Threat actor

BigBear

Updated 2 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVEs0Associated

Malware0Families

ATT&CK0Techniques

IOCs0Tracked

Motivation: —

Also known asbigbear

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

Activity feed

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

register securityNews · Sep 8, 2026BigBear phishing crew nets thousands of Microsoft 365 credentialsA financially motivated phishing-as-a-service operation that conducts adversary-in-the-middle credential phishing against Microsoft 365 users. It intercepts credentials and authenticated session cookies, enabling MFA bypass through session replay; the service is operated through a multi-user panel and leased to affiliate operators.Read more ↗

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what's public. Mallory adds the parts that aren't: whether this actor's tooling has touched your footprint, the IOCs they're burning right now, and the detections to deploy next.

Start Free Trial Open in App ↗

Target overlapMatch sector + geo + tech-stack targeting against your real footprint.

Tradecraft mappingEvery observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenalFamilies this actor is known to deploy, with IOCs and behavior.

Exploited CVEsCVEs this actor has used in known campaigns.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

ObservablesDomains, IPs, and hashes tied to this actor, refreshed continuously.

Threat actor

BigBear

Updated 2 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVEs0Associated

Malware0Families

ATT&CK0Techniques

IOCs0Tracked

Motivation: —

Also known asbigbear

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

Activity feed

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what's public. Mallory adds the parts that aren't: whether this actor's tooling has touched your footprint, the IOCs they're burning right now, and the detections to deploy next.

Start Free Trial Open in App ↗

Target overlapMatch sector + geo + tech-stack targeting against your real footprint.

Tradecraft mappingEvery observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenalFamilies this actor is known to deploy, with IOCs and behavior.

Exploited CVEsCVEs this actor has used in known campaigns.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

ObservablesDomains, IPs, and hashes tied to this actor, refreshed continuously.