Embargo
Reports
3
First seen
Mar 19, 2026
Last seen
Jun 30, 2026
Motivation
Financial
Targeting
Sectors
Victim regions
×2×2
United States×2
Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.
Top ATT&CK techniques
T1562.001 Impair Defenses: Disable or Modify Tools ×1T1562.006 Impair Defenses: Indicator Blocking ×1T1027.002 Obfuscated Files or Information: Software Packing ×1T1543.003 Create or Modify System Process: Windows Service ×1T1059.003 Command and Scripting Interpreter: Windows Command Shell ×1T1027 Obfuscated Files or Information ×1T1569.002 System Services: Service Execution ×1T1562.009 Impair Defenses: Safe Mode Boot ×1T1068 Exploitation for Privilege Escalation ×1T1489 Service Stop ×1
Indicators
filename ×49domain ×2
Indicator values are available on Pro and via the API.