Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Another tool that was used for this purpose is incognito V2 – for token manipulation and impersonation.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
The content repeatedly states that threat actors 'obtained,' 'acquired,' or 'used' publicly available, open-source, legitimate, or modified tools such as Mimikatz, Cobalt Strike, PsExec, Empire, Impacket, and many others.
Another tool that was used for this purpose is incognito V2 – for token manipulation and impersonation.
Another tool that was used for this purpose is incognito V2 – for token manipulation and impersonation.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.