Threat landscape — Belgium

Search IOCs, vulnerabilities, APT…

216.73.216.169

← Back to attack reports

Threat landscape — Belgium

· Published 29/05/2026 11:51

Share: LinkedIn Facebook Mastodon X

Export JSON

Essential information

Published: 29/05/2026 11:51
Modified: —
Confidence: 100/100
Report type(s): threat-report
Related entities: 18 vulnerabilities (cve), 20 intrusion sets (apt), 200 techniques (mitre), 200 malware, 26 tools

Description

Landscape de menace exporté depuis opencti-cli pour le secteur « ». Périmètre pays : Belgium. Importer via Data → Import / Import from STIX, ou rattacher à un rapport existant.

Related entities

Vulnerabilities, IOCs, intrusion sets, MITRE techniques and other entities referenced in this report.

Vulnerabilities (CVE) (18)

CVE-2023-46805 KEV

8.2 High

Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the …

Attack vector: Network
Published: 10/01/2024
Modified: 27/05/2026

CVE-2021-34473 KEV

Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution.

Published: 03/11/2021
Modified: 29/05/2026

CVE-2019-0797 KEV

Microsoft Win32k contains a privilege escalation vulnerability when the Win32k component fails to properly handle objects in memory. Successful exploitation allows an …

Published: 03/11/2021
Modified: 29/05/2026

CVE-2017-11882 KEV

7.8 High

Microsoft Office contains a memory corruption vulnerability that allows remote code execution in the context of the current user.

Attack vector: Local
Complexity: Low
Published: 15/11/2017
Modified: 29/05/2026

CWE-119

CVE-2025-55182 KEV

10.0 Critical

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, …

Attack vector: Network
Published: 05/12/2025
Modified: 29/05/2026

Analyzed

CVE-2023-27532 KEV

7.5 High

Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within …

Attack vector: Network
Published: 22/08/2023
Modified: 27/05/2026

← Previous

Page / 2

13–18 of 18

Vssrtje

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Shenzhen Haimaiyunxiang Media Co., Ltd.

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Magic Hound COBALT ILLUSIONITG18

The MITRE Corporation Confidence 100

[Magic Hound](https://attack.mitre.org/groups/G0059) is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European,…

First seen 01/01/1970 · Last seen 16/11/5138 ·
KageNoHitobito and DoNex

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Larva-24005

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
GroozaV2

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Russia

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Webworm

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
GALLIUM Granite Typhoon

The MITRE Corporation Confidence 100

[GALLIUM](https://attack.mitre.org/groups/G0093) is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia,…

First seen 01/01/1970 · Last seen 16/11/5138 ·
Hadoken Security Group

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Qilin

Ransomware.Live Confidence 100

Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator.…

First seen 01/01/1970 · Last seen 16/11/5138 ·
UAC-0063

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·

← Previous

Page / 2

1–12 of 20

T1553.005

Mark-of-the-Web Bypass MITRE
T1087.002

Domain Account MITRE
T1027.001

Binary Padding MITRE
T1070.003

Clear Command History MITRE
T1050

MITRE
T1021.002

SMB/Windows Admin Shares MITRE
T1590.005

IP Addresses MITRE
T1030

Data Transfer Size Limits MITRE
T1025

Data from Removable Media MITRE
T1036.005

Match Legitimate Resource Name or Location MITRE
T1484.001

Group Policy Modification MITRE
T1078

Valid Accounts MITRE

← Previous

Page / 17

25–36 of 200

PondRAT

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
SeaDuke - S0053

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Thoper

The MITRE Corporation Confidence 100

[PlugX](https://attack.mitre.org/software/S0013) is a remote access tool (RAT) with modular plugins that has been used by multiple threat groups.(Citation: Lastline PlugX Analysis)(Citation: FireEye Clandestine Fox Part 2)(Citation: New DragonOK)(Citation:…

First seen 01/01/1970 · Last seen 16/11/5138 ·
LPEClient

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
CollectionRAT

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
QUIETEXIT

Family The MITRE Corporation Confidence 100

[QUIETEXIT](https://attack.mitre.org/software/S1084) is a novel backdoor, based on the open-source Dropbear SSH client-server software, that has been used by [APT29](https://attack.mitre.org/groups/G0016) since at least 2021. [APT29](https://attack.mitre.org/groups/G0016) has deployed [QUIETEXIT](https://attack.mitre.org/software/S1084) on…

