MalwareUsed by 1 actor

STANDOFF COORD

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Operation STANDOFF

La console, une application React single-page servie sur 212.193.30.29 , est une plateforme collaborative d’intrusion ciblant les environnements Active Directory

via cyberveillecyberveille.ch

MITRE ATT&CK

Techniques & procedures

25 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1053.005Scheduled TaskEvidence1

des tâches planifiées (Schedule.Service.1)

T1059.001PowerShellEvidence1

T1059.001 — Command and Scripting Interpreter: PowerShell (Execution)

Persistence

2 techniques

T1053.005Scheduled TaskEvidence1

des tâches planifiées (Schedule.Service.1)

T1543.003Windows ServiceEvidence1

des services aux noms VirtualBox (VBoxGuest, VBoxMouse, VBoxSF, VBoxService, VBoxVideo, VBoxWddm)

Privilege Escalation

4 techniques

T1053.005Scheduled TaskEvidence1

des tâches planifiées (Schedule.Service.1)

T1055Process InjectionEvidence1

T1055 — Process Injection (Defense Evasion)

T1055.012Process HollowingEvidence1

T1055.012 — Process Injection: Process Hollowing (Defense Evasion)

T1543.003Windows ServiceEvidence1

des services aux noms VirtualBox (VBoxGuest, VBoxMouse, VBoxSF, VBoxService, VBoxVideo, VBoxWddm)

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

T1027 — Obfuscated Files or Information (Defense Evasion)

T1036MasqueradingEvidence1

La persistance est établie via : un faux processus système C:\Windows\rss\csrss.exe

T1055Process InjectionEvidence1

T1055 — Process Injection (Defense Evasion)

T1055.012Process HollowingEvidence1

T1055.012 — Process Injection: Process Hollowing (Defense Evasion)

Credential Access

5 techniques

T1003OS Credential DumpingEvidence1

T1003 — OS Credential Dumping (Credential Access)

T1110.003Password SprayingEvidence1

T1110.003 — Brute Force: Password Spraying (Credential Access)

T1539Steal Web Session CookieEvidence1

Socelars (vol de tokens) ... Vault de credentials typés : ... cookie

T1552.001Credentials In FilesEvidence1

T1552.001 — Unsecured Credentials: Credentials In Files (Credential Access)

T1557Adversary-in-the-MiddleEvidence1

T1557 — Adversary-in-the-Middle (Credential Access)

Discovery

3 techniques

T1057Process DiscoveryEvidence1

T1057 — Process Discovery (Discovery)

T1082System Information DiscoveryEvidence1

T1082 — System Information Discovery (Discovery)

T1083File and Directory DiscoveryEvidence1

T1083 — File and Directory Discovery (Discovery)

Lateral Movement

2 techniques

T1550.002Pass the HashEvidence1

Vault de credentials typés : ... hash (NTLM) ... ; T1550.002 — Use Alternate Authentication Material: Pass the Hash (Lateral Movement)

T1550.003Pass the TicketEvidence1

Vault de credentials typés : ... kerberos_ticket ... ; T1550.003 — Use Alternate Authentication Material: Pass the Ticket (Lateral Movement)

Collection

3 techniques

T1005Data from Local SystemEvidence1

T1005 — Data from Local System (Collection)

T1113Screen CaptureEvidence1

T1113 — Screen Capture (Collection)

T1557Adversary-in-the-MiddleEvidence1

T1557 — Adversary-in-the-Middle (Credential Access)

Command and Control

4 techniques

T1071.001Web ProtocolsEvidence1

Un User-Agent WinHTTP malformé ... constitue une signature réseau distinctive.

T1090ProxyEvidence1

212.193.30.45 : sert /proxies.txt ... ; gestion de proxies (consommant le pool du botnet)

T1102Web ServiceEvidence1

Des dead-drop resolvers sur Telegram ... Mastodon ... et Pastebin assurent la résilience du C2.

T1568Dynamic ResolutionEvidence1

Des dead-drop resolvers sur Telegram ... Mastodon ... et Pastebin assurent la résilience du C2.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

T1041 — Exfiltration Over C2 Channel (Exfiltration)

Other

1 technique

T1562.001Disable or Modify ToolsEvidence1

désactivation de Microsoft Defender (real-time monitoring, MAPS, exclusion du répertoire de staging)

INDICATORS OF COMPROMISE

IOCs tracked for this family

67 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

65 tracked

IPs, domains, and DNS infrastructure linked to this family.

