🕵️ Unnamed threat actor

The items that name it 26

• Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers
  writeup2026-09-30It is written here as Unnamed threat actor (likely based in China).

  Determined attacker who compromised multiple tenants on a shared recreation management software platform by registering member accounts, uploading malicious .aspx webshells, and conducting reconnaissance and payment card data theft across three web servers. Attributed to China based on PowerShell us

• Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence
  writeup2026-09-09It is written here as Unnamed threat actor(s).

  Attackers behind two related August incidents using phishing, browser-in-the-browser (BiTB) pages, and rogue ScreenConnect RMM installers to gain persistent remote access; not attributed to a named group in the page.

• Runtime Security for AWS CodeBuild-Hosted GitHub Actions Runners
  article2026-09-02It is written here as Unnamed threat actor (AWS CodeBuild incident, July 2025).

  Stole source repository access tokens by dumping memory of a CodeBuild build environment via a malicious pull request; exfiltrated token and reached AWS Toolkit for Visual Studio Code and AWS SDK for .NET repositories.

• Socket: Popular Rust Crates Compromised in Build-Time Supply Chain Attack
  writeup2026-08-20It is written here as Unnamed threat actor (proc-macro1 supply chain attacker).

  Compromised legitimate Rust crates maintained by David Roundy (droundy), likely via compromised maintainer computer or crates.io publishing credentials, and published malicious versions injecting a dependency on the typosquat crate proc-macro1 impersonating proc-macro2, leading to build-time executi

• Bank of America Phishing Email Delivers ScreenConnect Malware
  writeup2026-08-04

  Actor behind Bank of America phishing campaign delivering ScreenConnect RMM malware via VBScript, multi-stage base64/AES-encoded PowerShell, and a UAC bypass exploit; also uses SDDL/ACL tricks to hide and protect the malicious service.

• Compromised npm Packages: @joyfill/components and @joyfill/layouts Ship an Obfuscated Remote Access Trojan
  writeup2026-07-30It is written here as Unnamed threat actor (npm supply chain campaign, campaign tag A9-0135-3).

  Single actor believed to have hijacked and published malicious beta versions of @joyfill/components and @joyfill/layouts on npm; distributes the same Socket.IO RAT and Python credential stealer across multiple campaigns tracked by campaign tag (e.g., A9-0135-3 for the npm vector), using blockchain-b

• Socket: GitHub Actions Abuse Powers Distributed cPanel/WHM Exploitation Campaign
  writeup2026-07-23It is written here as Unnamed threat actor (unattributed).

  Operator of a distributed cPanel/WHM exploitation campaign that compromised GitHub repositories (starting with developer dinushchathurya's Packagist-linked repos), embedded malicious GitHub Actions workflows to launch GitHub-hosted runners as scanning/exploitation infrastructure, exploited CVE-2026-

• Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT
  writeup2026-07-22It is written here as Unnamed threat actor (operator).

  Individual who registered claude.ai.download-app[.]us and at least 10 domains with the same email address since December 2025; also ran an April 2026 campaign distributing fake Docker Desktop installs via Docker Hub using the same libcef.dll sideloading tactic; Ethereum BSC transactions tied to this

• Opening the Black Box: Agentless Threat Detection for Virtual Appliances
  writeup2026-07-22It is written here as Unnamed threat actor (Amazon Threat Intelligence report).

  Threat actor scanning Fortigate devices for use of default credentials and exploiting older vulnerabilities (CVE-2024-55591, CVE-2024-23113)

• AI Security Briefing
  article2026-07-18It is written here as Unnamed threat actor(s).

  Attackers who disseminate links to malicious-looking-harmless repositories via job posts, tutorials, or messages to lure developers into cloning them with Claude Code, triggering a reverse shell attack

• The OpenSourceMalware Show #13
  talk2026-07-16It is written here as Unnamed threat actor (JScrambler compromise).

  Gained access via an npm publishing credential (unknown if stolen or obtained via GitHub Actions exploit); published malicious jscrambler versions on July 11

• Socket: Coordinated npm/PyPI Campaign Typosquats Paysafe, Skrill, Neteller Payment SDKs
  writeup2026-07-16It is written here as Unnamed threat actor (npm/PyPI typosquat campaign).

  Coordinated actor who published 17 malicious npm and PyPI packages typosquatting Paysafe, Skrill, and Neteller payment SDKs on July 7, 2026, to steal developer secrets and credentials, exfiltrating data to AWS/ngrok infrastructure. Used version-unique obfuscation keys to avoid signature tracking, em

• Threat Actors Achieve Persistence After SQL Injection
  writeup2026-07-13It is written here as Unnamed threat actor (June 26 incident).

  Gained initial access via SQL injection against a tech sector organization; performed recon, created persistence, disabled Windows Defender, installed BadIIS modules, deployed XMRig cryptocurrency miner, and used CnCrypt Protect for defense evasion.

