MalwareUsed by 4 actors

Tambur

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Sandworm

Як правило, реалізація зловмисного задуму здійснювалася із застосуванням вже відомих програмних засобів KALAMBUR, SUMBUR, TAMBUR

via cert uacert.gov.ua

UAC-0002

via cert uacert.gov.ua

UAC-0145

via cert uacert.gov.ua

APT-C-13

Weixin analysts at the 360 Threat Intelligence Center identified this campaign and confirmed that APT-C-13 is deploying a modular penetration framework known as the Tambur/Sumbur/Kalambur series.

via cyber security newscybersecuritynews.com

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1195Supply Chain CompromiseEvidence1

...одним з основних способів отримання первинного доступ був вектор "пасивної" компрометації, що полягав у завантаженні користувачем з торент-трекерів інсталяторів програмних продуктів ... які містили вбудований бекдор.

T1566PhishingEvidence2

...набули поширення випадки розповсюдження програмних засобів реалізації кіберзагроз у месенджері Signal під виглядом необхідності встановлення "антивірусного захисту".

Execution

2 techniques

T1053.005Scheduled TaskEvidence1

The Tambur module establishes persistence by planting scheduled tasks named “Tambur” and “Protector” inside the \Microsoft\Windows\WDI\Protector\ path — a location designed to look exactly like a native Windows Diagnostic Infrastructure component.

T1059.001PowerShellEvidence1

Because the attack chain primarily abuses legitimate Windows tools — including scheduled tasks, SSH, PowerShell, and RDP — standard antivirus solutions often fail to raise alerts.

Persistence

1 technique

T1053.005Scheduled TaskEvidence1

Privilege Escalation

1 technique

T1053.005Scheduled TaskEvidence1

Credential Access

1 technique

T1528Steal Application Access TokenEvidence1

...поширення набули програмні засоби для викрадення ключів та даних месенджерів Signal, WhatsApp...

Lateral Movement

2 techniques

T1021.001Remote Desktop ProtocolEvidence1

One of the world’s most dangerous state-backed hacking groups is actively targeting Remote Desktop Protocol (RDP) servers across critical infrastructure, defense organizations, and government agencies... these tasks run with full administrator-level privileges and use a hardcoded password (1qaz@WSX) to maintain constant, uninterrupted access to the RDP service on the infected host.

T1570Lateral Tool TransferEvidence1

...скомпрометований в такий спосіб комп'ютер був використаний для забезпечення присутності та горизонтального переміщення в локальній мережі організації...

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cert uaNews

Jul 15, 2026

CERT-UA

Named malware/tool used by the UAC-0145 cluster in prior intrusion activity.

cyber security newsNews

Mar 24, 2026

APT Hackers Attacking RDP Servers to Deploy Malicious Payloads and Establish Persistence

A modular intrusion framework used by Sandworm/APT-C-13 for long-term covert access. Tambur establishes persistence via scheduled tasks and maintains RDP access; Kalambur and Sumbur route C2 through Tor and use SSH reverse tunneling to expose victim RDP services remotely. Sumbur also mimics Microsoft Edge update activity for stealth.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution4

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 4 actors

Tambur

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Sandworm

via cert uacert.gov.ua

UAC-0002

via cert uacert.gov.ua

UAC-0145

via cert uacert.gov.ua

APT-C-13

Weixin analysts at the 360 Threat Intelligence Center identified this campaign and confirmed that APT-C-13 is deploying a modular penetration framework known as the Tambur/Sumbur/Kalambur series.

via cyber security newscybersecuritynews.com

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1195Supply Chain CompromiseEvidence1

T1566PhishingEvidence2

Execution

2 techniques

T1053.005Scheduled TaskEvidence1

T1059.001PowerShellEvidence1

Because the attack chain primarily abuses legitimate Windows tools — including scheduled tasks, SSH, PowerShell, and RDP — standard antivirus solutions often fail to raise alerts.

Persistence

1 technique

T1053.005Scheduled TaskEvidence1

Privilege Escalation

1 technique

T1053.005Scheduled TaskEvidence1

Credential Access

1 technique

T1528Steal Application Access TokenEvidence1

...поширення набули програмні засоби для викрадення ключів та даних месенджерів Signal, WhatsApp...

Lateral Movement

2 techniques

T1021.001Remote Desktop ProtocolEvidence1

T1570Lateral Tool TransferEvidence1

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cert uaNews

Jul 15, 2026

CERT-UA

Named malware/tool used by the UAC-0145 cluster in prior intrusion activity.

cyber security newsNews

Mar 24, 2026

APT Hackers Attacking RDP Servers to Deploy Malicious Payloads and Establish Persistence

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution4

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.