed

Recent activity

No public activity tracked yet. Mallory keeps watching.

View more in app →

No public activity observed for this threat actor.

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what's public. Mallory adds the parts that aren't: whether this actor's tooling has touched your footprint, the IOCs they're burning right now, and the detections to deploy next.

Start Free Trial Open in App ↗

Target overlapMatch sector + geo + tech-stack targeting against your real footprint.

Tradecraft mappingEvery observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal2Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEsCVEs this actor has used in known campaigns.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

ObservablesDomains, IPs, and hashes tied to this actor, refreshed continuously.

Threat actor

Moonscape

Updated 4 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVEs0Associated

Malware2Families

ATT&CK0Techniques

IOCs0Tracked

Motivation: —

Also known asmoonscape

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

Arsenal

Associated malware families

2 malware families attributed to this actor across reporting.

FamilyContextEvidenceLast seen

Activity feed

Recent activity

No public activity tracked yet. Mallory keeps watching.

View more in app →

No public activity observed for this threat actor.

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what's public. Mallory adds the parts that aren't: whether this actor's tooling has touched your footprint, the IOCs they're burning right now, and the detections to deploy next.

Start Free Trial Open in App ↗

Target overlapMatch sector + geo + tech-stack targeting against your real footprint.

Tradecraft mappingEvery observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal2Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEsCVEs this actor has used in known campaigns.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

ObservablesDomains, IPs, and hashes tied to this actor, refreshed continuously.