Classic Brechas Mapa Actores TTP Matrix Analitica Alertas CyberNews Arsenal Exploits KillChain Origen SSLBL RansomLook Ransomwhere

MalKamak

0 incidentes 0 paises 0 sectores apt IR Ultimo: -

Aliases: APT MALKAMAK, Operation GhostShell, ShellClient, dominios como www

Ver en IntelTracker → APTTrail →

MalKamak is an Iranian cyber espionage group that first emerged in 2018, operating undetected for at least three years. The group primarily conducts cyber espionage, focusing on the theft of sensitive information from targeted entities. MalKamak is notable for the continuous development and use of ShellClient, a custom Remote Access Trojan that evolved from a basic reverse shell into a modular espionage tool, and its unique approach of utilizing legitimate cloud services like Dropbox for command and control activities to maintain stealth. While some research points to potential connections with other Iranian state-sponsored groups such as APT39 (Chafer APT) and Agrius APT, MalKamak exhibits distinct operational characteristics.

Aliases del actor

APT MALKAMAK Operation GhostShell ShellClient dominios como www

Actores similares

apt-malkamakactor · 1 apt-45actor · 2 apt-c-27actor · 2 apt-c-01actor · 2 apt-c-12actor · 1 apt-18actor · 1 apt-1877teamactor · 1 apt-27actor · 1 apt-30actor · 1 apt-38actor · 1

Canales, DLS e infraestructura asociada

Clasificacion automatica desde IntelTracker/APTTrail/OSINT. Estado real solo si viene indicado por la fuente.

Tipo	Estado	Host / enlace	Title / ultimo titulo
DLS / leak site	unknown	www.cybereason.com	APT MALKAMAK indicators and references
DLS / leak site	unknown	www.virustotal.com	APT MALKAMAK indicators and references
DLS / leak site	unknown	www.virustotal.com	APT MALKAMAK indicators and references
Repositorio	unknown	github.com	APT MALKAMAK indicators and references
DLS / leak site	unknown	raw.githubusercontent.com	APT MALKAMAK indicators and references
DLS / leak site	unknown	www.cybereason.com	APT MALKAMAK indicators and references

Motivacion