Loading malware…
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
FLAME SPRAY - Windows-based remote-controlled malware with strong anti-analysis features. Can be customized to generate different types of servers.
FLAME SPRAY - Windows-based remote-controlled malware with strong anti-analysis features. Can be customized to generate different types of servers.
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Using this MiTM platform, they allegedly hijacked internal hosts and servers of the University before deploying further tools for remote control of the systems.
NOPEN: A remote-controlled malware that provided NSA operators with ongoing access to compromised systems. It allowed for file execution, process management, system command execution, and privilege escalation ... FLAME SPRAY - Windows-based remote-controlled malware ... STOIC SURGEON: A stealthy backdoor targeting Linux, Solaris, JunOS, and FreeBSD systems.
Encrypted Communications: All NSA tools leveraged encryption, ensuring that traffic to their command-and-control (C2) servers remained undetectable.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.