# Mallory — full content

> Expanded corpus of mallory.ai's trending threat intelligence. Each entity links to its full Markdown view (`.md`) and its live page in the Mallory app.

## Trending vulnerabilities

### PwnEscape (CVE-2026-99999)
*severity critical · CVSS 9.3* — https://mallory.ai/vulnerabilities/CVE-2026-99999.md

PwnEscape is a Linux kernel IPv4 checksum-validation vulnerability introduced in Linux 2.6.27. Insufficient validation of CHECKSUM_PARTIAL metadata allows skb_checksum_help() to modify an IPv4 header after earlier processing has validated and relied upon it. Guest-controlled checksum-start and checksum-offset metadata can direct a deferred checksum write into the header, creating a deterministic validation/use inconsistency rather than a concurrency-dependent race. In a demonstrated fragmentation path, changing the interpreted IPv4 header length from 20 to 60 bytes causes the kernel to copy b…

### Authentication Bypass in BeyondTrust Remote Support Internal Messaging (CVE-2026-102764)
*severity critical · CVSS 9.3 · CISA KEV* — https://mallory.ai/vulnerabilities/CVE-2026-102764.md

CVE-2026-102764 is a critical authentication-bypass vulnerability affecting unpatched BeyondTrust Remote Support versions 26.2.3 and earlier. Internal messaging components inadequately validate the origin of received messages, allowing an unauthenticated remote attacker to perform file operations, including uploading and modifying files, on an affected appliance. Exploitation requires no user interaction. The vulnerability has a CVSS v4.0 score of 9.3. Zero-day exploitation attributed to ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221, was observed beginning i…

### Authentication Bypass and Remote Command Execution in Ivanti Connect Secure (CVE-2026-104935)
*severity high · CVSS 8.6 · CISA KEV* — https://mallory.ai/vulnerabilities/CVE-2026-104935.md

CVE-2026-104935 is an authentication-bypass-by-spoofing vulnerability in Ivanti Connect Secure (ICS) that enables unauthenticated remote command execution. ICS determines authentication requirements from the requested URL but selects the executing CGI handler using the attacker-controlled X-DSCGI-PATH header. This inconsistency exposes protected functionality to unauthenticated requests. An associated upload-handler weakness writes uploaded content before validating it, allowing concurrent requests to execute an uploaded script before deletion. Both weaknesses are tracked under this CVE and p…

### Root Command Execution via AMP Path Traversal in Cisco Secure Email Gateway (CVE-2026-76519)
*severity critical · CVSS 9.8 · CISA KEV* — https://mallory.ai/vulnerabilities/CVE-2026-76519.md

CVE-2026-76519 is a relative path traversal vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. Improper processing of email attachments when File Reputation is enabled allows an unauthenticated remote attacker to send a specially crafted attachment through an affected appliance, write arbitrary files on the underlying operating system, and execute commands with root privileges. Physical and virtual appliances are exposed when File Reputation is enabled and assigned to a mail policy and Content Scanner Tools is earlier than version 25.3.0.5525. Exploi…

### Authenticated Root Code Execution in Palo Alto Networks PAN-OS Management Interface (CVE-2026-0322)
*severity high · CVSS 8.6 · CISA KEV* — https://mallory.ai/vulnerabilities/CVE-2026-0322.md

CVE-2026-0322 is a code injection vulnerability in the Palo Alto Networks PAN-OS management interface that allows an authenticated attacker with high privileges and network access to execute arbitrary code as root. Affected deployments include PA-Series and VM-Series firewalls and Panorama virtual and M-Series appliances, with vulnerable releases across PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2. No special configuration or user interaction is required. Cloud NGFW and Prisma Access are unaffected. The vulnerability has a CVSS 4.0 score of 8.6. Palo Alto Networks confirmed very limited exploitati…

### Unauthenticated command injection in Collabora Online Built-in CODE Server for Nextcloud (CVE-2026-110447)
*severity critical · CVSS 9.2* — https://mallory.ai/vulnerabilities/CVE-2026-110447.md

CVE-2026-110447 is an operating-system command injection vulnerability in Collabora Online Built-in CODE Server (richdocumentscode) for Nextcloud, affecting versions before 26.4.303. When the bundled CODE service is stopped, its startup mechanism incorporates request-controlled text into a double-quoted shell command, allowing shell expansion and arbitrary command execution as the web-server account. Exploitation requires neither authentication nor user interaction and occurred in the wild during September and October 2026. Standalone Collabora Online servers are unaffected. The vulnerability…

### Windows Shell Mark of the Web Security Feature Bypass (CVE-2026-96951)
*severity high · CVSS 8.8 · CISA KEV* — https://mallory.ai/vulnerabilities/CVE-2026-96951.md

CVE-2026-96951 is a command injection vulnerability in Microsoft Windows Shell caused by improper neutralization of special elements used in a command. An unauthenticated remote attacker can bypass Mark of the Web (MOTW) protections by persuading a user to interact with specially crafted content. Affected products include Windows 10, multiple Windows 11 releases, Windows Server editions from 2012 R2 through 2025, and Outlook.com before its service-side correction. Microsoft addressed the vulnerability on October 13, 2026, and confirmed exploitation before patch availability. Microsoft rates i…

### GitLab CI/CD Regular-Expression Compiler Integer Overflow RCE (CVE-2026-97229)
*severity critical · CVSS 10* — https://mallory.ai/vulnerabilities/CVE-2026-97229.md

CVE-2026-97229 is an integer-overflow vulnerability in GitLab Community Edition and Enterprise Edition affecting versions 19.2.0 before 19.2.8, 19.3.0 before 19.3.5, and 19.4.0 before 19.4.2. Insufficient validation of CI/CD regular expressions allows a crafted expression to bypass repeat-bound checks and initially pass compiled-size validation. Matching against a specially constructed UTF-8 repository path then causes Ruby's Onigmo engine to recompile the expression without repeating GitLab's size checks. Overflow in compiled-program size and branch-offset calculations can corrupt regular-ex…

