Loading malware…
4 distinct techniques documented for this family, organized by ATT&CK tactic.
we have uncovered nearly 300 repositories with similar redirect links, where the threat actor is using SEO keywords to attract victims
a link disguised as an ‘Official Page’ led unsuspecting victims to download a ZIP archive containing several malicious executables
Within was an unofficial file named “Arctic-Wolf-3.9.7.exe”. Running this trojanized executable runs another file disguised as the dynamic-link library “libcurl.dll”.
identified a GitHub page impersonating Arctic Wolf to target our customers and prospects
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.