Threat actor

Virtualine

Updated 1 day ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

1 mention · peak 1 in a dayToday

CVEs0Associated

Malware0Families

ATT&CK5Techniques

IOCs1Tracked

Motivation: —

Also known asVirtualine

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

MITRE ATT&CK

Tradecraft

5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.

4 of 15 tactics7 techniques

= intelligence reports citing the technique

TA0042Resource Development1 technique

T1583Acquire Infrastructure

T1583.001Domains

T1583.003Virtual Private Server

TA0001Initial Access1 technique

T1566Phishing

T1566.002Spearphishing Link

TA0010Exfiltration1 technique

T1020Automated Exfiltration

TA0040Impact1 technique

T1657Financial Theft

Indicators of compromise

Observables

1 indicator attributed to this actor. Values are masked here and available in full in Mallory.

View all in app →

Indicator values are available in Mallory. Pivot on every hash, domain, URL, and IP, or pipe them straight into your SIEM.View all in Mallory

Activity feed

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

cyberveilleNews · Oct 27, 2026Saisie du domaine Virtualine.net : hébergeur bulletproof démantelé par une opération internationale | CyberVeilleAlleged cybercriminal infrastructure provider whose domain, virtualine.net, was seized in an international law-enforcement operation announced on October 27, 2026. The report describes advertising hosting for illegal activities, disregarding abuse reports, offering infrastructure migration to a front company following law-enforcement requests, actively supporting an illicit-content forum, and facilitating money laundering. No named malware or ransomware use is established.Read more ↗

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what's public. Mallory adds the parts that aren't: whether this actor's tooling has touched your footprint, the IOCs they're burning right now, and the detections to deploy next.

Start Free Trial Open in App ↗

Target overlapMatch sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping5MITRE ATT&CK techniques reported for this actor, grouped by tactic.

Associated malwareFamilies linked to this actor, with IOCs and behavior.

Associated CVEsCVEs linked to this actor, with the reporting behind each link.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables1Domains, IPs, and hashes tied to this actor, refreshed continuously.

Threat actor

Virtualine

Updated 1 day ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

1 mention · peak 1 in a dayToday

CVEs0Associated

Malware0Families

ATT&CK5Techniques

IOCs1Tracked

Motivation: —

Also known asVirtualine

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

MITRE ATT&CK

Tradecraft

5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.

4 of 15 tactics7 techniques

= intelligence reports citing the technique

TA0042Resource Development1 technique

T1583Acquire Infrastructure

T1583.001Domains

T1583.003Virtual Private Server

TA0001Initial Access1 technique

T1566Phishing

T1566.002Spearphishing Link

TA0010Exfiltration1 technique

T1020Automated Exfiltration

TA0040Impact1 technique

T1657Financial Theft

Indicators of compromise

Observables

1 indicator attributed to this actor. Values are masked here and available in full in Mallory.

View all in app →

Indicator values are available in Mallory. Pivot on every hash, domain, URL, and IP, or pipe them straight into your SIEM.View all in Mallory

Activity feed

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what's public. Mallory adds the parts that aren't: whether this actor's tooling has touched your footprint, the IOCs they're burning right now, and the detections to deploy next.

Start Free Trial Open in App ↗

Target overlapMatch sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping5MITRE ATT&CK techniques reported for this actor, grouped by tactic.

Associated malwareFamilies linked to this actor, with IOCs and behavior.

Associated CVEsCVEs linked to this actor, with the reporting behind each link.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables1Domains, IPs, and hashes tied to this actor, refreshed continuously.