🕵️ LittleFilch
Named by 3 kept items in this workspace.
2 items name it under threat actors and 1 under classification.key entities.
Search every workspace for LittleFilch. It matches the name as written, so it can find other things that share it.
The items that name it 3
articleas classification.key entities2026-10-29
articleas threat actors2026-10-29It is written here as LittleFilch: KeyDrift module that collects keying material, which Talos believes includes keys protecting data-plane traffic..
writeupas threat actors2026-10-28It is written here as LittleFilch: KeyDrift component (libcommon.so) that hooks SSL_read in vdaemon to extract keying material for predefined edge nodes and stage it encrypted for exfiltration.
libcommon.so
All threat actors in this workspace.