Threat actor

Inky Squid

Updated 3 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVEs0Associated

Malware1Family

ATT&CK1Technique

IOCs0Tracked

Motivation: —

Also known asinky_squid

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

MITRE ATT&CK

Tradecraft

1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.

1 of 15 tactics2 techniques

= intelligence reports citing the technique

TA0001Initial Access1 technique

T1566Phishing

T1566.001Spearphishing Attachment

Malware

Associated malware families

1 malware family Mallory has associated with this actor across public reporting.

FamilyContextEvidenceLast seen

ROKRATIn this article, we describe a cluster of observed activity that deploys ROKRAT... we have observed a shift to delivering ROKRAT with LNK files disguised as legitimate documents.1Aug 14, 2026

Activity feed

Recent activity

1 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

View more in app →

No news coverage yet. Advisories and community discussion only.

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what's public. Mallory adds the parts that aren't: whether this actor's tooling has touched your footprint, the IOCs they're burning right now, and the detections to deploy next.

Start Free Trial Open in App ↗

Target overlapMatch sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping1MITRE ATT&CK techniques reported for this actor, grouped by tactic.

Associated malware1Families linked to this actor, with IOCs and behavior.

Associated CVEsCVEs linked to this actor, with the reporting behind each link.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

ObservablesDomains, IPs, and hashes tied to this actor, refreshed continuously.

Inky Squid

Updated 3 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVEs0Associated

Malware1Family

ATT&CK1Technique

IOCs0Tracked

Motivation: —

Also known asinky_squid

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure