Handala
Rank: 1
THREAT ACTOR INTELLIGENCE KNOW YOUR ENEMY
- Know their tactics, techniques, and past activities.
- Access detailed profiles and track threat actor activities.
- Keep up with the latest threats and Tactics, Techniques, and Procedures (TTPs).
- Prioritize risks based on active threat actors in your industry or region.
Discover the
adversaries targeting your industry
Clear
Search
Please select a filter to get Threat Actors!
Top Threat Actors
570000
Audience
6
News
340
IOC
Target Countries:
Albania
Israel
Target Sectors:
Technology -
Entertainment -
NAICS:92 -
Associated Malware/Software:
rhadamanthys
Related CVE's:
No CVE's available.
ATT&CK IDs:
T1106 - Native API
T1574 - Hijack Execution Flow
T1566 - Phishing
T1102 - Web Service
T1036 - Masquerading
+ 3
See Details
Safe
★
Rank: 2
429651
Audience
2
News
3044
IOC
Target Countries:
Saudi Arabia
Romania
Bulgaria
USA
Philippines
+ 17
Target Sectors:
Education -
NGOs -
Media -
Government -
Technology -
Associated Malware/Software:
No Malware available.
Related CVE's:
CVE-2018-4878
CVE-2020-1472
CVE-2016-3715
CVE-2019-11510
CVE-2021-34527
ATT&CK IDs:
T1027
T1566.001
T1115 - Clipboard Data
T1071.001
T1140 - Deobfuscate/Decode Files or Information
+ 1
See Details
IntelBroker
★
Rank: 3
310000
Audience
4
News
9
IOC
Target Countries:
No target country found.
Target Sectors:
No target sector found.
Associated Malware/Software:
No Malware available.
Related CVE's:
CVE-2020-0601
CVE-2019-11510
CVE-2024-23897
CVE-2021-26855
ATT&CK IDs:
T1087 - Account Discovery
T1190 - Exploit Public-Facing Application
T1003
T1499
T1528 - Steal Application Access Token
+ 19
See Details
Lazarus Group
★
Rank: 4
303544
Audience
4
News
25981
IOC
Target Countries:
Israel
Worldwide (WannaCry)
USA
South Africa
Canada
+ 23
Target Sectors:
Energy -
Healthcare -
Shipping and Logistics -
Engineering -
Financial -
Associated Malware/Software:
osx.kandykorn
win.lambload
win.op_blockbuster
Lazarus
win.hardrain
+ 192
Related CVE's:
CVE-2022-41973
CVE-2024-43461
CVE-2021-34470
CVE-2021-36955
CVE-2023-20198
+ 169
ATT&CK IDs:
T1441
T1132.001
T1133
T1591.004
T1505
+ 395
See Details
Target Countries for Handala:
- Albania
- Israel
Related CVEs for Handala:
ATT&CK IDs for Handala:
- T1106 - Native API
- T1574 - Hijack Execution Flow
- T1566 - Phishing
- T1102 - Web Service
- T1036 - Masquerading
- T1134 - Access Token Manipulation
- T1027 - Obfuscated Files or Information
- T1547 - Boot or Logon Autostart Execution
Associated Malware/Software for Handala:
-
rhadamanthys
Target Countries for Safe:
- Saudi Arabia
- Romania
- Bulgaria
- USA
- Philippines
- Canada
- Serbia
- China
- Brazil
- Syria
- Mongolia
- Malaysia
- South Korea
- South Sudan
- India
- Algeria
- Australia
- Russia
- Hungary
- Pakistan
- UAE
- Egypt
Related CVEs for Safe:
- CVE-2018-4878
- CVE-2020-1472
- CVE-2016-3715
- CVE-2019-11510
- CVE-2021-34527
ATT&CK IDs for Safe:
- T1027
- T1566.001
- T1115 - Clipboard Data
- T1071.001
- T1140 - Deobfuscate/Decode Files or Information
- T1059.003
Associated Malware/Software for Safe:
Target Countries for IntelBroker:
Related CVEs for IntelBroker:
- CVE-2020-0601
- CVE-2019-11510
- CVE-2024-23897
- CVE-2021-26855
ATT&CK IDs for IntelBroker:
- T1087 - Account Discovery
- T1190 - Exploit Public-Facing Application
- T1003
- T1499
- T1528 - Steal Application Access Token
- T1055 - Process Injection
- T1213 - Data from Information Repositories
- T1204 - User Execution
- T1078 - Valid Accounts
- T1071 - Application Layer Protocol
- T1114 - Email Collection
- T1078
- T1053 - Scheduled Task/Job
- T1548 - Abuse Elevation Control Mechanism
- T1552 - Unsecured Credentials
- T1566.001
- T1102 - Web Service
- T1583 - Acquire Infrastructure
- T1134 - Access Token Manipulation
- T1190
- T1206 - Sudo Caching
- T1547 - Boot or Logon Autostart Execution
- T1185 - Man in the Browser
- T1567 - Exfiltration Over Web Service
Associated Malware/Software for IntelBroker:
Target Countries for Lazarus Group:
- Israel
- Worldwide (WannaCry)
- USA
- South Africa
- Canada
- Philippines
- Germany
- Netherlands
- China
- Ecuador
- Brazil
- France
- Taiwan
- Hong Kong
- Bangladesh
- UK
- Vietnam
- Guatemala
- Belgium
- India
- Mexico
- Australia
- Russia
- Poland
- Japan
- Thailand
- Chile
- South Korea
Related CVEs for Lazarus Group:
- CVE-2022-41973
- CVE-2024-43461
- CVE-2021-34470
- CVE-2021-36955
- CVE-2023-20198
- CVE-2022-2827
- CVE-2021-40684
- CVE-2024-38814
- CVE-2024-47575
- CVE-2014-1225
- CVE-2020-3259
- CVE-2023-34362
- CVE-2019-15637
- CVE-2023-2868
- CVE-2024-3094
- CVE-2024-37085
- CVE-2021-31196
- CVE-2022-47966
- CVE-2024-20272
- CVE-2024-38106
- CVE-2024-4577
- CVE-2020-0688
- CVE-2024-6327
- CVE-2024-38193
- CVE-2018-0798
- CVE-2015-0554
- CVE-2023-36884
- CVE-2022-32917
- CVE-2021-44142
- CVE-2022-41040
- CVE-2022-40259
- CVE-2023-32784
- CVE-2022-27925
- CVE-2024-30051
- CVE-2021-34527
- CVE-2023-21932
- CVE-2022-0609
- CVE-2019-16098
- CVE-2017-4946
- CVE-2022-24663
- CVE-2022-23093
- CVE-2022-25064
- CVE-2020-12812
- CVE-2024-43093
- CVE-2023-5009
- CVE-2014-8361
- CVE-2022-22005
- CVE-2014-4019
- CVE-2013-7389
- CVE-2022-42475
- CVE-2024-40766
- CVE-2017-11882
- CVE-2021-33768
- CVE-2023-46604
- CVE-2023-22515
- CVE-2024-28995
- CVE-2021-45837
- CVE-2024-4040
- CVE-2022-24664
- CVE-2021-33766
- CVE-2021-34523
- CVE-2023-38035
- CVE-2021-33764
- CVE-2021-31207
- CVE-2023-49606
- CVE-2023-33010
- CVE-2021-25325
- CVE-2024-38112
- CVE-2024-23897
- CVE-2017-10271
- CVE-2021-26855
- CVE-2022-41128
- CVE-2023-20109
- CVE-2023-50164
- CVE-2023-35078
- CVE-2024-38812
- CVE-2021-31206
- CVE-2023-27350
- CVE-2024-24691
- CVE-2023-3079
- CVE-2023-42793
- CVE-2018-19320
- CVE-2019-0708
- CVE-2024-5274
- CVE-2024-28991
- CVE-2024-45519
- CVE-2021-25323
- CVE-2014-2962
- CVE-2023-34039
- CVE-2022-24665
- CVE-2023-29059
- CVE-2023-25690
- CVE-2024-4947
- CVE-2021-20038
- CVE-2024-29849
- CVE-2021-44731
- CVE-2012-5687
- CVE-2019-11510
- CVE-2024-7971
- CVE-2020-25213
- CVE-2021-30657
- CVE-2019-5591
- CVE-2021-25324
- CVE-2023-0669
- CVE-2022-22947
- CVE-2019-7609
- CVE-2021-4034
- CVE-2022-24785
- CVE-2021-44228
- CVE-2023-27997
- CVE-2024-40711
- CVE-2018-13379
- CVE-2015-6585
- CVE-2022-3328
- CVE-2023-46747
- CVE-2021-3018
- CVE-2023-32315
- CVE-2024-36401
- CVE-2024-38178
- CVE-2021-20028
- CVE-2023-51467
- CVE-2022-41352
- CVE-2018-4878
- CVE-2024-21410
- CVE-2024-0769
- CVE-2023-35082
- CVE-2024-21762
- CVE-2023-4966
- CVE-2023-33246
- CVE-2022-3236
- CVE-2024-4058
- CVE-2024-21412
- CVE-2023-3519
- CVE-2015-2051
- CVE-2018-10562
- CVE-2017-0199
- CVE-2022-38028
- CVE-2018-8174
- CVE-2021-45105
- CVE-2013-5947
- CVE-2023-40044
- CVE-2023-22518
- CVE-2023-49103
- CVE-2020-1380
- CVE-2023-23376
- CVE-2021-43226
- CVE-2023-5129
- CVE-2023-28771
- CVE-2014-9583
- CVE-2022-21882
- CVE-2021-41773
- CVE-2018-20250
- CVE-2022-41082
- CVE-2022-40242
- CVE-2023-23397
- CVE-2022-30190
- CVE-2017-16238
- CVE-2022-22965
- CVE-2023-46748
- CVE-2022-24990
- CVE-2021-45046
- CVE-2021-34473
- CVE-2015-7248
- CVE-2024-21894
- CVE-2024-0204
- CVE-2020-1472
- CVE-2021-21551
- CVE-2017-17215
- CVE-2024-21338
- CVE-2024-23222
- CVE-2022-37042
- CVE-2021-24284
- CVE-2023-38831
- CVE-2022-41974
ATT&CK IDs for Lazarus Group:
- T1441
- T1132.001
- T1133
- T1591.004
- T1505
- T1557.001
- T1584.004
- T1134.001
- T1060
- T1089 - Disabling Security Tools
- T1114
- T1204.002 - Malicious File
- T1530
- T1129 - Shared Modules
- T1045 - Software Packing
- T1496 - Resource Hijacking
- T1090.001
- T1025
- T1135
- T1574 - Hijack Execution Flow
- T1218.011
- T1134.002
- T1031
- T1053.005
- T1115
- T1059.001
- T1070.001
- T1567.002
- T1056.001 - Keylogging
- T1591
- T1518.001
- T1555.005 - Password Managers
- T1059
- T1444
- T1105 - Ingress Tool Transfer
- T1486
- T1202
- T1210
- T1459 - Device Unlock Code Guessing or Brute Force
- T1203
- T1454
- T1543 - Create or Modify System Process
- T1485
- T1574
- T1428 - Exploit Enterprise Resources
- T1104 - Multi-Stage Channels
- T1113 - Screen Capture
- T1559
- T1132.001 - Standard Encoding
- T1110.003
- T1568.002 - Domain Generation Algorithms
- T1562
- T1566.002 - Spearphishing Link
- T1622
- T1546
- T1098
- T1036
- T1189
- T1496
- T1588.003
- T1016 - System Network Configuration Discovery
- T1568
- T1566.001
- T1071.004
- T1560.001
- T1587.004
- TA0007
- T1090
- T1036 - Masquerading
- T1449
- T1071 - Application Layer Protocol
- T1585
- T1036.005
- T1560
- T1129
- T1037
- T1036.003
- T1048
- T1564.001
- T1140 - Deobfuscate/Decode Files or Information
- T1550
- T1104
- T1059.005
- T1547
- T1039 - Data from Network Shared Drive
- T1590
- T1449 - Exploit SS7 to Redirect Phone Calls/SMS
- T1071.001
- T1007
- T1573.001
- T1127
- T1059.003
- T1059 - Command and Scripting Interpreter
- T1562.003
- T1555.003 - Credentials from Web Browsers
- T1542.003
- T1550.002 - Pass the Hash