### Privileged OS Command Injection in SiteGuard Server Edition Statistics (CVE-2026-106931)
*severity high · CVSS 8.5 · CISA KEV* — https://mallory.ai/vulnerabilities/CVE-2026-106931.md

CVE-2026-106931 is an OS command injection vulnerability in the statistics-processing functionality of SiteGuard Server Edition, a host-based web application firewall. A local attacker with low privileges can exploit the default-enabled statistics feature to execute arbitrary operating system commands as root or SYSTEM. Affected releases start at version 2.20 and extend to versions before 8.00 Update 5 for non-FreeBSD Apache httpd, Nginx, and IIS editions, and before 7.00 Update 6 for FreeBSD Apache httpd and Nginx editions. IIS versions 3.10 through 4.00 Update 4, inclusive, are unaffected.…

### HTTP/2 upload Use-After-Free in curl (CVE-2026-92392)
*severity high · CVSS 8.1* — https://mallory.ai/vulnerabilities/CVE-2026-92392.md

CVE-2026-92392 is a use-after-free vulnerability in HTTP/2 upload handling in curl and libcurl. A receiving server can send an RST_STREAM frame with reason HTTP_1_1_REQUIRED or REFUSED_STREAM, triggering faulty retry and cleanup ordering that leaves a reference to a freed struct Curl_easy object. Subsequent processing can access the released memory, causing memory corruption, a crash, or remote code execution. The vulnerability affects upstream versions 8.12.0 through 8.22.0, excluding patched maintenance releases. The curl project rates it High severity because demonstrated code execution re…

### Authenticated CLI Path Traversal in Fortinet FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager (CVE-2025-61624)
*severity medium · CVSS 6.5 · CISA KEV* — https://mallory.ai/vulnerabilities/CVE-2025-61624.md

CVE-2025-61624 is a path traversal vulnerability in the command-line interpreter of Fortinet FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. An authenticated attacker with an administrator profile and at least read-write permissions can supply specially crafted arguments to existing CLI commands to write or delete arbitrary files outside the intended restricted directory. Affected releases include FortiOS 7.6.0–7.6.4, 7.4.0–7.4.9, and all 7.2, 7.0, and 6.4 releases; FortiPAM 1.7.0 and all 1.0–1.6 releases; FortiProxy 7.6.0–7.6.4, 7.4.0–7.4.11, and all 7.2 and 7.0 releases; and FortiSwi…

### Remote Code Execution in Drupal Core Field UI (CVE-2026-108097)
*severity unknown* — https://mallory.ai/vulnerabilities/CVE-2026-108097.md

CVE-2026-108097 is a critical remote code execution vulnerability in Drupal core's Field UI module, which provides administrative interfaces for managing fields and their display. During table pre-render processing, Field UI invokes a PHP callable specified by a row's #region_callback property through call_user_func_array without validating whether the callable is trusted. This nested invocation bypasses Drupal's protections against untrusted render callbacks. Drupal core alone does not expose an attacker-controlled input path, but contributed modules or custom code can make the vulnerable fu…

### DLL Side-Loading in Siemens Software Center (CVE-2026-110936)
*severity high · CVSS 8.4 · CISA KEV* — https://mallory.ai/vulnerabilities/CVE-2026-110936.md

CVE-2026-110936 is an uncontrolled DLL search-path vulnerability in Siemens Software Center versions earlier than 4.0.9.8. The application loads dynamic-link libraries from insufficiently restricted search locations, including its executable directory, allowing an authenticated local attacker to plant a specially crafted DLL that executes with the application's privileges. Observed attacks paired a genuine, digitally signed Siemens executable with malicious DLLs distributed outside official Siemens channels. Siemens confirmed active exploitation associated with the Romulus ClickFix delivery o…

### Heap Buffer Overflow in NGINX Alias and Rewrite Processing (CVE-2026-15176)
*severity critical · CVSS 9.2* — https://mallory.ai/vulnerabilities/CVE-2026-15176.md

CVE-2026-15176 is a heap-based buffer overflow in ngx_http_core_module affecting NGINX Plus, NGINX Open Source, and products embedding vulnerable NGINX components. The vulnerability occurs when a location combines alias and rewrite directives and evaluates $request_filename, for example through set, return, or an access-log format. Mapping the rewritten URI to a filesystem path can write beyond a heap buffer in an NGINX worker process. Unauthenticated remote attackers can trigger the flaw with crafted HTTP requests under configuration-dependent conditions. Exploitation can restart workers and…

### FortiJump (CVE-2024-47575)
*severity critical · CVSS 9.8 · CISA KEV* — https://mallory.ai/vulnerabilities/CVE-2024-47575.md

FortiJump is a critical missing-authentication vulnerability in the Fortinet FortiManager fgfmd daemon, which implements the FortiGate-to-FortiManager (FGFM) management protocol. A remote attacker can register an unauthorized FortiGate device and send specially crafted requests to execute arbitrary code or commands without authenticating as a FortiManager user. Affected FortiManager releases are 7.6.0, 7.4.0–7.4.4, 7.2.0–7.2.7, 7.0.0–7.0.12, 6.4.0–6.4.14, and 6.2.0–6.2.12. Affected FortiManager Cloud releases include 7.4.1–7.4.4, 7.2.1–7.2.7, 7.0.1–7.0.12, and 6.4.1–6.4.7. Certain FortiAnalyz…

### Authentication Bypass in AhsayCBS JSON API (CVE-2026-105133)
*severity medium · CVSS 5.5 · CISA KEV* — https://mallory.ai/vulnerabilities/CVE-2026-105133.md

CVE-2026-105133 is an improper authentication vulnerability in the AhsayCBS API that allows remote, unauthenticated attackers to invoke protected JSON API actions. The JSONApi.execute() authentication logic trusts the attacker-controlled FromServlet field: supplying "FromServlet":"Y" causes execution to skip the checkSysPwd() password check. Initial vulnerability records describe manipulation of the random argument in checkSysPwd() and identify versions through 10.3.2 as affected; subsequent testing confirmed that version 10.3.4 also remained vulnerable. Exploitation permits unauthorized admi…

### Compromised eMudhra intermediate CA trust in Go crypto/x509 (CVE-2026-111943)
*severity unknown* — https://mallory.ai/vulnerabilities/CVE-2026-111943.md

CVE-2026-111943 addresses continued trust in eight compromised eMudhra intermediate CA public keys in Go's crypto/x509 certificate verification. The affected intermediates comprise six TLS certificate authorities and two code-signing certificate authorities. Possession of the corresponding private keys permits unauthorized certificate issuance that may be accepted by clients trusting the affected chains, subject to other validation requirements. Go 1.27.3 and 1.26.10 update certificate verification to reject chains containing any of these keys, including verification through macOS and Windows…

### BlockStrap (CVE-2026-103849)
*severity critical · CVSS 10* — https://mallory.ai/vulnerabilities/CVE-2026-103849.md

BlockStrap is a second-pass directive injection vulnerability in the email-template engine of Adobe Commerce, Magento Open Source, and Adobe Commerce B2B. Affected releases include unpatched Adobe Commerce and Magento Open Source versions 2.4.9 and earlier, and Adobe Commerce B2B versions 1.5.3 and earlier. Attacker-controlled content in a child email template can be signed as trusted and subsequently reprocessed at the root template level, allowing a smuggled {{block}} directive to execute within the rendering process. The vulnerability permits unauthenticated remote execution of arbitrary P…

### WinRAR NTFS Alternate Data Stream Path Traversal (CVE-2025-8088)
*severity high · CVSS 8.4 · CISA KEV* — https://mallory.ai/vulnerabilities/CVE-2025-8088.md

CVE-2025-8088 is a path traversal vulnerability affecting Windows versions of RARLAB WinRAR before 7.13. Crafted RAR archives combine parent-directory traversal sequences with NTFS alternate data stream names to bypass path validation and write files outside the selected extraction directory. Attackers can place executable payloads in the current user's Startup folder, causing arbitrary code execution at the next sign-in. The vulnerability has been exploited in the wild for malware delivery.

### Remote Code Execution in AhsayCBS Replication Receiver (CVE-2026-105134)
*severity critical · CVSS 9.3 · CISA KEV* — https://mallory.ai/vulnerabilities/CVE-2026-105134.md

CVE-2026-105134 is a critical remote code execution vulnerability in the AhsayCBS Replication Receiver component. It is classified as operating system command injection involving manipulation of the random parameter in the receiver-update API. Detailed technical analysis also identifies a replication-upload path traversal: attacker-controlled destination headers reach getReplicatedPath() without the system-folder restrictions applied elsewhere, allowing executable JSP files to be written into a web-served application directory. Chaining this capability with authentication bypass CVE-2026-1051…

## Trending threat actors

### N0n
https://mallory.ai/actors/01a0b66b-5d28-7de8-b4e0-bcb3d78f6d49.md

n0n, also styled N0n, is a financially motivated cybercriminal data-extortion group that emerged in September 2026. It threatens to publish stolen organizational data unless victims pay and operates a dark-web leak site displaying payment and exposure statuses. Although frequently labeled a ransomware group, deployment of traditional file-encrypting ransomware has not been established. Its country of origin is not confirmed. The group targets organizations internationally, including maritime transport and logistics operators, IT and hosting providers, healthcare organizations, financial servi…

### Qilin
https://mallory.ai/actors/019ab9bd-c6a1-7c6e-b28c-cda01d372ff4.md

Qilin is a financially motivated, Russia-linked ransomware-as-a-service operation active since at least 2022. Also known as Agenda and tracked as GOLD FEATHER, Water Galura, and Spikey Scorpius, it operates an affiliate-based ecosystem that compromises organizations, deploys ransomware, and extorts victims. Its operations include both encryption-only attacks and double extortion, combining encryption with threats to publish stolen information on its data leak site. Qilin targets organizations internationally, including healthcare providers, transportation and logistics companies, manufacturer…

### Metaencryptor
https://mallory.ai/actors/019d0233-4083-707e-b4e1-b8d6b94fc8d1.md

MetaEncryptor is a ransomware threat actor associated with publicly claimed compromises of organizations across North America and Asia, with activity documented during September and October 2026. Its claimed targets include healthcare providers, medical-device manufacturers, technology and managed-services companies, engineering and construction firms, automotive suppliers, steel manufacturers, and defense-related enterprises. Claimed victims include MyMichigan Health, Beckman Coulter, VIATechnik, AECOM, Astemo, Nippon Steel, SFA Engineering, EllisDon, and ST Engineering. Its geographic targe…

### TheGentlemen
https://mallory.ai/actors/019abb07-733a-7e38-ae2d-cd735f8140b3.md

The Gentlemen is a financially motivated ransomware-as-a-service operation, also known as Gentleman and tracked as GOLD SHERWOOD and Storm-2697. It supplies ransomware and supporting infrastructure to affiliates and uses double extortion: stealing information before encrypting systems and threatening publication to obtain payment. Its targets span healthcare, education, technology, manufacturing, food production, professional services, government organizations, and defense-related businesses across multiple countries. The operation emerged in 2025 with a platform prepared by hastalamuerte, a…

### Termite
https://mallory.ai/actors/019aba62-8788-7839-acad-b3dae183a840.md

Termite is a financially motivated ransomware and data-extortion operation, also referred to as the Termite ransomware group or Termite ransomware operators. It maintains a dedicated data-leak site to publicize claimed compromises and pressure victims. Its victim listings span healthcare, industrial manufacturing and equipment distribution, financial services, software, real estate, private education, and media, with a substantial concentration of organizations in the United States. Termite uses threatened or claimed disclosure of stolen information as leverage. Its claims have included theft…

### NightSpire
https://mallory.ai/actors/019ab986-dc48-73a9-a5aa-473a480a44fd.md

NightSpire, also tracked as nightspire_ransomware, is a financially motivated ransomware and data-extortion group that emerged in early March 2025. It conducts double-extortion operations, stealing sensitive information and encrypting victim systems before demanding payment. Its dedicated dark-web leak site lists victims and uses publication countdowns to pressure organizations into negotiations. The group also uses direct pressure emails and public shaming through Telegram. NightSpire targets organizations internationally, including victims in the United States, Europe, Asia, the Middle East…

### blacknevas
https://mallory.ai/actors/019abad0-6808-7ac0-85fc-f377e338e159.md

Black Nevas, also known as blacknevas and black_nevas, is a financially motivated ransomware and data-extortion group that publicizes claimed compromises through a leak site. Its claimed victims span financial services, information technology, healthcare, manufacturing, logistics, retail, and hospitality. Organizations associated with its activity include businesses in the United States, Canada, and Saudi Arabia, as well as South Korean companies. Its victim claims also encompass multinational manufacturing data associated with operations in France, Chile, and South Africa. The group uses cla…

### ShinyHunters
https://mallory.ai/actors/019ab9bd-c6aa-7f7d-9076-630e52a81778.md

ShinyHunters, also known as Shiny Hunters and Bling Libra, is a financially motivated cybercriminal collective active since approximately 2019–2020. Originally associated with French operators, it focuses on stealing sensitive information and monetizing it through extortion and data sales. Its targets include technology providers, retailers, telecommunications companies, educational institutions, healthcare businesses, and government organizations. Its operations have affected organizations and individuals across multiple countries, including the United States and Canada. ShinyHunters commonl…

### ARMORY CASTLE
https://mallory.ai/actors/01a14240-70e4-71a9-81b5-6ea5fe76ed68.md

ARMORY CASTLE is a suspected Chinese state-sponsored cyberespionage actor formerly tracked as UNC5221 and also known as WARP PANDA. Active since at least October 2023, it targets government organizations, legal services firms, business-process outsourcers, technology companies, and software-as-a-service providers across multiple countries. Its operations emphasize exploiting internet-facing edge appliances and remote-access products to establish persistent access for long-term intelligence collection. It has repeatedly exploited Ivanti and Citrix products, using both zero-day vulnerabilities…

### Wallstreet
https://mallory.ai/actors/019f06e7-e4da-7c5b-9482-c22c6379d02c.md

Wallstreet is a threat group associated with reported ransomware attacks against organizations in the United States, Sweden, the United Kingdom, Denmark, and Saudi Arabia. Its reported activity includes attacks recorded during September and October 2026. Its geographic origin, organizational structure, and relationships with other threat groups are not established. Reported targets span healthcare, manufacturing, architecture and professional services, electronics, packaging, real estate, and nonprofit organizations. Named victims include Green Clinic, Gibson Area Hospital & Health Services,…

### Helix
https://mallory.ai/actors/019f45fd-b615-7f80-b990-1a65d37da594.md

Helix is a financially motivated cybercriminal extortion operation associated with Storm-3032, a cluster comprising actors who splintered from BlackFile. Its activity overlaps with the broader cloud-data theft ecosystem tracked as UNC6671 and PREY-0058. BlackFile, Redact, Pink, Falcon, and Cinder are related ecosystem brands, but are not established as interchangeable aliases for Helix. Its country of origin is not established. Helix targets US organizations across financial services, manufacturing, healthcare, real estate, professional services, and energy-related businesses. Its cloud-accou…

### PEAR
https://mallory.ai/actors/019afe68-e925-7d11-8317-e9068227d36c.md

PEAR, also tracked as pear_ransomware_group, is a financially motivated cybercriminal extortion group first publicly observed in mid-2025. Its principal operating model is data-theft extortion: stealing organizational information and threatening publication unless a ransom is paid, rather than relying on file encryption. PEAR uses phishing and voice phishing to obtain access to Microsoft 365 email accounts. PEAR's reported targeting spans the United States and Jamaica, with multiple healthcare organizations among its claimed victims. Other targets include technology providers, financial servi…

### LeakNet
https://mallory.ai/actors/019cfdb2-d5dc-73c5-ab2c-eac9127cad6d.md

LeakNet is a financially motivated ransomware and data-extortion operation first observed in late 2024. Its web-based initial-access campaigns are opportunistic rather than focused on a narrowly defined victim profile. The group has also directed extortion activity against the United States healthcare sector, publishing purported patient-data samples and threatening additional disclosures. LeakNet uses ClickFix social engineering on compromised legitimate websites, including fake Cloudflare Turnstile verification prompts, to persuade users to execute malicious Windows Installer commands. This…

### LockBit
https://mallory.ai/actors/019ab9bd-c6ac-7814-a96b-62c6e28547e9.md

LockBit is a financially motivated ransomware-as-a-service operation comprising core administrators, developers, and affiliated intrusion operators. Its names and variants include ABCD ransomware, LockBit 2.0, LockBit 3.0, LockBit Black, and LockBit Green. It targets organizations internationally across manufacturing, professional services, healthcare, telecommunications, hospitality, utilities, and transportation infrastructure. Its operating model combines ransomware deployment with data theft and threats to publish stolen information through a dedicated leak site. LockBit supplies affiliat…

