Loading threat actor…
PREY-0059 is a social-engineering threat cluster tracked by Arctic Wolf that impersonates internal IT help-desk personnel through external Microsoft Teams accounts to steal credentials and deploy Java-based remote access trojans on Windows systems. Its operators use organization-branded Microsoft Entra tenants and display names matching real IT personnel, sometimes contacting more than 20 employees within an hour. Victim-specific Amazon S3 landing pages imitate ServiceNow self-service portals, collect credentials through purported health checks, and distribute malicious archives disguised as Windows updates. The infection chain places a command on the victim's clipboard and instructs them to execute it through the Windows Run dialog. This extracts nested archives and launches Java source code using a bundled, legitimately signed Eclipse Adoptium OpenJDK runtime from a user-writable location. Observed intrusions established command-and-control communication in under five minutes of the initial Teams message, and endpoint detection products did not typically block execution. The Java RAT provides WebSocket-based command and control, operator-directed TCP proxying, Windows command execution, and file management. Its infrastructure uses Amazon CloudFront, with Azure Front Door configured as a fallback. Post-execution activity includes rapid collection of operating-system information, environment variables, network configuration, and running processes. Operators have queried domain controllers over LDAP within six minutes of payload execution and subsequently scanned other systems for SMB and RPC services.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
6 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.