- T1553.005
- T1081 - Credentials in Files
- T1195
- T1566.003 - Spearphishing via Service
- T1095
- T1140
- T1112 - Modify Registry
- T1656
- T1547.009
- T1574.002
- T1078 - Valid Accounts
- T1608
- T1071.004 - DNS
- T1176
- T1531
- T1202 - Indirect Command Execution
- T1587
- T1003.001
- T1567
- T1003 - OS Credential Dumping
- TA0005
- T1055.001
- T1072 - Software Deployment Tools
- T1091
- T1195.002
- T1018
- T1124
- T1583.006
- T1485 - Data Destruction
- T1021.004 - SSH
- T1587 - Develop Capabilities
- T1112
- T1063
- T1572 - Protocol Tunneling
- T1564 - Hide Artifacts
- T1111 - Two-Factor Authentication Interception
- T1070.003
- T1542
- T1553 - Subvert Trust Controls
- T1218 - Signed Binary Proxy Execution
- T1040 - Network Sniffing
- T1563
- T1583
- T1561
- T1057
- T1505 - Server Software Component
- T1565.001
- T1221
- T1045
- T1552.001 - Credentials In Files
- T1497.001 - System Checks
- T1204 - User Execution
- T1584.001
- T1547.006
- T1136 - Create Account
- T1561 - Disk Wipe
- T1571 - Non-Standard Port
- T1587.001
- T1203 - Exploitation for Client Execution
- T1588 - Obtain Capabilities
- T1553.002 - Code Signing
- TA0034
- T1047
- T1187
- T1489
- T1132 - Data Encoding
- TA0003
- T1583.001
- T1571
- T1608.002
- T1553
- T1040
- T1442
- T1195.001
- T1595
- T1569.002
- T1566 - Phishing
- T1591 - Gather Victim Org Information
- T1049
- T1176 - Browser Extensions
- T1204
- T1220
- T1036.008
- T1505.004
- T1107
- T1562.001
- T1620
- T1553.002
- T1562.001 - Disable or Modify Tools
- T1543.003
- T1138 - Application Shimming
- T1560 - Archive Collected Data
- T1585.001
- T1016.001 - Internet Connection Discovery
- T1588.002
- T1021
- T1021.002 - SMB/Windows Admin Shares
- T1583.004
- T1011
- T1518
- T1583.001 - Domains
- T1133 - External Remote Services
- T1552 - Unsecured Credentials
- T1002
- T1588.004
- T1125
- T1491
- T1592 - Gather Victim Host Information
- T1137 - Office Application Startup
- T1012 - Query Registry
- T1566.002
- T1105
- T1547.008
- T1567 - Exfiltration Over Web Service
- T1445 - Abuse of iOS Enterprise App Signing Key
- T1003
- TA0006
- T1593.001
- T1071
- T1021 - Remote Services
- T1041
- T1056
- T1056 - Input Capture
- T1565
- T1555.001 - Keychain
- T1555
- T1102
- T1024 - Custom Cryptographic Protocol
- T1056.001
- T1190
- T1593
- T1070.006
- T1608.001
- T1566
- T1090 - Proxy
- T1561.002
- T1560.003
- T1053 - Scheduled Task/Job
- T1132
- T1568 - Dynamic Resolution
- T1560.002
- T1155 - AppleScript
- T1095 - Non-Application Layer Protocol
- T1552
- T1497.002 - User Activity Based Checks
- TA0005 - Defense Evasion
- T1497 - Virtualization/Sandbox Evasion
- T1070.004
- T1001.003 - Protocol Impersonation
- T1565.002
- T1048.003
- T1078
- T1568.002
- TA0002
- T1195 - Supply Chain Compromise
- T1573
- T1021.001 - Remote Desktop Protocol
- T1573 - Encrypted Channel
- T1218
- T1583.005
- T1027
- T1562.004
- T1139 - Bash History
- T1070 - Indicator Removal on Host
- T1087.002
- T1005 - Data from Local System
- T1587.004 - Exploits
- T1204.002
- T1055
- T1014 - Rootkit
- T1557
- T1059.003 - Windows Command Shell
- T1555 - Credentials from Password Stores
- T1548
- T1573.001 - Symmetric Cryptography
- T1497.003
- T1071.001 - Web Protocols
- T1498 - Network Denial of Service
- T1027.007
- T1119
- T1217
- T1055 - Process Injection
- T1059.007 - JavaScript
- T1119 - Automated Collection
- T1031 - Modify Existing Service
- T1143 - Hidden Window
- T1608.001 - Upload Malware
- T1083 - File and Directory Discovery
- T1001
- T1059.001 - PowerShell
- T1074.001
- T1027.013
- T1565 - Data Manipulation
- T1585.002
- T1083
- T1589.002
- T1213 - Data from Information Repositories
- T1082
- T1021.004
- T1218.010
- T1547.001 - Registry Run Keys / Startup Folder
- T1566.003
- T1218.011 - Rundll32
- T1078.003 - Local Accounts
- T1584
- T1048 - Exfiltration Over Alternative Protocol
- T1063 - Security Software Discovery
- T1569
- T1547 - Boot or Logon Autostart Execution
- T1047 - Windows Management Instrumentation
- TA0040
- T1036.004
- T1614
- T1556
- T1564
- T1027 - Obfuscated Files or Information
- T1218.005
- T1027.002 - Software Packing
- TA0004
- T1033 - System Owner/User Discovery
- T1021.001
- T1090.002
- T1033
- T1027.002
- T1218.001
- T1008
- T1053
- T1106 - Native API
- T1070
- T1056.004 - Credential API Hooking
- T1486 - Data Encrypted for Impact
- T1491.001
- T1018 - Remote System Discovery
- T1204.001
- T1082 - System Information Discovery
- T1570 - Lateral Tool Transfer
- T1068 - Exploitation for Privilege Escalation
- T1055.002
- T1001.003
- T1190 - Exploit Public-Facing Application
- T1059.006 - Python
- T1110
- T1189 - Drive-by Compromise
- T1587.001 - Malware
- T1087
- T1565.003
- T1583 - Acquire Infrastructure
- T1505.003
- T1134 - Access Token Manipulation
- T1529
- T1113
- T1495
- T1587.002
- T1574.002 - DLL Side-Loading
- T1078.002 - Domain Accounts
- T1574.013
- T1137
- T1102.002
- T1046
- T1588
- T1068
- T1106
- T1596 - Search Open Technical Databases
- T1589
- TA0011
- T1012
- T1534
- T1614.001
- T1480
- T1102 - Web Service
- T1543.001 - Launch Agent
- T1017 - Application Deployment Software
- T1592
- T1022
- T1595 - Active Scanning
- T1210 - Exploitation of Remote Services
- T1561.001
- T1543
- T1014
- T1005
- TA0009
- T1490
- T1219
- T1057 - Process Discovery
- T1136
- T1053.003
- T1053.005 - Scheduled Task
- T1192
- T1547.001
- T1087 - Account Discovery
- T1134
- T1021.002
- T1064
- T1115 - Clipboard Data
- T1060 - Registry Run Keys / Startup Folder
- T1081
- T1218.007
- T1023 - Shortcut Modification
- T1497
- T1074
- T1016
- T1010
- T1497.001
Associated Malware/Software for Lazarus Group:
-
osx.kandykorn
-
win.lambload
-
win.op_blockbuster
-
Lazarus
-
win.hardrain
-
win.dtrack
-
win.interception
-
win.bravonc
-
win.neddnloader
-
osx.interception
-
DPRK
-
TYPEFRAME
-
win.lpeclient
-
jrat
-
Korean
-
win.srdi
-
js.quickcafe
-
win.ratankbapos
-
win.badcall
-
PLAY
-
Andariel
-
win.torisma
-
win.dacls
-
VMConnect
-
Gheg
-
win.magic_rat
-
win.imprudentcook
-
win.volgmer
-
osx.simpletea
-
win.scout
-
BlueNoroff
-
win.lightlesscan
-
elf.badcall
-
win.bankshot
-
netsh
-
APNIC
-
win.hermes
-
win.iconic_stealer
-
win.power_ratankba
-
win.httpsuploader
-
osx.unidentified_001
-
invisibleferret
-
win.cur1_downloader
-
win.lcpdot
-
Ransom:Win32/WannaCrypt
-
Trojan:Win32/SmokeLoader
-
win.slickshoes
-
HARDRAIN
-
win.wagenttea
-
win.fuwuqidrama
-
osx.applejeus
-
win.electricfish
-
Cutwail
-
win.deltas
-
Volgmer
-
win.banpolmex
-
m1
-
win.duuzer
-
QUASAR
-
osx.watchcat
-
Unix
-
FALLCHILL
-
RawDisk
-
win.alreay
-
win.klackring
-
win.feed_load
-
mimikatz
-
mirai
-
win.joanap
-
osx.manuscrypt
-
win.jessiecontea
-
sliver
-
Zombie.A
-
KEYMARBLE
-
win.winordll64
-
ET
-
GbdInf_305B1C9A.J!ibt
-
win.wannacryptor
-
win.typeframe
-
win.dyepack
-
win.nachocheese
-
win.webbytea
-
Exploit:Win32/CVE-2017-0147
-
win.nestegg
-
win.phandoor
-
win.miniblindingcan
-
DDoS:Linux/Gafgyt
-
win.hotwax
-
win.redshawl
-
RATANKBA
-
win.bitsran
-
win.unidentified_090
-
apk.badcall
-
osaminer
-
AgentTesla.KM
-
Win.Malware.Botgor-9853222-0
-
win.anchormtea
-
osx.yort
-
WannaCry
-
win.wormhole
-
osx.3cx_backdoor
-
win.fudmodule
-
win.rustbucket
-
hellokitty
-
Trojan:Win32/ClipBanker
-
win.artfulpie
-
PWSX-gen
-
AuditCred
-
win.roll_sling
-
osx.hloader
-
win.unidentified_101
-
win.snatchcrypto
-
win.postnaptea
-
win.sierras
-
hermeticwiper
-
win.romeos
-
win.blindtoad
-
win.unidentified_042
-
comebacker
-
ETERNALBLUE
-
win.buffetline
-
DDoS-Y
-
NIDS
-
win.ratankba
-
win.dratzarus
-
win.unidentified_077
-
Linux
-
beavertail
-
Bankshot
-
Mofksys.B
-
win.coredn
-
win.cleantoad
-
win.lazarus_killdisk
-
win.pslogger
-
win.ghost_secret
-
osx.rustbucket
-
osx.casso
-
FG!tr.ransom
-
win.keymarble
-
Threat
-
tsunami
-
elf.spectral_blur
-
elf.simpletea
-
win.alphanc
-
win.racket
-
win.lazardoor
-
HTTP
-
win.vsingle
-
win.hotcroissant
-
win.ghost_rat
-
TrojanSpy
-
win.bookcodesrat
-
win.gopuram
-
win.minitypeframe
-
win.brambul
-
osx.sugarloader
-
HOPLIGHT
-
win.cloudburst
-
BADCALL
-
Neurevt
-
Proxysvc
-
ps1.powerbrace
-
win.hoplight
-
osx.poolrat
-
win.contopee
-
win.3cx_backdoor
-
Windows
-
win.veiledsignal
-
win.vyveva
-
POOLRAT
-
win.wininetloader
-
win.bootwreck
-
Net
-
php.redhat_hacker
-
apk.hardrain
-
Tofsee.T
-
win.crat
-
win.lazarloader
-
win.blindingcan
-
RustBucket
-
win.rifdoor
-
DarkComet
-
osx.spectral_blur
-
win.bluenoroff
-
aix.fastcash
-
osx.dacls
-
win.applejeus
-
fullhouse
-
Mimikatz
-
win.darkcomet
-
win.cheesetray
-
win.comebacker
-
cobalt_strike
-
win.forest_tiger
-
ps1.powerspritz
-
win.touchmove
-
win.bistromath
Top Ransomware Groups
ransomhub
★
Rank: 1
1222151
Audience
9
News
107
IOC
Target Countries:
Israel
Hungary
Thailand
Latvia
Chile
+ 73
Target Sectors:
Food Manufacturing -
Real Estate -
Hospitals -
Accommodation -
Air Transportation -
Associated Malware/Software:
No Malware available.