### Toufan
https://mallory.ai/actors/01a0023f-5395-7498-ac70-5a34985f0289.md

Toufan is an Iranian threat group associated with a politically motivated destructive malware campaign targeting Israeli organizations in the context of the Israel–Hamas war that began in October 2023. Its campaign uses malware referred to as the ESET wiper to destroy data and display political messages. Its destructive functionality extends to local drives, removable storage, and network shares. The malware employs a multistage execution chain, requests administrator privileges, and queries Israel’s civil defense alert service as an execution gate intended to identify Israeli-associated syst…

### UTA0576
https://mallory.ai/actors/01a1362a-0448-75c7-a618-df30ab50d45d.md

UTA0576 is a threat actor tracked by Volexity for exploiting Ivanti Connect Secure VPN appliances in October 2026. Activity documented from October 3 compromised an appliance running version 22.8R2.4, which was fully patched at the time. The actor chained authentication-bypass and file-upload weaknesses collectively tracked as CVE-2026-104935 with a separate privilege-escalation zero-day to obtain unauthenticated root-level command execution. Its geographic origin, organizational affiliation, and ultimate motivation remain undetermined. UTA0576 repeatedly executed the exploit chain to issue c…

### DeadLock
https://mallory.ai/actors/019bbd99-5af2-7e99-ac4e-03d181663e29.md

DeadLock, also styled Deadlock, is a financially motivated ransomware operation first observed in July 2025. It conducts double extortion by encrypting victim environments and threatening to publish stolen data through its DeadLock blog. Its victims span Europe, Asia, the Americas, and Africa, with a substantial concentration in Europe, particularly Italy, Spain, and Poland. Targeted sectors include manufacturing, information technology, mining, transportation and logistics, hospitality, consumer goods, healthcare, and telecommunications. Multiple threat actors have deployed DeadLock, includi…

### INCRansom
https://mallory.ai/actors/019abb75-d1ae-706a-ae97-ffe6fb518528.md

INC Ransom, also tracked as GOLD IONIC and Tarnished Scorpius, is a financially motivated ransomware-as-a-service operation active since 2023. Core operators maintain the ransomware platform, while affiliates conduct intrusions in exchange for a share of ransom payments. Its targets span healthcare, government, education, technology, financial services, hospitality, manufacturing, retail, and professional services. Significant affiliate activity is tracked separately as Vanilla Tempest; that name does not encompass the entire INC Ransom operation. Affiliates obtain initial access through comp…

### Akira
https://mallory.ai/actors/019abb75-d1b9-7402-a825-66d273de4705.md

Akira is a financially motivated ransomware and extortion operation active since 2023. It is also tracked as GOLD SAHARA, Howling Scorpius, PUNK SPIDER, and Storm-1567; its ransomware is additionally known as REDBIKE. PUNK SPIDER identifies the adversary responsible for developing and maintaining Akira ransomware and its dedicated data-leak site. The operation uses a ransomware-as-a-service model and primarily targets small and medium-sized businesses, alongside larger organizations and critical infrastructure entities. Its victim base spans North America, Europe, Australia, and other regions…

### iah6477
https://mallory.ai/actors/01a0236f-3f71-7f3b-9e85-2f9b71de893a.md

iah6477 is a threat actor associated with reported ransomware incidents involving predominantly United States-based organizations. Incidents attributed to the actor span August through October 2026 and affect manufacturing, professional services, food production, retail, financial services, and technology organizations. Named targets include Middleby, Sunshine Mills, Buckle, Veritiv, Swagelok, TRC Companies, ProAmpac, MAT Holdings, and Acima. Several attributed incidents involve reported data volumes ranging from hundreds of gibibytes to multiple tebibytes, but those figures do not establish…

## Trending malware

### SAWFLY
https://mallory.ai/malware/01a14240-7039-7c04-b18f-67cc36566873.md

SAWFLY is a lightweight, obfuscated PHP webshell used by ARMORY CASTLE, a suspected China-linked cyberespionage actor formerly tracked as UNC5221, on compromised BeyondTrust Remote Support appliances. It provides interactive remote code execution and bidirectional encrypted command-and-control communications. The webshell decodes and decrypts attacker-supplied instructions, executes PHP code, and encrypts and encodes the results before returning them. Its communications use RC4 encryption and Base32 encoding. Requests lacking its designated command parameter receive an HTTP 404 response, help…

### BARECLAW
https://mallory.ai/malware/01a14240-700e-770b-a403-251faf58151e.md

BARECLAW is a custom C-based tunneling backdoor deployed on compromised BeyondTrust Remote Support appliances. It implements SOCKS5 proxying over WebSockets, relaying TCP connections between remote clients and selected destinations to provide network access through the compromised appliance. Its features include TLS-protected WebSocket listeners, shared-secret authentication, optional XOR stream obfuscation, upstream SOCKS5 proxy chaining, destination-subnet restrictions, configurable connection limits and timeouts, and a quiet mode that suppresses logging. BARECLAW has been deployed by ARMOR…

### CoGUI
https://mallory.ai/malware/019b9cfa-8cf0-7083-890d-1d5a322d1cc3.md

CoGUI, also known as NX or FA, is a Chinese-language phishing-as-a-service kit used to steal usernames, passwords, payment-card information, and other personal data. Observed since at least October 2024, it supplies ready-made websites and messages impersonating trusted retailers, payment services, banks, government agencies, and other organizations. Multiple criminal operators use the kit, predominantly targeting Japanese-language speakers and organizations in Japan, with additional activity affecting the United States and other countries. Financial services and healthcare are prominent affe…

