Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
We also found indications of additional implant(s): ‘Cryshell’– a custom implant used for bouncing connections in an internal network to external command-and-control servers, with support for custom port knocking sequences.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
When the TCP KNOCK communication method is enabled, the metaMain and Mafalda implants can establish an indirect connection to the C2 server through another implant... metaMain and Mafalda authenticate themselves to Cryshell through a port-knocking and handshake procedure.
When the TCP KNOCK communication method is enabled, the metaMain and Mafalda implants can establish an indirect connection to the C2 server through another implant... metaMain and Mafalda authenticate themselves to Cryshell through a port-knocking and handshake procedure.
‘Cryshell’– a custom implant used for bouncing connections in an internal network to external command-and-control servers... When the TCP KNOCK communication method is enabled, the metaMain and Mafalda implants can establish an indirect connection to the C2 server through another implant.
When the TCP KNOCK communication method is enabled, the metaMain and Mafalda implants can establish an indirect connection to the C2 server through another implant... metaMain and Mafalda authenticate themselves to Cryshell through a port-knocking and handshake procedure.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.