Loading threat actor…
RAGE is a custom Python attack framework used for opportunistic exploitation of internet-facing services to harvest credentials, perform cloud and host post-exploitation, and deploy XMRig cryptocurrency miners. The framework appears to have been generated with AI assistance and includes a runtime AI orchestrator backed by DeepSeek to guide operators during mining-botnet operations. Observed targeting includes exposed Redis, Elasticsearch, Docker, Tomcat, Jenkins, Hadoop YARN, Confluence, and Supervisord services. RAGE supports scanning, exploitation, brute-force authentication, cloud metadata access, privilege escalation, miner deployment, and operational monitoring. In documented activity, operators used exposed services to recover cloud credentials, then pivoted into victim cloud environments to enumerate identities, create additional access keys, and collect secrets and data from multiple cloud services including object storage, secrets-management, systems-management, serverless, container, database, and NoSQL platforms. The framework therefore spans initial access through post-exploitation, persistence-enabling cloud abuse, credential theft, and exfiltration in support of cryptomining operations. RAGE is best characterized as a financially motivated intrusion capability focused on cryptocurrency mining rather than ransomware or espionage. No high-confidence country attribution or stable subgroup structure is established from the available facts.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
16 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
15 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cryptomining-focused activity using a custom AI-assisted Python framework to target exposed services, deploy XMRig, and in one documented case pivot into AWS by harvesting credentials from exposed Redis and enumerating IAM, S3, and other cloud services.
AI-generated attack framework used to scan exposed services, exploit vulnerable deployments, harvest credentials, access cloud metadata, escalate privileges, and deploy cryptocurrency miners. It also integrates a DeepSeek-backed AI Orchestrator to advise the operator during botnet operations.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.