### Pegasus
https://mallory.ai/malware/019ab9bd-b37f-7241-b6c9-fa6a5c21983c.md

Pegasus is commercial mobile spyware developed by the Israeli company NSO Group and licensed to government customers for intelligence and law-enforcement surveillance. It targets Apple iOS and Android devices, providing operators with access to private communications, including messages from encrypted messaging applications, and device location. It can covertly activate microphones and cameras, enabling surveillance beyond the communications stored on a compromised phone. Pegasus has been deployed through zero-click exploit chains that require no user interaction, including attacks delivered…

### Darksword
https://mallory.ai/malware/019d01a2-7aab-79e8-972f-b5f95efd0e30.md

DarkSword is an iOS exploit kit used to compromise vulnerable iPhones and deploy data-theft and remote-control payloads. Observed in attacks since late 2025 and publicly documented in March 2026, its established six-vulnerability chain targets iOS 18.4 through 18.7. It combines browser exploitation, sandbox escapes, and kernel privilege escalation before injecting a payload into SpringBoard. Infection can begin when Safari loads a malicious webpage or embedded content on a compromised website, without requiring application installation or further approval. DarkSword enables collection and exf…

### PEERSTITCH
https://mallory.ai/malware/01a13c99-eb51-7721-ba79-995b7d0ff3bd.md

PEERSTITCH is a memory-resident backdoor written in C for ARM64 Linux-based Fortinet FortiGate appliances running FortiOS. It is associated with the threat cluster CL-STA-0954, also tracked as UNC5820, and was identified during a prolonged intrusion against a telecommunications managed service provider. The implant operates as a process-memory patching injector targeting legitimate FortiOS logging and IKE/IPsec VPN daemons. It uses ptrace to attach to these processes, allocates executable memory, inserts malicious hooks, and redirects execution. The hooks establish a covert inter-process comm…

### SHINYROAD
https://mallory.ai/malware/01a14578-6747-73c9-a36b-818a3fd6a791.md

SHINYROAD is a modular Windows backdoor used by the threat cluster UNC7017 to establish persistent remote access. Its capabilities include remote shell execution, self-updating, and receiving and executing additional interpreter code. It embeds the PocketPy interpreter and executes ChaCha20-encrypted Python bytecode after decrypting it in memory, without writing the decrypted payload to disk. The deployment chain uses genuine, digitally signed Radmin components to side-load an attacker-controlled DLL through DLL search-order hijacking. A subsequent component hosts the implant inside a signed…

### Iron Man System
https://mallory.ai/malware/01a13ae2-93ce-7e4a-b31e-553da994ea7d.md

Iron Man System is a commercial phishing-as-a-service kit sold to criminal customers as a self-hosted, container-distributed package. It provides thousands of localized templates impersonating banks, postal and courier services, government agencies, traffic authorities, healthcare providers, telecommunications companies, and retailers. Campaigns use email and SMS lures, including unpaid tolls, traffic fines, parcel-delivery problems, and account-verification requests, to direct victims to fraudulent websites and steal credentials, payment-card information, and verification codes. Its geograph…

### Mirai
https://mallory.ai/malware/019ab9bd-b380-706f-8e9b-313a0c30efbe.md

Mirai is a Linux-based botnet malware family that compromises internet-connected devices, particularly routers, surveillance cameras, and digital video recorders, and recruits them into infrastructure for distributed denial-of-service (DDoS) attacks. Its original propagation mechanism relies on attempting factory-default usernames and passwords on exposed devices. Compromised devices collectively generate traffic that overwhelms targeted services and disrupts availability. Mirai was used in the October 21, 2016 attack against DNS provider Dyn, which made numerous major online services unreach…

### CROSSROAD
https://mallory.ai/malware/01a14578-675b-7820-b2ab-c24b9cbdd3df.md

CROSSROAD is a Windows downloader used by the threat cluster UNC7017 in a software supply-chain campaign targeting AOMEI’s update and promotional-notification infrastructure between April and July 2026. Attackers briefly altered vendor-hosted configurations to redirect legitimate application workflows to malicious archives and trigger execution without additional user interaction. Confirmed infections involved AOMEI Backupper; AOMEI AnyViewer’s shared delivery mechanism was also targeted. The campaign was opportunistic, affecting organizations in IT services, telecommunications, and higher ed…

### XMRig
https://mallory.ai/malware/019aba62-7595-7e7a-9982-2ffed904f831.md

XMRig is legitimate, open-source cryptocurrency-mining software widely abused in cryptojacking campaigns, particularly to mine Monero using compromised systems. It runs on Linux, Windows, and macOS, including Apple Silicon. Unauthorized deployments consume victims’ processing resources and electricity and can cause sustained high CPU utilization and service degradation. XMRig is a mining component rather than inherently a credential stealer, backdoor, or self-propagating worm. Attackers deploy XMRig after exploiting internet-facing applications, abusing exposed Docker APIs, or compromising so…

### Candiru
https://mallory.ai/malware/019abad0-53f4-70b4-847c-91440e47aa86.md

Candiru is commercial surveillance spyware developed by the Israeli vendor of the same name, subsequently operating as Integrity Labs, for government customers. Its Windows tooling includes DevilsTongue and supports theft of files, credentials, messages, emails, and photographs, as well as access to microphones and cameras. Documented targets include journalists, activists, politicians, and civil society members, including people associated with the Catalan independence movement. Candiru has been delivered through targeted phishing emails and exploitation of Windows and Chrome vulnerabilities…

### ROMULUS
https://mallory.ai/malware/01a13ae2-93c8-7630-8eae-9160f51310f1.md

ROMULUS is a reusable, multi-payload malware-delivery platform used in ClickFix campaigns targeting Windows systems. It supports deceptive verification and repair pages that persuade victims to execute attacker-supplied commands. Associated campaigns have abused malicious ChatGPT Custom GPTs to direct users to these lures. Its delivery infrastructure includes an authentication panel and statistics tracking installations, executions, and geographic distribution. ROMULUS serves obfuscated PowerShell staging scripts that initiate different infection chains. One route silently installs a trojaniz…

