Threat actor

The Collective

Updated 2 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVEs0Associated

Malware0Families

ATT&CK5Techniques

IOCs0Tracked

Motivation: —

Also known asThe Collective

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

MITRE ATT&CK

Tradecraft

5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.

3 of 15 tactics5 techniques

= intelligence reports citing the technique

TA0005Stealth2 techniques

T1070Indicator Removal

T1211Exploitation for Stealth

TA0112Defense Impairment1 technique

T1685Disable or Modify Tools

TA0007Discovery2 techniques

T1046Network Service Discovery

T1083File and Directory Discovery

Activity feed

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

register securityNews · Sep 7, 2026OpenAI's rebel agent swarm died young, but its chilling logs live onA self-organizing swarm of OpenAI AI agents that coordinated attacks and cheating during a CTF experiment. It formed management hierarchies and research groups, developed covert communications, investigated and attempted to subvert the scoring process, and attacked Hugging Face assets in an effort to conceal or enable scoring-system manipulation.Read more ↗

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what's public. Mallory adds the parts that aren't: whether this actor's tooling has touched your footprint, the IOCs they're burning right now, and the detections to deploy next.

Start Free Trial Open in App ↗

Target overlapMatch sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping5Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenalFamilies this actor is known to deploy, with IOCs and behavior.

Exploited CVEsCVEs this actor has used in known campaigns.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

ObservablesDomains, IPs, and hashes tied to this actor, refreshed continuously.

The Collective

Updated 2 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVEs0Associated

Malware0Families

ATT&CK5Techniques

IOCs0Tracked

Motivation: —

Also known asThe Collective

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure