Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Victims were served ClickFix-style lures to deliver Windows, Android, and iOS malware tailored to their device; the Windows tools included CloudSyncSvc.
3 distinct techniques documented for this family, organized by ATT&CK tactic.
They used compromised admin credentials to modify DNS records so that they pointed to services owned by the actor.
Victims were redirected to disposable hosting servers to retrieve malware via phishing, ClickFix, and DNS hijacking schemes.
Victims were served ClickFix-style lures to deliver Windows, Android, and iOS malware tailored to their device.
45 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.