• jscrambler npm Package Compromised in Supply Chain Attack
  writeup2026-07-11

  Attacker who obtained an npm publishing credential for the jscrambler package and published multiple malicious releases (8.14.0, 8.16.0, 8.17.0, 8.18.0, 8.20.0) delivering a Rust-built cross-platform infostealer; per Jscrambler's investigation, 'the attacker was able to publish the package using an

• Compromised Injective SDK npm Package Exfiltrates Wallet Keys and Mnemonics
  advisory2026-07-09

  Compromised a GitHub developer account with established history of contributions to the Injective SDK repository, used it to push malicious commits and publish a backdoored npm package (@injectivelabs/sdk-ts@1.20.21) that exfiltrates wallet private keys and mnemonics; also published version 1.20.21

• AI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
  writeup2026-07-08It is written here as Unnamed threat actor (incident June 3).

  Threat actor who gained RDP access to a domain-joined Windows Server using pre-compromised credentials and deployed an AI-generated ('vibe-coded') PowerShell script to enumerate Active Directory, followed by data exfiltration tools.

• Defence Impairment Olympics
  writeup2026-06-29

  Actor responsible for the incident Huntress responded to on June 7, who used a steganographic webshell, conducted enumeration, and later performed extensive defence impairment techniques (disabling IIS logging, tampering with Defender, killing security processes, clearing event logs, credential dump

• Fantastic clear-text passwords and where to collect them (Part 2 - Windows)
  writeup2026-06-28It is written here as Unnamed threat actor (VPN compromise).

  Gained network access via VPN using credentials Username: Nexus, Password: Nexus123, no MFA, local admin account.

• Fantastic clear-text passwords and where to collect them (Part 1 - Linux)
  article2026-06-21It is written here as Unnamed Threat Actor (Siemens/OpenScape incident).

  TA that hid inside a targeted network for months, stole confidential research material by extracting a Java Keystore password from root's Bash history, then used the extracted private key/certificate plus Tenant ID and client ID to abuse client credentials flow with certificate-based authentication

• Project Glasswing: Initial Update (Anthropic)
  article2026-05-27

  Compromised a customer's email account and made spoof phone calls in an attempt to execute a fraudulent $1.5 million wire transfer at one of Project Glasswing's partner banks; detected and prevented with help from Claude Mythos Preview.

• A Threat Actor Abuses Another Free Trial
  writeup2026-03-06It is written here as Unnamed threat actor (Elastic Cloud SIEM abuse campaign).

  Adversary exploiting SolarWinds Web Help Desk and other vulnerabilities, exfiltrating victim data via encoded PowerShell to a free trial Elastic Cloud SIEM instance for victim triage; used disposable email (quieresmail.com, likely part of firstmail.ltd network), Cloudflare Worker pages for Velocirap

• RMM Abuse: When IT Convenience Bites Back
  article2026-03-05It is written here as Unnamed threat actor (stolen RMM credentials incident).

  Used stolen RMM credentials belonging to an IT support technician to gain initial access to a partner's environment, ran enumeration commands, and attempted defense evasion by disabling the Huntress agent; contained by Huntress SOC about 12 minutes after first command execution.

• They Got In Through SonicWall. Then They Tried to Kill | Huntress
  writeup2026-02-04It is written here as Unnamed threat actor (SonicWall SSLVPN intrusion, February 2026).

  Used compromised SonicWall SSLVPN credentials for initial access, then deployed a BYOVD EDR killer abusing the EnCase EnPortv.sys driver to terminate security processes before ransomware deployment; intrusion was disrupted before ransomware was deployed.

• Huntress Catches SmarterMail Account Takeover Leading to RCE
  advisory2026-01-22It is written here as Unnamed threat actor(s).

  Observed by Huntress conducting in-the-wild exploitation of CVE-2026-23760, hijacking privileged SmarterMail accounts to access System Events functionality and create malicious System Events for reconnaissance command execution; made rapid HTTP POST requests across multiple customers, suggesting mas

• Reflecting on AI in 2025: Faster Attacks, Same Old Tradecraft
  writeup2026-01-12It is written here as Unnamed threat actor (browser credential theft via ScreenConnect).

  Dropped a PowerShell payload through a rogue ScreenConnect session; iterated through three AI-generated scripts (qb_check.ps1 targeting QuickBooks, coinbase_check.ps1 targeting Coinbase, secure.chase.ps1 targeting Chase) before producing a functional Chrome/Edge browser history credential harvester

• ESXi Exploitation in the Wild
  writeup2026-01-07It is written here as Unnamed threat actor (TA).

  Intrusion observed by Huntress in December 2025; deployed VMware ESXi exploit toolkit potentially aiming for ransomware; assessed with high confidence to have gained initial access via compromised SonicWall VPN; assessed as a well-resourced developer likely operating in a Chinese-speaking region bas