MalwareUsed by 1 actor

FFmpeg

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

LongNosedGoblin

"...an argument runner ... was used to run a video recorder, likely FFmpeg, to capture audio and video."

via dark readingdarkreading.com

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1589Gather Victim Identity InformationEvidence1

フェイク動画を作成するためには、オリジナル(= 筆者 )とターゲット(= 同僚A )の顔をDeep Learningで学習させる必要があります。このため、学習用の顔画像を大量に収集します。

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence2

“Uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execute arbitrary system commands when video generation occurs.”

T1203Exploitation for Client ExecutionEvidence1

"Use ffmpeg to convert to raw PCM audio" with "announcement.media_id" marked as "attacker-controlled" and supplied as a concat/subfile/file URI targeting "/proc/self/environ."

Lateral Movement

1 technique

T1210Exploitation of Remote ServicesEvidence1

Chained with FFmpeg's source-URL handling, this created a potential path to remote code execution on the streaming host.

Collection

3 techniques

T1005Data from Local SystemEvidence1

The crafted media_id targets "file:///proc/self/environ"; the received output contains "HASSIO_TOKEN", "SUPERVISOR_TOKEN", environment variables, and process configuration.

T1113Screen CaptureEvidence5

ffmpeg... used for gdigrab desktop screen capture streaming.

T1125Video CaptureEvidence3

今回は検証用に弊社会議室で撮影した同僚Aの動画(約1分間)から、30fps(30フレーム/1秒)で画像を抽出しました。

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

Early versions of the malware could receive a command to download a file and execute it.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

"This satellite is where we will receive the exfiltrated data" and the attacker-controlled Wyoming server reports that "HA connected" and saved "raw bytes" containing environment data.

Impact

2 techniques

T1499.001OS Exhaustion FloodEvidence1

An attacker-controlled server that never closes the connection causes the server process to accumulate memory indefinitely. For video, frame PNGs grow rapidly until disk exhaustion while FFmpeg saturates CPU.

T1499.004Application or System ExploitationEvidence2

The endpoint fetches attacker-supplied media URLs into server memory with no byte limit, and extracts every frame of a supplied video when num_frames is None, allowing exhaustion of server memory, disk space, and CPU.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

dark readingNews

Dec 19, 2025

LongNosedGoblin Caught Snooping on Asian Governments

Legitimate multimedia tool likely repurposed by the threat actor to record audio/video from compromised systems.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

FFmpeg

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

LongNosedGoblin

"...an argument runner ... was used to run a video recorder, likely FFmpeg, to capture audio and video."

via dark readingdarkreading.com

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1589Gather Victim Identity InformationEvidence1

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence2

T1203Exploitation for Client ExecutionEvidence1

"Use ffmpeg to convert to raw PCM audio" with "announcement.media_id" marked as "attacker-controlled" and supplied as a concat/subfile/file URI targeting "/proc/self/environ."

Lateral Movement

1 technique

T1210Exploitation of Remote ServicesEvidence1

Chained with FFmpeg's source-URL handling, this created a potential path to remote code execution on the streaming host.

Collection

3 techniques

T1005Data from Local SystemEvidence1

The crafted media_id targets "file:///proc/self/environ"; the received output contains "HASSIO_TOKEN", "SUPERVISOR_TOKEN", environment variables, and process configuration.

T1113Screen CaptureEvidence5

ffmpeg... used for gdigrab desktop screen capture streaming.

T1125Video CaptureEvidence3

今回は検証用に弊社会議室で撮影した同僚Aの動画(約1分間)から、30fps(30フレーム/1秒)で画像を抽出しました。

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

Early versions of the malware could receive a command to download a file and execute it.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

"This satellite is where we will receive the exfiltrated data" and the attacker-controlled Wyoming server reports that "HA connected" and saved "raw bytes" containing environment data.

Impact

2 techniques

T1499.001OS Exhaustion FloodEvidence1

T1499.004Application or System ExploitationEvidence2

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

dark readingNews

Dec 19, 2025

LongNosedGoblin Caught Snooping on Asian Governments

Legitimate multimedia tool likely repurposed by the threat actor to record audio/video from compromised systems.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.