Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
12 distinct techniques documented for this family, organized by ATT&CK tactic.
Threat actors delivering modern campaigns are using browser and operating system information to deliver increasingly targeted content. This information is collected from the “User-Agent” provided by the browser when victims visit a landing page via a URL embedded in an email or attachment.
This sample of ConnectWise RAT connects to a C2 which is actively monitored by a threat actor. Shortly after checking in, the threat actor takes remote control of any infected computers.
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A legitimate remote access tool abused by threat actors in multi-stage phishing campaigns, often as a second-stage payload to establish remote control, persistence, and support follow-on access sales or additional payload delivery.
A legitimate remote access tool repurposed by threat actors as a remote access trojan in phishing campaigns, often delivered to Windows victims and used to gain access while evading signature-based defenses.
A trusted remote access tool cited as being repurposed by threat actors for malicious remote access in phishing campaigns, making detection harder.
A legitimate remote access tool abused by threat actors and delivered via a malicious website linked from a spoofed Zoom meeting invitation.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.