APT28 — Attack group profile
APT28 was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…
Category: Attack Groups
MITRE ATT&CK groups, threat actors, intrusion sets and activity clusters.
Volt Typhoon: China-Nexus Threat Actor Using JDY Botnet
Volt Typhoon is a Chinese state-sponsored hacking group that has been observed using the JDY botnet for reconnaissance and targeting of vulnerable…
GrayBravo: Threat Activity Cluster Behind CastleLoader and CastleStealer
GrayBravo is a threat activity cluster attributed to distributing CastleLoader and CastleStealer malware. The group is known for using ClickFix-style lures and…
PolinRider: Threat Cluster Using Blockchain-Based C2
PolinRider is a threat cluster assessed to be related to the Contagious Interview campaign, known for using multi-blockchain resolver structures (Tron, Aptos,…
Russian-Speaking IAB Behind FortiBleed Credential Harvesting Campaign
A financially motivated Russian-speaking initial access broker (IAB) is assessed to be behind the FortiBleed campaign, which has targeted over 430,000 FortiGate…
SantaAd: Russian-Speaking Account Advertising Fortinet Device Access
A Russian-speaking account named SantaAd advertised access to thousands of Fortinet devices for a starting price of $30,000, later increased to $60,000.…
FortiBleed: 110 Million Credentials Harvested via FortiGate Firewalls in Global Campaign
A Russian-speaking initial access broker (IAB) has been linked to a large-scale credential-harvesting operation dubbed FortiBleed, targeting over 430,000 FortiGate firewalls globally…
Prince Group: Transnational Criminal Organization in Southeast Asian Scam Compounds
Prince Group is a Cambodia-based conglomerate classified as a Transnational Criminal Organization (TCO) by the U.S. Treasury for its role in operating…
HuiOne Group: Enabler of Cyber Scam Money Laundering
HuiOne Group is a Cambodia-based conglomerate whose subsidiaries operated an illicit Telegram marketplace, HuiOne Guarantee, facilitating money laundering for cryptocurrency investment fraud…
plymouth: Threat Actor Behind StealC Infostealer
plymouth is the threat actor who sells the StealC information stealer under a malware-as-a-service model, charging $300 per month or $1,000 for…