### Haozi
https://mallory.ai/malware/01a13ab3-53eb-7eae-b333-a084142617fb.md

Haozi, also known as Phoenix, is a commercially licensed phishing-as-a-service kit used for credential theft and financial fraud. It is sold through YAM Store, an underground marketplace tracked by Microsoft as Storm-3119. Microsoft collectively tracks the developers and associated activity behind Haozi, CoGUI, and Iron Man System as Storm-2990 and attributes their development to Chinese-speaking threat actors. Haozi belongs to a group of interactive phishing kits that impersonate trusted organizations to harvest usernames, passwords, payment information, and verification codes. The kits supp…

### Chvost
https://mallory.ai/malware/01a13ae2-93c0-700e-81ae-e28edcb50be3.md

Chvost is a lightweight Windows reverse shell used by Silent Lynx in activity tracked as UAT-6275 and TAG-193. It provides interactive remote access, allowing operators to issue commands on compromised systems and receive their output. The earliest identified sample was compiled in June 2022. Chvost evolved from plaintext TCP communication to TLS using statically linked OpenSSL and incorporates XOR-based obfuscation. Analyzed implementations make a single connection attempt and lack anti-debugging checks. Chvost has been deployed in spear-phishing operations targeting government organizations…

### PickleShell
https://mallory.ai/malware/01a13ae2-93d3-7dba-be74-b0edccd24801.md

PickleShell is a C#/.NET reverse shell for Windows used in UAT-6275 campaigns, also tracked as TAG-193 and associated with Silent Lynx. It provides interactive remote command execution by launching a hidden command shell and relaying command input and output to an attacker-controlled server. It masquerades as a Windows service component, including the Distributed Transaction Coordinator. Later builds support SSL/TLS-encrypted command-and-control communications and bypass certificate validation. PickleShell has been delivered through spear-phishing campaigns using RAR archives containing malic…

### Hirudo
https://mallory.ai/malware/01a139cf-cd0f-7499-b715-82c9bef00f2c.md

Hirudo is an Android banking trojan with extensive remote-access capabilities, identified by ThreatFabric. It combines credential theft and live device control with replacement of legitimate banking applications by modified copies. Dedicated replacements have been identified for eight Indonesian banking applications across seven banks. Its configured credential targets also include financial applications associated with China, India, Mexico, Morocco, and Thailand. Hirudo is distributed through apparently functional shopping, adult-video, and short-drama applications promoted through social me…

### Laplas
https://mallory.ai/malware/019abd9b-8caa-7d29-8998-2b4cb61cd895.md

Laplas is a lightweight C++ reverse shell for Windows used to provide interactive command execution on compromised systems. It connects to an external command-and-control server, launches the Windows command interpreter with redirected pipes, and relays commands and their output between the operator and the infected host. Identified variants support TLS-encrypted communications and incorporate debugger detection and XOR-based obfuscation. Laplas is used by UAT-6275, also tracked as TAG-193, in activity overlapping the Silent Lynx threat cluster. These operations target government organization…

### KGB RAT
https://mallory.ai/malware/019d921d-44f8-7f3d-811c-a545615b2cf6.md

KGB RAT is a Windows remote access trojan sold through a malware-as-a-service model and deceptively marketed as legitimate remote administration software. Analyzed samples are predominantly x86 .NET executables written in VB.NET and derived from NjRAT, including obfuscated variants and encrypted loaders that reconstruct payloads at runtime. Multiple operators use a shared builder with different command-and-control configurations and optional modules. Its capabilities include remote desktop control, keylogging, screenshot capture, clipboard monitoring, file management, and credential harvestin…

### LegionLoader
https://mallory.ai/malware/019d7da8-7729-7908-91c9-3eb8739e7088.md

LegionLoader, also known as CurlyGate, RobotDropper, and Satacom, is a Windows malware loader and downloader active since 2019. It retrieves and executes additional payloads while providing backdoor functionality and collecting sensitive browser information. Its command-driven capabilities include executing native PE files, shellcode, PowerShell scripts, and Windows Installer packages. It supports custom in-memory PE loading, process injection, process hollowing, and persistence through Windows logon registry mechanisms. LegionLoader registers compromised hosts with its command-and-control in…

## Blog

### Rapid Response: PHP's Critical RCE Fixes Skip 884,000 Internet-Facing Hosts
https://mallory.ai/blog/php-rce-rapid-response — October 20, 2026

PHP patches two critical RCEs on October 21, but only for 8.2 and later. About 884,000 internet-facing hosts run a branch that will get no fix.

### Findings: Fix What Matters First
https://mallory.ai/blog/mallory-findings — October 8, 2026

Mallory Agents investigate alerts and advisories, then file findings with evidence, severity, and remediation steps your team can triage, route, and track.

### A Conversation With Jace Davis, Mallory's First Sales Hire
https://mallory.ai/blog/family-is-the-why-jace-davis — October 6, 2026

Jace Davis, Mallory's first sales hire, on what drives him, why he wanted to build from a blank page, and the impact he wants to have.

### The Mallory App for Splunk Closes the Loop on Every Match
https://mallory.ai/blog/mallory-app-for-splunk — September 15, 2026

The Mallory App for Splunk imports Mallory's threat intelligence into Splunk ES, matches it against your telemetry, and reports every confirmed match back to Mallory as a sighting, automatically.