Related CVE's:
CVE-2022-26809
CVE-2021-34527
CVE-2021-44228
ATT&CK IDs:
T1566.001
T1078
T1562.001
T1486
T1027
See Details
hellcat
★
Rank: 2
1011097
Audience
4
News
0
IOC
Target Countries:
Turkey
United Kingdom
Tanzania, United Republic of
United States
Indonesia
+ 3
Target Sectors:
Public Administration -
Telecommunications -
Associated Malware/Software:
No Malware available.
Related CVE's:
No CVE's available.
ATT&CK IDs:
No Attack IDs
See Details
akira
★
Rank: 3
793530
Audience
3
News
265
IOC
Target Countries:
Greece
Finland
Czech Republic
Thailand
Netherlands
+ 52
Target Sectors:
Food Manufacturing -
Other Information Services -
Rail Transportation -
Software Publishers -
Real Estate -
Associated Malware/Software:
Netwalker - S0457
Virus:Win32/Alma
APT
Backdoor:Win32/Aeon
win.crimson
+ 46
Related CVE's:
CVE-2017-0147
CVE-2023-27532
CVE-2023-20269
ATT&CK IDs:
T1567 - Exfiltration Over Web Service
T1047 - Windows Management Instrumentation
T1219 - Remote Access Software
T1560 - Archive Collected Data
T1133 - External Remote Services
+ 37
See Details
lockbit
★
Rank: 4
740000
Audience
11
News
27796
IOC
Target Countries:
Croatia
Cuba
Israel
Hungary
Thailand
+ 78
Target Sectors:
Food Manufacturing -
Software Publishers -
Real Estate -
Hospitals -
Enterprises & Holding -
Associated Malware/Software:
Remsec
VB.PwShell.2
FonePaw
VB:Trojan.Valyria
Inmortal
+ 324
Related CVE's:
CVE-2022-36537
CVE-2023-46604
CVE-2023-3519
CVE-2014-3153
CVE-2023-22515
+ 50
ATT&CK IDs:
T1038
T1064
TA0003
T1021.001
T1022
+ 157
See Details
Target Countries for ransomhub:
- Israel
- Hungary
- Thailand
- Latvia
- Chile
- None
- Spain
- Brazil
- Italy
- Argentina
- Russian Federation
- Lebanon
- Sweden
- Austria
- Switzerland
- Slovakia
- United States
- Germany
- Panama
- Costa Rica
- India
- Norway
- Malaysia
- Bangladesh
- Sri Lanka
- Kenya
- China
- Denmark
- Malta
- Paraguay
- Kuwait
- Venezuela, Bolivarian Republic of
- Mexico
- Fiji
- Ecuador
- Peru
- Belgium
- Japan
- Qatar
- Colombia
- South Africa
- Saudi Arabia
- Tunisia
- Greece
- Global
- Australia
- Indonesia
- Taiwan, Province of China
- Poland
- Philippines
- Romania
- Cyprus
- Ireland
- Luxembourg
- Hong Kong
- Lithuania
- United Arab Emirates
- Myanmar
- France
- Serbia
- Ukraine
- Timor-Leste
- Turkey
- Dominican Republic
- Singapore
- Guatemala
- Canada
- New Zealand
- Egypt
- Jamaica
- Netherlands
- El Salvador
- Tuvalu
- Sudan
- United Kingdom
- Oman
- Korea, Republic of
- Iran, Islamic Republic of
Related CVEs for ransomhub:
- CVE-2022-26809
- CVE-2021-34527
- CVE-2021-44228
ATT&CK IDs for ransomhub:
- T1566.001
- T1078
- T1562.001
- T1486
- T1027
Associated Malware/Software for ransomhub:
Target Countries for hellcat:
- Turkey
- United Kingdom
- Tanzania, United Republic of
- United States
- Indonesia
- France
- Israel
- Jordan
Related CVEs for hellcat:
ATT&CK IDs for hellcat:
Associated Malware/Software for hellcat:
Target Countries for akira:
- Greece
- Finland
- Czech Republic
- Thailand
- Netherlands
- Denmark
- Nicaragua
- None
- Norway
- Ecuador
- India
- Germany
- Singapore
- Uruguay
- Jersey
- Georgia
- Sweden
- Bahamas
- Colombia
- Chile
- Romania
- Panama
- Kenya
- United Kingdom
- Tunisia
- Hungary
- Russian Federation
- Argentina
- United Arab Emirates
- Poland
- United States
- Italy
- Bangladesh
- Brazil
- Malta
- China
- Spain
- Iceland
- Slovenia
- Turkey
- Global
- [object Object]
- Switzerland
- France
- Mexico
- South Africa
- Australia
- Canada
- Martinique
- Ireland
- Slovakia
- Jordan
- Austria
- Belize
- Saudi Arabia
- Peru
- Japan
Related CVEs for akira:
- CVE-2017-0147
- CVE-2023-27532
- CVE-2023-20269
ATT&CK IDs for akira:
- T1567 - Exfiltration Over Web Service
- T1047 - Windows Management Instrumentation
- T1219 - Remote Access Software
- T1560 - Archive Collected Data
- T1133 - External Remote Services
- T1046 - Network Service Scanning
- T1552 - Unsecured Credentials
- T1021 - Remote Services
- T1136 - Create Account
- T1068 - Exploitation for Privilege Escalation
- T1069 - Permission Groups Discovery
- T1040 - Network Sniffing
- T1562 - Impair Defenses
- T1027 - Obfuscated Files or Information
- T1486 - Data Encrypted for Impact
- T1071 - Application Layer Protocol
- T1110 - Brute Force
- T1190 - Exploit Public-Facing Application
- T1041 - Exfiltration Over C2 Channel
- T1485 - Data Destruction
- T1083 - File and Directory Discovery
- T1087 - Account Discovery
- T1490 - Inhibit System Recovery
- T1070 - Indicator Removal on Host
- T1140 - Deobfuscate/Decode Files or Information
- T1059 - Command and Scripting Interpreter
- T1573 - Encrypted Channel
- T1105 - Ingress Tool Transfer
- T1018 - Remote System Discovery
- T1011 - Exfiltration Over Other Network Medium
- T1543 - Create or Modify System Process
- T1570 - Lateral Tool Transfer
- T1003 - OS Credential Dumping
- T1546 - Event Triggered Execution
- T1048 - Exfiltration Over Alternative Protocol
- T1082 - System Information Discovery
- T1569 - System Services
- T1547 - Boot or Logon Autostart Execution
- T1078 - Valid Accounts
- T1112 - Modify Registry
- T1471 - Data Encrypted for Impact
- T1132.001 - Standard Encoding
Associated Malware/Software for akira:
-
Netwalker - S0457
-
Virus:Win32/Alma
-
APT
-
Backdoor:Win32/Aeon
-
win.crimson
-
Alpha Ransomware
-
win.orcus_rat
-
jar.jrat
-
Ransom:Win32/Nemty
-
win.afrodita
-
#Hacktool:MSIL/Hawkeyelogger
-
Ransom:Win32/Phobos
-
Worm:Win32/Netsky
-
Dharma Ransomware
-
win.cobalt_strike
-
elf.glupteba_proxy
-
elf.conti
-
osx.amos
-
AMOS macOS
-
Revenge RAT - S0379
-
TEL:Trojan:Win32/Emotet
-
Remcos - S0332
-
TEL:TrojanSpy:MSIL/AgentTesla
-
Azorult - S0344
-
win.alina_pos
-
Embarcadero Delphi
-
Maze - S0449
-
Trojan:Win32/Pitou
-
Virus:Win32/Aldebaran
-
Virus:DOS/Abbas
-
NetSupportManagerRAT
-
Dridex - S0384
-
Virus:DOS/Alabama
-
FakeSG
-
win.tofsee
-
win.formbook
-
Hancitor - S0499
-
win.raccoon
-
win.pony
-
Trojan:DOS/ABCD
-
Virus:DOS/Acid
-
win.zloader
-
ALFA Ransomware
-
Joke:Win32/Amigo
-
Adonis
-
ALF:HeraklezEval:HackTool:Win32/PwCrack
-
Ryuk ransomware
-
Akira
-
Trojan:Win32/Aleph
-
win.vidar
-
TrickBot - S0266
Target Countries for lockbit:
- Croatia
- Cuba
- Israel
- Hungary
- Thailand
- Chile
- Afghanistan
- Spain
- Bulgaria
- Brazil
- Italy
- Argentina
- Russian Federation
- Lebanon
- Sweden
- Austria
- Switzerland
- Bolivia, Plurinational State of
- Slovakia
- United States
- Germany
- Panama
- Costa Rica
- Jordan
- India
- Iceland
- Norway
- Malaysia
- Bangladesh
- Kenya
- China
- Martinique
- Kuwait
- Senegal
- Venezuela, Bolivarian Republic of
- Mexico
- Nicaragua
- Peru
- Belgium
- Japan
- Virgin Islands, U.S.
- Colombia
- South Africa
- Saudi Arabia
- Greece
- Global
- Mozambique
- Australia
- Indonesia
- Taiwan, Province of China
- Poland
- Nigeria
- Romania
- Cyprus
- Ireland
- Luxembourg
- Hong Kong
- United Arab Emirates
- Czech Republic
- France
- Ukraine
- Haiti
- Uruguay
- Turkey
- Georgia
- Samoa
- Dominican Republic
- Singapore
- Portugal
- Canada
- Ethiopia
- New Zealand
- Saint Vincent and the Grenadines
- Egypt
- Angola
- Netherlands
- Bahamas
- United Kingdom
- Oman
- Finland
- Korea, Republic of
- Iran, Islamic Republic of
- Trinidad and Tobago
Related CVEs for lockbit:
- CVE-2022-36537
- CVE-2023-46604
- CVE-2023-3519
- CVE-2014-3153
- CVE-2023-22515
- CVE-2021-36942
- CVE-2023-20198
- CVE-2019-11510
- CVE-2017-0199
- CVE-2023-40044
- CVE-2023-22518
- CVE-2023-36025
- CVE-2023-5129
- CVE-2022-47966
- CVE-2021-44228
- CVE-2021-34523
- CVE-2023-38035
- CVE-2020-0787
- CVE-2019-19781
- CVE-2017-0143
- CVE-2021-31207
- CVE-2023-29324
- CVE-2018-13379
- CVE-2018-0798
- CVE-2015-1650
- CVE-2017-8464
- CVE-2023-46747
- CVE-2023-36884
- CVE-2021-26857
- CVE-2023-20109
- CVE-2022-30190
- CVE-2023-23397
- CVE-2024-1709
- CVE-2023-46748
- CVE-2021-20028
- CVE-2023-27350
- CVE-2021-34473
- CVE-2020-0796
- CVE-2023-5009
- CVE-2017-17215
- CVE-2023-34039
- CVE-2021-22986
- CVE-2018-8453
- CVE-2024-1708
- CVE-2017-0147
- CVE-2022-26134
- CVE-2022-42475
- CVE-2023-3284
- CVE-2023-4966
- CVE-2023-38831
- CVE-2017-11882
- CVE-2021-27065
- CVE-2022-3236
- CVE-2023-20269
- CVE-2024-21412
ATT&CK IDs for lockbit:
- T1038
- T1064
- TA0003
- T1021.001
- T1022
- T1110
- T1176
- T1012
- T1445
- T1562.004
- T1482
- T1410
- T1057
- T1018
- T1596
- T1569
- T1210
- T1056
- T1029
- T1530
- T1567
- T1027.002
- T1199
- T1106
- T1207
- T1137
- T1036
- T1008
- T1041
- TA0040
- T1053
- T1189
- T1133
- TA0005
- T1587
- T1518
- T1193
- T1078
- T1574
- T1059.007
- T1127
- T1056.001
- T1021
- T1048
- T1539
- TA0004
- T1491
- T1450
- T1412
- T1454
- TA0011
- T1556
- T1055
- T1559.001
- T1059.002
- T1583.002
- T1088
- T1553
- T1563
- T1129
- TA0009
- T1031
- T1219
- T1156
- T1591
- T1187
- T1136
- T1059.003
- T1518.001
- T1614
- T1070.004
- T1100
- T1566
- T1564
- T1560
- T1059
- T1574.002
- T1082
- T1087
- T1113
- T1552
- T1102
- T1489
- T1134
- T1147
- T1083
- T1060
- T1486
- T1105
- T1221
- TA0006
- T1071.002
- T1068
- T1564.001
- T1496
- T1480
- T1046
- T1072
- T1490
- T1498
- T1204.002
- T1132
- T1053.005
- TA0034
- T1585
- T1003.008
- T1204
- TA0029
- T1112
- T1005
- T1218
- T1570
- T1095
- T1485
- T1140
- T1588
- TA0007
- T1449
- T1074
- T1104
- T1011
- T1543
- T1070
- T1063
- T1497
- T1049
- T1583
- T1071
- T1562.001
- T1584.005
- T1090
- T1562
- T1555
- T1211
- T1531
- T1571
- TA0002
- T1003
- T1114
- T1546
- T1190
- T1583.005
- T1027
- T1183
- T1548
- T1071.004
- T1110.002
- T1195
- T1001.002
- T1584
- T1505
- T1573
- T1016
- T1572
- T1547
- T1040
- T1071.003
- T1122
- T1001
- T1010
- T1071.001
- T1047
Associated Malware/Software for lockbit:
-
Remsec
-
VB.PwShell.2
-
FonePaw
-
VB:Trojan.Valyria
-
Inmortal
-
Bitmap.exe
-
Hall Render
-
Win32/SocStealer!rfn
-
Gen:Heur.NoobyProtect
-
FileRepMalware
-
Loki Bot
-
Lumma Stealer
-
SpyAgent
-
win.bloodalchemy
-
ALF:Ransom:Win32/LockBit
-
Backdoor.Oldrea
-
VB.EmoDldr.4
-
win.lookback
-
win.netfilter
-
TA505
-
win.agent_tesla
-
FG!tr.ransom
-
GlobalNet
-
WannaCry Kill Switch
-
AgentTesla
-
VB.Chronos.7
-
Script.INF
-
win.chaos
-
AGEN.1045227
-
GetLucky
-
Win.Worm.Mydoom-5
-
win.pwndlocker
-
GLOOXMAIL
-
Maltiverse
-
KANDYKORN macOS
-
Mastadon
-
Unsafe
-
RedlineStealer
-
Lokbit
-
win.cobalt_strike
-
Gen:NN.ZemsilF.34128
-
Presenoker
-
ScrInject.B
-
RedLine Stealer
-
Indiloadz.BB
-
TrojanSpy
-
States
-
BScope.Riskware
-
Exploit CVE-2017-11882
-
jar.jrat
-
HallGrand
-
win.darkgate
-
HopToDesk
-
Marina Botnet
-
Tor - S0183
-
Wiper
-
Quasar RAT
-
HEUR:Trojan.BAT
-
Kraddare
-
Zpevdo
-
Patcher
-
$WebWatson
-
W32.AIDetectVM
-
PUA.Reg1staid
-
AutoIT
-
index.php
-
win.azorult
-
apk.alien
-
Magic
-
Ghandi
-
fake ,promethiumm ,strongpity
-
win.formbook
-
win.lumma
-
IL:Trojan.MSILZilla
-
elf.lockbit
-
Ursu
-
js.gootloader
-
PWS.p
-
win.amadey
-
Win32:RansomX-gen\ [Ransom]
-
Makop
-
3AM
-
Dark Power
-
win.nokoyawa
-
elf.ransomexx
-
SdBot.CAOC
-
Systweak
-
WininiCrypt
-
Daisy Coleman
-
BEC
-
Ulise.345018
-
Fusioncore
-
elf.dark
-
win.quasar_rat
-
win.asyncrat
-
PWSX
-
DroxiDat
-
CIL.HeapOverride
-
Deuterbear
-
PWS:Win32/QQpass.CI
-
win.nymaim
-
MalwareX
-
BlackNET
-
js.evilnum
-
Lazarus
-
ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47
-
win.rhadamanthys
-
Stopransomware.gov
-
win.icefog
-
Pegasus for iOS - S0289
-
Gen:Variant.Bulz
-
Zbot
-
HTML_REDIR.SMR
-
Remcos RAT
-
Gen:Trojan.Heur
-
ALPHV
-
ALF:HeraklezEval:PUA:Win32/SpyrixKeylogger
-
Win.Packer.Crypter-6539596-1
-
Trojan:Win32/WannaCry.350
-
Crypt3.BLXP
-
Virus.Botgor!1.D115 (CLASSIC)
-
elf.blackmatter
-
win.lokipws
-
Win32.HsIdir
-
SocGholish
-
JS:Iframe
-
Evo
-
NoName057
-
win.blacknet_rat
-
Tsara Brashears
-
BlackCat - S1068
-
Hidden Form
-
LNK
-
WannaCry
-
staticrr.paleokits.net
-
ELF
-
Ransom:Win32/CVE-2017-0147
-
Worm:Win32/Benjamin
-
win.cuba
-
Black
-
Strictor
-
Arid.Viper_CnC
-
ETERNALBLUE
-
elf.babuk
-
Win.Malware.Botgor-9853222-0
-
Brontok
-
win.kuluoz
-
CVE-2015-1650
-
win.remcos
-
BehavBehavesLike.PUPXBI
-
win.parallax
-
Phish.AB
-
DoNex
-
win.dridex
-
win.maze
-
Malvertizing
-
W32.AIDetect.malware2
-
Ransomware
-
W32.eHeur
-
win.ramnit
-
ALF:TrojanSpy:Win32/Keylogger
-
Swisyn
-
LNK.Powershell
-
win.stealbit
-
JHUHUGIT
-
Faceliker.A
-
PWS-FCZZ
-
win.virut
-
Trojan:Win32/Wacatac
-
Trojan:VBA/Downldr
-
win.feodo
-
TROJ_FRS.VSN1EJ18
-
Python
-
darkrace
-
Trojan:Python/Downldr
-
Threat
-
win.suppobox
-
Cyberespionage
-
SGeneric
-
Exploit.CVE
-
Suspicious.Save
-
TROJ_GEN.R002C0OG518
-
LolKek
-
Packed-GV
-
CVE JAR
-
Zbd Zeus
-
Twitter Malware
-
win.wannacryptor
-
Keylogger
-
NBAE
-
APT Notes
-
Trojan:Linux/Downldr
-
WebToolbar
-
Relic
-
Kryptik.FPH.gen
-
HTML:Script
-
Detects UPATRE
-
Raas
-
Delf.NBX
-
Tulach Malware
-
elf.mikey
-
win.lockfile
-
Bl00dy
-
Bleed
-
win.trickbot
-
Adload.AD81
-
Cyclops Blink - S0687
-
TrickBot - S0266
-
ETPRO
-
py.networm
-
TrueSightKiller
-
Tulach
-
Agent Tesla
-
PSW.Stealer
-
Trojan:MSIL/Burkina
-
Arkei
-
IOCs
-
win.njrat
-
Sabey
-
Noberus
-
win.karagany
-
win.graftor
-
PossibleThreat.PALLAS
-
win.raccoon
-
win.redcap
-
Worm:VBS/Dapato
-
OpenSubtitles.A
-
SNH:Script [Dropper]
-
Crack
-
Agent Tesla - S0331
-
Xegumumune.8596c22f
-
win.redline_stealer
-
win.webmonitor
-
win.locky
-
susp.lnk
-
Cybersecurity News
-
win.blueshell
-
JavaScript
-
win.agent_btz
-
VB.EmoooDldr.10
-
HEUR:AdWare.StartSurf
-
Phishing
-
Qbot
-
Application.SQLCrack
-
Pegasus
-
Win32:RATX-gen [Trj]
-
elf.mirai
-
Wacatac
-
Beacons
-
Adware
-
MSIL.C515258
-
QakBot
-
Downldr.gen
-
Win64.Payload.Limepad
-
Dropper.DR/AutoIt.Gen
-
win.vidar
-
Dapato
-
GhostDriver
-
Bazaar Loader
-
Ursnif
-
OriginLoader
-
win.emotet
-
Bit RAT
-
win.immortal_stealer
-
Artemis
-
malicious.2a7bf4
-
generic.ml
-
JS:Trojan.HideLink
-
win.smokeloader
-
win.doublepulsar
-
Trojan:Win32/Detplock
-
Cobalt Strike
-
GameHack.DR
-
Witchetty
-
Pua.Gen
-
DangerousObject.Multi
-
Ryuk ransomware
-
RevengeRAT
-
Swort
-
TrojanDownloader:Linux/Downldr
-
win.bobik
-
Nemucod
-
win.nanocore
-
Ransom_WCRY.SMALYM
-
Injector.IS.gen
-
HallRender
-
Amazon AES
-
Suspicious_GEN.F47V0520
-
win.dnspionage
-
Domains
-
W32/Hupigon.NCU
-
CHOPSTICK
-
Strike Beacon
-
PS1
-
win.shadowpad
-
Detplock
-
win.waterbear
-
win.xworm
-
win.hupigon
-
Death Bitches
-
Apple Malware
-
elf.blackcat
-
RiskTool.Phpw
-
AzoruIt
-
VBS
-
Facebook HT
-
Virus:DOS/Burma
-
Rhysida
-
Win.Packed.Zenpak-7101989-0
-
Skynet
-
Discord
-
Wacapew.C
-
RedLine
-
TSGeneric
-
Win.Downloader.76944-1
-
Maui ransomware
-
Program.Unwanted
-
S-b748adc5
-
Auslogics
-
elf.conti
-
CIL.StupidCryptor
-
Download
-
NetSupport
-
njRAT - S0385
-
WisdomEyes.16070401.9500
-
Ransom:Win32/GandCrab.AE
-
Racoon Stealer
-
Silk Road
-
win.zeus
Discover the adversaries targeting your industry
Search Your Enemy
Copyright © 2025 SOCRadar Cyber Intelligence Inc.
All rights
reserved.
