Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
Back to threat actors

ARToken

Also known asARToken
Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial
OPERATIONAL PROFILE

Targeting

Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.

Who they target

Sectors the actor has been observed targeting.

  • Pharmaceuticals, Biotechnology & Life Sciences
  • Financial Services
  • Transportation

Where they target

Geographies tied to known operations.

  • 🇺🇸 United States
MITRE ATT&CK

Tradecraft

12 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

10 of 15 tactics22 techniques×N= number of intelligence reports citing this technique
MITRE ATT&CK
TA0042
Resource Development
1 technique
T1583
Acquire Infrastructure
T1583.006
Web Services
TA0001
Initial Access
1 technique
T1566
Phishing
T1566.002×2
Spearphishing Link
TA0003
Persistence
1 technique
T1098
Account Manipulation
T1098.001
Additional Cloud Credentials
T1098.002
Additional Email Delegate Permissions
TA0004
Privilege Escalation
1 technique
T1098
Account Manipulation
T1098.001
Additional Cloud Credentials
T1098.002
Additional Email Delegate Permissions
TA0005
Stealth
3 techniques
T1027
Obfuscated Files or Information
T1036
Masquerading
T1497
Virtualization/Sandbox Evasion
T1497.001
System Checks
TA0006
Credential Access
1 technique
T1528
Steal Application Access Token
TA0007
Discovery
1 technique
T1497
Virtualization/Sandbox Evasion
T1497.001
System Checks
TA0008
Lateral Movement
1 technique
T1550
Use Alternate Authentication Material
T1550.001
Application Access Token
TA0009
Collection
1 technique
T1114
Email Collection
T1114.002
Remote Email Collection
TA0040
Impact
1 technique
T1531
Account Access Removal
ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Start free trial
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping12

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables

Domains, IPs, and hashes tied to this actor, refreshed continuously.