First seen 01/01/1970 · Last seen 16/11/5138 ·
JuicyPotato

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
TSVIPSrv.dll

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
RegDuke

Family The MITRE Corporation Confidence 100

[RegDuke](https://attack.mitre.org/software/S0511) is a first stage implant written in .NET and used by [APT29](https://attack.mitre.org/groups/G0016) since at least 2017. [RegDuke](https://attack.mitre.org/software/S0511) has been used to control a compromised machine when control…

First seen 01/01/1970 · Last seen 16/11/5138 ·
ScoringMathTea

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
POSHSPY

Family The MITRE Corporation Confidence 100

[POSHSPY](https://attack.mitre.org/software/S0150) is a backdoor that has been used by [APT29](https://attack.mitre.org/groups/G0016) since at least 2015. It appears to be used as a secondary backdoor used if the actors lost…

First seen 01/01/1970 · Last seen 16/11/5138 ·
PyPlunderPlug

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·

← Previous

Page / 17

1–12 of 200

Sliver

The MITRE Corporation Confidence 100

[Sliver](https://attack.mitre.org/software/S0633) is an open source, cross-platform, red team command and control (C2) framework written in Golang. [Sliver](https://attack.mitre.org/software/S0633) includes its own package manager, "armory," for staging and downloading additional…
netsh

The MITRE Corporation Confidence 100

[netsh](https://attack.mitre.org/software/S0108) is a scripting utility used to interact with networking components on local or remote systems. (Citation: TechNet Netsh)
Pupy

The MITRE Corporation Confidence 100

[Pupy](https://attack.mitre.org/software/S0192) is an open source, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool. (Citation: GitHub Pupy) It is written in Python and can be generated as…
ipconfig

The MITRE Corporation Confidence 100

[ipconfig](https://attack.mitre.org/software/S0100) is a Windows utility that can be used to find information about a system's TCP/IP, DNS, DHCP, and adapter configuration. (Citation: TechNet Ipconfig)
BloodHound

The MITRE Corporation Confidence 100

[BloodHound](https://attack.mitre.org/software/S0521) is an Active Directory (AD) reconnaissance tool that can reveal hidden relationships and identify attack paths within an AD environment.(Citation: GitHub Bloodhound)(Citation: CrowdStrike BloodHound April 2018)(Citation: FoxIT…
Ping

The MITRE Corporation Confidence 100

[Ping](https://attack.mitre.org/software/S0097) is an operating system utility commonly used to troubleshoot and verify network connections. (Citation: TechNet Ping)
Net

The MITRE Corporation Confidence 100

The [Net](https://attack.mitre.org/software/S0039) utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. (Citation: Microsoft…
Mimikatz

The MITRE Corporation Confidence 100

[Mimikatz](https://attack.mitre.org/software/S0002) is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of…
Tasklist

The MITRE Corporation Confidence 100

The [Tasklist](https://attack.mitre.org/software/S0057) utility displays a list of applications and services with their Process IDs (PID) for all tasks running on either a local or a remote computer. It…
AdFind

The MITRE Corporation Confidence 100

[AdFind](https://attack.mitre.org/software/S0552) is a free command-line query tool that can be used for gathering information from Active Directory.(Citation: Red Canary Hospital Thwarted Ryuk October 2020)(Citation: FireEye FIN6 Apr 2019)(Citation:…
at

The MITRE Corporation Confidence 100

[at](https://attack.mitre.org/software/S0110) is used to schedule tasks on a system to run at a specified date or time.(Citation: TechNet At)(Citation: Linux at)
Reg

The MITRE Corporation Confidence 100

[Reg](https://attack.mitre.org/software/S0075) is a Windows utility used to interact with the Windows Registry. It can be used at the command-line interface to query, add, modify, and remove information. (Citation:…

← Previous

Page / 3

13–24 of 26

Contact About Legal notice Privacy policy Terms of use