Threat actorLinked to in-the-wild CVEs

Subaat

Updated 3 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVEs1Associated

Malware1Family

ATT&CK19Techniques

IOCs76Tracked

Motivation: —

Also known assubaat

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

MITRE ATT&CK

Tradecraft

19 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.

8 of 15 tactics25 techniques

= intelligence reports citing the technique

TA0001Initial Access1 technique

T1566×2Phishing

T1566.001×2Spearphishing Attachment

TA0002Execution3 techniques

T1059Command and Scripting Interpreter

T1059.001PowerShell

T1059.003Windows Command Shell

T1059.005×2Visual Basic

T1203×2Exploitation for Client Execution

T1204User Execution

TA0004Privilege Escalation1 technique

T1055×2Process Injection

T1055.012Process Hollowing

TA0005Stealth5 techniques

T1027×2Obfuscated Files or Information

T1055×2Process Injection

T1055.012Process Hollowing

T1140Deobfuscate/Decode Files or Information

T1218System Binary Proxy Execution

T1218.009Regsvcs/Regasm

T1620Reflective Code Loading

TA0006Credential Access1 technique

T1056Input Capture

T1056.001Keylogging

TA0009Collection2 techniques

T1056Input Capture

T1056.001Keylogging

T1113Screen Capture

TA0011Command and Control2 techniques

T1105×2Ingress Tool Transfer

T1132Data Encoding

TA0010Exfiltration1 technique

T1048Exfiltration Over Alternative Protocol

Malware

Associated malware families

1 malware family Mallory has associated with this actor across public reporting.

FamilyContextEvidenceLast seen

Agent TeslaFinal Payload – Agent Tesla: Below figure shows injected Agent Tesla payload in RegAsm.exe. Agent Tesla is a well-known keylogger and infostealer written in DotNet.1Aug 14, 2026

Vulnerabilities

Associated vulnerabilities

1 CVE Mallory has associated with this actor across public reporting. 1 of them is exploited in the wild (not necessarily by this actor).

CVE-2017-118821 evidence · Aug 14, 2026Exploited in the wildStack Buffer Overflow in Microsoft Office Equation EditorThis RTF is weaponized with exploit which triggers CVE-2017-11882 vulnerability to execute arbitrary code... CVE-2017-11882 is present in the Microsoft Office Equation Editor (EQNEDT32.EXE) component. The attacker can successfully exploit a stack buffer overflow vulnerability in the equation editor component of MS Office and execute arbitrary code.View vulnerability →

Indicators of compromise

Observables

76 indicators attributed to this actor. Values are masked here and available in full in Mallory.

View all in app →

Indicator values are available in Mallory. Pivot on every hash, domain, URL, and IP, or pipe them straight into your SIEM.View all in Mallory

Activity feed

Recent activity

No public activity tracked yet. Mallory keeps watching.

View more in app →

No public activity observed for this threat actor.

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what's public. Mallory adds the parts that aren't: whether this actor's tooling has touched your footprint, the IOCs they're burning right now, and the detections to deploy next.

Start Free Trial Open in App ↗

Target overlapMatch sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping19MITRE ATT&CK techniques reported for this actor, grouped by tactic.

Associated malware1Families linked to this actor, with IOCs and behavior.

Associated CVEs1CVEs linked to this actor, with the reporting behind each link.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables76Domains, IPs, and hashes tied to this actor, refreshed continuously.

Subaat

Updated 3 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVEs1Associated

Malware1Family

ATT&CK19Techniques

IOCs76Tracked

Motivation: —

Also known assubaat

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure