Loading malware…
8 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
L’opérateur a déployé SecFlow, un framework d’orchestration IA qui répartit les tâches de reconnaissance, exploitation, collecte et reporting entre des workers spécialisés utilisant Claude (ACP), Qwen Code et DeepSeek.
9 distinct techniques documented for this family, organized by ATT&CK tactic.
SecFlow automated traditional hacking tasks, such as scanning for vulnerabilities.
The AI models... helped automate and organize traditional hacking tasks, such as... testing stolen credentials.
Operators achieved Windows command execution through internet-facing web applications.
A malicious service impersonating a MySQL database would accept connections from vulnerable Java applications, then return specially crafted data designed to trigger unsafe object deserialization on the client side.
The AI models... helped automate and organize traditional hacking tasks, such as... testing stolen credentials.
The AI models... helped automate and organize traditional hacking tasks, such as... testing stolen credentials.
The AI models... helped automate and organize traditional hacking tasks, such as... testing stolen credentials.
“Confirmed compromises included command execution, LSASS and registry-hive theft...”
“Confirmed compromises included command execution, LSASS and registry-hive theft...”
The implant could execute commands, transfer files, scan ports, proxy traffic, and use replacement command-and-control routes.
“Confirmed compromises included ... government and health-record access, and university database compromise...”
The implant could ... proxy traffic... Analysts ... trac[ed] a shared SOCKS proxy across five connected workspaces.
16 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.