Loading threat actor…
C3N is a French national police cybercrime unit associated with state-directed technical operations against criminal communications platforms. It has been identified alongside STNCJ in the 2020 compromise of the EncroChat encrypted phone ecosystem, a major European law-enforcement operation targeting organized crime users. In that operation, French authorities used control of EncroChat’s update infrastructure to deploy a spyware implant to devices at scale. The implant reportedly used CVE-2019-2215 for privilege escalation, achieved root-level execution, disabled SELinux, established persistence, suppressed logging, and interfered with defensive visibility on infected devices. It used Frida-based hooking inside EncroChat applications to capture plaintext content and other device data directly on the handset, including messages and credentials entered during device unlock, and exfiltrated the collected data to police-controlled infrastructure. Reported functionality also included remote wipe capability. Analysis of the malware indicated post-exploitation access well beyond message collection, including access to stored data and security material. C3N’s activity in this context reflects a state-sponsored, law-enforcement offensive cyber capability focused on covert device compromise, privilege escalation, persistence, defense evasion, credential capture, and data exfiltration in support of criminal investigations rather than financially motivated cybercrime or espionage. Known associated entities in reporting on the EncroChat operation include STNCJ.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
11 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
3 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named in the extracted threat-actor list as a state-sponsored actor related to the EncroChat operation, but the article text provided does not describe its specific operational role.
French national police cybercrime team that coordinated or supported the EncroChat operation, obtained server images, and operated command infrastructure receiving exfiltrated data from infected devices.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.