Loading threat actor…
Monkeydance is a threat actor alias associated with a claimed breach of the Thepha District Public Health Office in Thailand, a local public health authority under the Ministry of Public Health. The actor advertised an alleged data dump of approximately 2 GB that purportedly included databases, files, logs, document archives, backups, website user account data with hashed passwords, and staff contact information. Monkeydance also claimed to offer live server access to the compromised environment, indicating possible post-compromise access brokerage or monetization of unauthorized access. Available reporting supports only a limited profile. The documented activity is consistent with data theft and possible extortion-oriented or access-sale behavior, but the breach claim itself was unverified and no broader operational history, tooling, sub-groups, or confirmed attribution to a nation-state or criminal organization is established from the available facts. Based on the claimed targeting, Monkeydance has been associated with attacks against public-sector and health-related organizations in Thailand.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.