Threat landscape — Belgium

Search IOCs, vulnerabilities, APT…

216.73.216.197

← Back to attack reports

Threat landscape — Belgium

· Published 29/05/2026 11:51

Share: LinkedIn Facebook Mastodon X

Export JSON

Essential information

Published: 29/05/2026 11:51
Modified: —
Confidence: 100/100
Report type(s): threat-report
Related entities: 18 vulnerabilities (cve), 20 intrusion sets (apt), 200 techniques (mitre), 200 malware, 26 tools

Description

Landscape de menace exporté depuis opencti-cli pour le secteur « ». Périmètre pays : Belgium. Importer via Data → Import / Import from STIX, ou rattacher à un rapport existant.

Related entities

Vulnerabilities, IOCs, intrusion sets, MITRE techniques and other entities referenced in this report.

Vulnerabilities (CVE) (18)

CVE-2023-46805 KEV

8.2 High

Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the …

Attack vector: Network
Published: 10/01/2024
Modified: 27/05/2026

CVE-2021-34473 KEV

Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution.

Published: 03/11/2021
Modified: 29/05/2026

CVE-2019-0797 KEV

Microsoft Win32k contains a privilege escalation vulnerability when the Win32k component fails to properly handle objects in memory. Successful exploitation allows an …

Published: 03/11/2021
Modified: 29/05/2026

CVE-2017-11882 KEV

7.8 High

Microsoft Office contains a memory corruption vulnerability that allows remote code execution in the context of the current user.

Attack vector: Local
Complexity: Low
Published: 15/11/2017
Modified: 29/05/2026

CWE-119

CVE-2025-55182 KEV

10.0 Critical

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, …

Attack vector: Network
Published: 05/12/2025
Modified: 29/05/2026

Analyzed

CVE-2023-27532 KEV

7.5 High

Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within …

Attack vector: Network
Published: 22/08/2023
Modified: 27/05/2026

← Previous

Page / 2

13–18 of 18

Vssrtje

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Shenzhen Haimaiyunxiang Media Co., Ltd.

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Magic Hound COBALT ILLUSIONITG18

The MITRE Corporation Confidence 100

[Magic Hound](https://attack.mitre.org/groups/G0059) is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European,…

First seen 01/01/1970 · Last seen 16/11/5138 ·
KageNoHitobito and DoNex

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Larva-24005

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
GroozaV2

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Russia

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Webworm

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
GALLIUM Granite Typhoon

The MITRE Corporation Confidence 100

[GALLIUM](https://attack.mitre.org/groups/G0093) is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia,…

First seen 01/01/1970 · Last seen 16/11/5138 ·
Hadoken Security Group

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Qilin

Ransomware.Live Confidence 100

Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator.…

First seen 01/01/1970 · Last seen 16/11/5138 ·
UAC-0063

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·

← Previous

Page / 2

1–12 of 20

T1557

Adversary-in-the-Middle MITRE
T1562.006

Indicator Blocking MITRE
T1057

Process Discovery MITRE
T1003

OS Credential Dumping MITRE
T1019

MITRE
T1021.004

SSH MITRE
T1433

MITRE
T1585

Establish Accounts MITRE
T1110.001

Password Guessing MITRE
T1574.011

Services Registry Permissions Weakness MITRE
T1223

MITRE
T1063

MITRE

← Previous

Page / 17

1–12 of 200

Trojan:Win64/NukeSped

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
ChainWorm

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
BlackSmith

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
ClaimLoader

The MITRE Corporation Confidence 100

[CLAIMLOADER](https://attack.mitre.org/software/S1236) is a malware variant that frequently accompanies legitimate executables that are used for DLL side-loading known to be leveraged by [Mustang Panda](https://attack.mitre.org/groups/G0129) and was first observed utilized…

First seen 01/01/1970 · Last seen 16/11/5138 ·
LameHug

AlienVault Confidence 100

[LAMEHUG](https://attack.mitre.org/software/S9035) is Python-based information stealer first identified in July 2025 by Ukraine's Computer Emergency Response Team (CERT-UA) in phishing emails targeting Ukrainian government officials. [LAMEHUG](https://attack.mitre.org/software/S9035) is the first…

First seen 01/01/1970 · Last seen 16/11/5138 ·
CHERRYSPY

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
ThreatNeedle - S0665

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
WellMail

Family The MITRE Corporation Confidence 100

[WellMail](https://attack.mitre.org/software/S0515) is a lightweight malware written in Golang used by [APT29](https://attack.mitre.org/groups/G0016), similar in design and structure to [WellMess](https://attack.mitre.org/software/S0514).(Citation: CISA WellMail July 2020)(Citation: NCSC APT29 July 2020)

First seen 01/01/1970 · Last seen 16/11/5138 ·
FatalRAT

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
NativeZone

Family The MITRE Corporation Confidence 100

[NativeZone](https://attack.mitre.org/software/S0637) is the name given collectively to disposable custom [Cobalt Strike](https://attack.mitre.org/software/S0154) loaders used by [APT29](https://attack.mitre.org/groups/G0016) since at least 2021.(Citation: MSTIC Nobelium Toolset May 2021)(Citation: SentinelOne NobleBaron June 2021)

First seen 01/01/1970 · Last seen 16/11/5138 ·
PolyglotDuke

Family The MITRE Corporation Confidence 100

[PolyglotDuke](https://attack.mitre.org/software/S0518) is a downloader that has been used by [APT29](https://attack.mitre.org/groups/G0016) since at least 2013. [PolyglotDuke](https://attack.mitre.org/software/S0518) has been used to drop [MiniDuke](https://attack.mitre.org/software/S0051).(Citation: ESET Dukes October 2019)

First seen 01/01/1970 · Last seen 16/11/5138 ·
Fast16

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·

← Previous

Page / 17

73–84 of 200

Windows Credential Editor

The MITRE Corporation Confidence 100

[Windows Credential Editor](https://attack.mitre.org/software/S0005) is a password dumping tool. (Citation: Amplia WCE)
meek

The MITRE Corporation Confidence 100

[meek](https://attack.mitre.org/software/S0175) is an open-source Tor plugin that tunnels Tor traffic through HTTPS connections.

← Previous

Page / 3

25–26 of 26

Contact About Legal notice Privacy policy Terms of use