Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
One of the central hosts in the bank, which was running SWIFT Alliance software, contained a fully-fledged backdoor ... which has the same strong code and protocol design as a family of backdoors dubbed Romeo by Novetta.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Family of Lazarus backdoors/RATs used as a comparison point and explicitly linked by code/protocol design to backdoors found in the bank intrusions.
A Lazarus backdoor/RAT family used as a code-design reference point; backdoors found in the incidents matched the Romeo family design and helped link the operations to Lazarus.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.