MalwareUsed by 3 actors

Sumbur

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Sandworm

Як правило, реалізація зловмисного задуму здійснювалася із застосуванням вже відомих програмних засобів KALAMBUR, SUMBUR, TAMBUR

via cert uacert.gov.ua

UAC-0002

via cert uacert.gov.ua

UAC-0145

via cert uacert.gov.ua

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1195Supply Chain CompromiseEvidence1

...одним з основних способів отримання первинного доступ був вектор "пасивної" компрометації, що полягав у завантаженні користувачем з торент-трекерів інсталяторів програмних продуктів ... які містили вбудований бекдор.

T1566PhishingEvidence2

...набули поширення випадки розповсюдження програмних засобів реалізації кіберзагроз у месенджері Signal під виглядом необхідності встановлення "антивірусного захисту".

Execution

2 techniques

T1059.001PowerShellEvidence1

Because the attack chain primarily abuses legitimate Windows tools — including scheduled tasks, SSH, PowerShell, and RDP — standard antivirus solutions often fail to raise alerts.

T1059.005Visual BasicEvidence1

Sumbur, the more refined iteration of this framework, mimics Microsoft Edge’s update service — storing malicious VBScripts in a fake Edge update directory and triggering them every four hours to blend seamlessly with normal software activity.

Stealth

1 technique

T1036MasqueradingEvidence1

Credential Access

1 technique

T1528Steal Application Access TokenEvidence1

...поширення набули програмні засоби для викрадення ключів та даних месенджерів Signal, WhatsApp...

Lateral Movement

3 techniques

T1021.001Remote Desktop ProtocolEvidence1

One of the world’s most dangerous state-backed hacking groups is actively targeting Remote Desktop Protocol (RDP) servers across critical infrastructure, defense organizations, and government agencies... these tasks run with full administrator-level privileges and use a hardcoded password (1qaz@WSX) to maintain constant, uninterrupted access to the RDP service on the infected host.

T1021.004SSHEvidence1

Using SSH reverse tunneling, the attacker maps the victim’s RDP port (3389) to a remote C2 server, enabling silent remote logins from anywhere in the world.

T1570Lateral Tool TransferEvidence1

...скомпрометований в такий спосіб комп'ютер був використаний для забезпечення присутності та горизонтального переміщення в локальній мережі організації...

Command and Control

1 technique

T1090ProxyEvidence1

The Kalambur and Sumbur modules extend this control further by routing all command-and-control (C2) traffic through the Tor anonymous network, effectively masking the attacker’s real location.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cert uaNews

Jul 15, 2026

CERT-UA

Named malware/tool used by the UAC-0145 cluster in prior intrusion activity.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution3

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 3 actors

Sumbur

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Sandworm

via cert uacert.gov.ua

UAC-0002

via cert uacert.gov.ua

UAC-0145

via cert uacert.gov.ua

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1195Supply Chain CompromiseEvidence1

T1566PhishingEvidence2

Execution

2 techniques

T1059.001PowerShellEvidence1

Because the attack chain primarily abuses legitimate Windows tools — including scheduled tasks, SSH, PowerShell, and RDP — standard antivirus solutions often fail to raise alerts.

T1059.005Visual BasicEvidence1

Stealth

1 technique

T1036MasqueradingEvidence1

Credential Access

1 technique

T1528Steal Application Access TokenEvidence1

...поширення набули програмні засоби для викрадення ключів та даних месенджерів Signal, WhatsApp...

Lateral Movement

3 techniques

T1021.001Remote Desktop ProtocolEvidence1

T1021.004SSHEvidence1

Using SSH reverse tunneling, the attacker maps the victim’s RDP port (3389) to a remote C2 server, enabling silent remote logins from anywhere in the world.

T1570Lateral Tool TransferEvidence1

Command and Control

1 technique

T1090ProxyEvidence1

The Kalambur and Sumbur modules extend this control further by routing all command-and-control (C2) traffic through the Tor anonymous network, effectively masking the attacker’s real location.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cert uaNews

Jul 15, 2026

CERT-UA

Named malware/tool used by the UAC-0145 cluster in prior intrusion activity.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution3

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.