### Nightmare-Eclipse Moves Past Windows Defender.
https://mallory.ai/blog/nightmare-eclipse-moves-past-defender — September 9, 2026

Nightmare-Eclipse expanded past Windows Defender to CrowdStrike, Avast, Kaspersky, and NVIDIA this year. Here's what's patched, confirmed, and still just a claim.

### Why I Bet on Mallory's Team, Not Just Its Category
https://mallory.ai/blog/joining-mallory-as-founding-marketing-lead — September 4, 2026

Why I joined Mallory as Founding Marketing Lead, and why this team is finally building exposure management right instead of bolting it on.

### We Turned Claude Code Into a Malware Analysis System
https://mallory.ai/blog/mortex-claude-code-malware-analysis — September 2, 2026

At Black Hat USA 2026, Mallory researcher Maxim Gofnung traces Mortex from a one-off Claude Code result through a coordination failure, a runtime gap static analysis cannot see, and a sealed case landing in Mallory.

### Bring Your Own Key Is Now Generally Available
https://mallory.ai/blog/byok-bring-your-own-key — August 18, 2026

BYOK lets the Mallory Agent reason on the AI provider your organization already vetted and contracted, instead of Mallory's own model account.

### Adversary Timelines Have Collapsed: Defenders Must Rethink Proactive Security with Agents
https://mallory.ai/blog/adversary-timelines-collapsed — August 4, 2026

AI has cut disclosure-to-exploitation to hours. Mallory's new architecture unifies context, reasoning, and policy so agents can act safely, under your rules.

### Five Eyes to Boards: Back to Basics, Faster
https://mallory.ai/blog/five-eyes-ai-shift — June 24, 2026

Six cybersecurity agency heads signed one statement on AI and cyber risk. Their answer is not more tools. It is the basics, done faster, because the gap between disclosure and exploitation is shrinking to months.

### The Real Change in BOD 26-04 Is Forensic Triage
https://mallory.ai/blog/bod-26-04-forensic-triage — June 12, 2026

CISA's new directive replaces fixed KEV deadlines with risk-based timelines. The bigger change: for the highest-risk vulnerabilities, agencies must now determine whether the asset was already compromised, within 72 hours.

### Compromised Packages Drop Daily. Are You Running Any of Them?
https://mallory.ai/blog/supply-chain-compromised-package-audit — June 2, 2026

From an overnight supply chain compromise to a scheduled audit of your own GitHub org. A live stream of compromised packages, an agent that checks whether you're running any of them, and a daily 6am email with the answer.

### Mallory is now SOC 2 Type 2 certified
https://mallory.ai/blog/soc2-type2-certified — May 23, 2026

Our SOC 2 Type 2 examination is complete, less than 60 days after GA. The report is available to security teams under NDA.

### VulnOps, Minus the Mythology
https://mallory.ai/blog/mythos-vuln-ops-patchmageddon — May 7, 2026

Vuln-ops gets talked about like a mythology. Here's what five minutes of it actually looks like in Mallory, from a Slack ping on Bleeding Llama (CVE-2026-7482) to on-demand Suricata rules.

### Enhancing Cyber Situational Awareness with Mallory Stories
https://mallory.ai/blog/delivering-signal-over-noise — April 22, 2026

Cyber defense starts with situational awareness. Mallory Stories cluster millions of references into one coherent view, tailored to your environment.

### Why I'm Backing Mallory
https://mallory.ai/blog/why-im-backing-mallory — April 23, 2026

The Mallory team has built a modern cyber-security platform that sits at the intersection of AI-Native Operations and Exposure Management. Mallory's agentic capabilities serve several use cases, builders, and operators alike.

### Mallory on Unsupervised Learning
https://mallory.ai/blog/demoing-mallory-unsupervised-learning — April 6, 2026

Jonathan Cran joins Daniel Miessler on Unsupervised Learning for a full walkthrough of Mallory — from real-time threat stories and entity resolution to scheduled monitoring, asset context, and agent integration.

### HD Moore on Delivering Value with Mallory
https://mallory.ai/blog/hd-moore-delivering-value — April 6, 2026

The runZero co-founder on how his team uses Mallory to get ahead of new vulnerabilities — often notifying customers before the first news article drops.

### Announcing Decibel's Investment in Mallory
https://mallory.ai/blog/dan-nguyen-huu-investing-in-mallory — April 6, 2026

Decibel partner Dan Nguyen-Huu on the evolution of threat intelligence — from raw data feeds to contextualized, actionable insight delivered in the context of your environment.

### Matt Johansen on AI Native Cyber Threat Intelligence
https://mallory.ai/blog/mattjay-new-approach-threat-intel — April 6, 2026

Longtime security practitioner Matt Johansen on why LLMs change everything for threat intelligence — from natural language queries to agents that act on intel autonomously.

### John Sapp, CISO Texas Mutual: Where Mallory Fits
https://mallory.ai/blog/john-sapp-force-multiplier — April 9, 2026

John Sapp runs dual managed services to triage alerts down to true positives. From there, Mallory is the force multiplier that enables his analysts to investigate deeply and respond fast.

### Meet the Founder: Why We Built Mallory
https://mallory.ai/blog/meet-the-founders — March 23, 2026

Our CEO Jonathan Cran on the problem Mallory was built to solve: helping security teams figure out if they're affected and take action, fast.

### Mallory goes GA: Introducing our AI-Native Threat Intelligence Platform
https://mallory.ai/blog/launching-mallory — April 9, 2026

Today, we're launching Mallory, our AI-Native Threat Intelligence Platform built for exposure investigation. Here's why we built it, what it does, and what's next.

### Introducing Mallory
https://mallory.ai/blog/introducing-mallory — September 29, 2025

We're excited to introduce Mallory, a stealth-mode startup focused on supporting security operations teams through high quality and operationally efficient cyber threat intelligence.

---
Curated index: https://mallory.ai/llms.txt