Skip to content

Unnamed threat actor/group

Named by 2 kept items in this workspace.

Search every workspace for Unnamed threat actor/group. It matches the name as written, so it can find other things that share it.

The items that name it 2

  • Employee Monitoring and SimpleHelp Software Abused in | Huntress
    writeup2026-02-11It is written here as Unnamed threat actor/group (Net Monitor + SimpleHelp intrusions).

    Single threat actor or group suspected behind both Case #1 and Case #2 intrusions, based on shared infrastructure (dronemaker[.]org), overlapping IOCs, and reuse of the same vhost.exe filename. Financially motivated, targeting cryptocurrency theft (via SimpleHelp keyword monitoring) and ransomware d

  • Trial, Error & Typos: Malware Isn't Always 'Sophisticated' | Huntress
    writeup2025-12-22It is written here as Unnamed threat actor/group (Incidents 1, 2, 3).

    Actor exploiting web application vulnerabilities via IIS w3wp.exe to run commands, deploy a Golang Trojan (agent.exe), and establish persistence; behavior evolved across three incidents (Nov 6, Nov 17, Nov 25) with shared infrastructure, malware naming conventions, and operating folder (C:\Users\Pub

All threat actors in this workspace.