Other

2 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyberveilleNews

Jul 26, 2026

Operation STANDOFF : campagne cybercriminelle russe multi-couches avec botnet, intrusion AD et influence IA | CyberVeille

Operator framework/console used by the campaign for collaborative intrusion management, credential vaulting, host inventory, tasking, and AD-focused operations.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching67

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping25

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

STANDOFF COORD

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Operation STANDOFF

La console, une application React single-page servie sur 212.193.30.29 , est une plateforme collaborative d’intrusion ciblant les environnements Active Directory

via cyberveillecyberveille.ch

MITRE ATT&CK

Techniques & procedures

25 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1053.005Scheduled TaskEvidence1

des tâches planifiées (Schedule.Service.1)

T1059.001PowerShellEvidence1

T1059.001 — Command and Scripting Interpreter: PowerShell (Execution)

Persistence

2 techniques

T1053.005Scheduled TaskEvidence1

des tâches planifiées (Schedule.Service.1)

T1543.003Windows ServiceEvidence1

des services aux noms VirtualBox (VBoxGuest, VBoxMouse, VBoxSF, VBoxService, VBoxVideo, VBoxWddm)

Privilege Escalation

4 techniques

T1053.005Scheduled TaskEvidence1

des tâches planifiées (Schedule.Service.1)

T1055Process InjectionEvidence1

T1055 — Process Injection (Defense Evasion)

T1055.012Process HollowingEvidence1

T1055.012 — Process Injection: Process Hollowing (Defense Evasion)

T1543.003Windows ServiceEvidence1

des services aux noms VirtualBox (VBoxGuest, VBoxMouse, VBoxSF, VBoxService, VBoxVideo, VBoxWddm)

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

T1027 — Obfuscated Files or Information (Defense Evasion)

T1036MasqueradingEvidence1

La persistance est établie via : un faux processus système C:\Windows\rss\csrss.exe

T1055Process InjectionEvidence1

T1055 — Process Injection (Defense Evasion)

T1055.012Process HollowingEvidence1

T1055.012 — Process Injection: Process Hollowing (Defense Evasion)

Credential Access

5 techniques

T1003OS Credential DumpingEvidence1

T1003 — OS Credential Dumping (Credential Access)

T1110.003Password SprayingEvidence1

T1110.003 — Brute Force: Password Spraying (Credential Access)

T1539Steal Web Session CookieEvidence1

Socelars (vol de tokens) ... Vault de credentials typés : ... cookie

T1552.001Credentials In FilesEvidence1

T1552.001 — Unsecured Credentials: Credentials In Files (Credential Access)

T1557Adversary-in-the-MiddleEvidence1

T1557 — Adversary-in-the-Middle (Credential Access)

Discovery

3 techniques

T1057Process DiscoveryEvidence1

T1057 — Process Discovery (Discovery)

T1082System Information DiscoveryEvidence1

T1082 — System Information Discovery (Discovery)

T1083File and Directory DiscoveryEvidence1

T1083 — File and Directory Discovery (Discovery)

Lateral Movement

2 techniques

T1550.002Pass the HashEvidence1

Vault de credentials typés : ... hash (NTLM) ... ; T1550.002 — Use Alternate Authentication Material: Pass the Hash (Lateral Movement)

T1550.003Pass the TicketEvidence1

Vault de credentials typés : ... kerberos_ticket ... ; T1550.003 — Use Alternate Authentication Material: Pass the Ticket (Lateral Movement)

Collection

3 techniques

T1005Data from Local SystemEvidence1

T1005 — Data from Local System (Collection)

T1113Screen CaptureEvidence1

T1113 — Screen Capture (Collection)

T1557Adversary-in-the-MiddleEvidence1

T1557 — Adversary-in-the-Middle (Credential Access)

Command and Control

4 techniques

T1071.001Web ProtocolsEvidence1

Un User-Agent WinHTTP malformé ... constitue une signature réseau distinctive.

T1090ProxyEvidence1

212.193.30.45 : sert /proxies.txt ... ; gestion de proxies (consommant le pool du botnet)

T1102Web ServiceEvidence1

Des dead-drop resolvers sur Telegram ... Mastodon ... et Pastebin assurent la résilience du C2.

T1568Dynamic ResolutionEvidence1

Des dead-drop resolvers sur Telegram ... Mastodon ... et Pastebin assurent la résilience du C2.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

T1041 — Exfiltration Over C2 Channel (Exfiltration)

Other

1 technique

T1562.001Disable or Modify ToolsEvidence1

désactivation de Microsoft Defender (real-time monitoring, MAPS, exclusion du répertoire de staging)

INDICATORS OF COMPROMISE

IOCs tracked for this family

67 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

65 tracked

IPs, domains, and DNS infrastructure linked to this family.

Other

2 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyberveilleNews

Jul 26, 2026

Operation STANDOFF : campagne cybercriminelle russe multi-couches avec botnet, intrusion AD et influence IA | CyberVeille

Operator framework/console used by the campaign for collaborative intrusion management, credential vaulting, host inventory, tasking, and AD-focused operations.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching67

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping25

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.