Threat landscape — Belgium

Search IOCs, vulnerabilities, APT…

216.73.216.86

← Back to attack reports

Threat landscape — Belgium

· Published 29/05/2026 11:51

Share: LinkedIn Facebook Mastodon X

Export JSON

Essential information

Published: 29/05/2026 11:51
Modified: —
Confidence: 100/100
Report type(s): threat-report
Related entities: 18 vulnerabilities (cve), 20 intrusion sets (apt), 200 techniques (mitre), 200 malware, 26 tools

Description

Landscape de menace exporté depuis opencti-cli pour le secteur « ». Périmètre pays : Belgium. Importer via Data → Import / Import from STIX, ou rattacher à un rapport existant.

Related entities

Vulnerabilities, IOCs, intrusion sets, MITRE techniques and other entities referenced in this report.

Vulnerabilities (CVE) (18)

CVE-2023-46805 KEV

8.2 High

Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the …

Attack vector: Network
Published: 10/01/2024
Modified: 27/05/2026

CVE-2021-34473 KEV

Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution.

Published: 03/11/2021
Modified: 29/05/2026

CVE-2019-0797 KEV

Microsoft Win32k contains a privilege escalation vulnerability when the Win32k component fails to properly handle objects in memory. Successful exploitation allows an …

Published: 03/11/2021
Modified: 29/05/2026

CVE-2017-11882 KEV

7.8 High

Microsoft Office contains a memory corruption vulnerability that allows remote code execution in the context of the current user.

Attack vector: Local
Complexity: Low
Published: 15/11/2017
Modified: 29/05/2026

CWE-119

CVE-2025-55182 KEV

10.0 Critical

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, …

Attack vector: Network
Published: 05/12/2025
Modified: 29/05/2026

Analyzed

CVE-2023-27532 KEV

7.5 High

Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within …

Attack vector: Network
Published: 22/08/2023
Modified: 27/05/2026

← Previous

Page / 2

13–18 of 18

Vssrtje

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Shenzhen Haimaiyunxiang Media Co., Ltd.

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Magic Hound COBALT ILLUSIONITG18

The MITRE Corporation Confidence 100

[Magic Hound](https://attack.mitre.org/groups/G0059) is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European,…

First seen 01/01/1970 · Last seen 16/11/5138 ·
KageNoHitobito and DoNex

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Larva-24005

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
GroozaV2

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Russia

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Webworm

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
GALLIUM Granite Typhoon

The MITRE Corporation Confidence 100

[GALLIUM](https://attack.mitre.org/groups/G0093) is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia,…

First seen 01/01/1970 · Last seen 16/11/5138 ·
Hadoken Security Group

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Qilin

Ransomware.Live Confidence 100

Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator.…

First seen 01/01/1970 · Last seen 16/11/5138 ·
UAC-0063

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·

← Previous

Page / 2

1–12 of 20

T1557

Adversary-in-the-Middle MITRE
T1562.006

Indicator Blocking MITRE
T1057

Process Discovery MITRE
T1003

OS Credential Dumping MITRE
T1019

MITRE
T1021.004

SSH MITRE
T1433

MITRE
T1585

Establish Accounts MITRE
T1110.001

Password Guessing MITRE
T1574.011

Services Registry Permissions Weakness MITRE
T1223

MITRE
T1063

MITRE

← Previous

Page / 17

1–12 of 200

Headlace

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
HIUPAN

Family The MITRE Corporation Confidence 100

[HIUPAN](https://attack.mitre.org/software/S1230) (aka U2DiskWatch) is a is a worm that propagates through removable drives known to be leveraged by [Mustang Panda](https://attack.mitre.org/groups/G0129) and was first observed utilized in 2024. (Citation:…

First seen 01/01/1970 · Last seen 16/11/5138 ·
Mydoor

The MITRE Corporation Confidence 100

[gh0st RAT](https://attack.mitre.org/software/S0032) is a remote access tool (RAT). The source code is public and it has been used by multiple groups.(Citation: FireEye Hacking Team)(Citation: Arbor Musical Chairs Feb…

First seen 01/01/1970 · Last seen 16/11/5138 ·
GeminiDuke

Family The MITRE Corporation Confidence 100

[GeminiDuke](https://attack.mitre.org/software/S0049) is malware that was used by [APT29](https://attack.mitre.org/groups/G0016) from 2009 to 2012. (Citation: F-Secure The Dukes)

First seen 01/01/1970 · Last seen 16/11/5138 ·
HATVIBE

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
BugDrop

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Manuscrypt

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
JSObfuscated

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
SUNSPOT

Family The MITRE Corporation Confidence 100

[SUNSPOT](https://attack.mitre.org/software/S0562) is an implant that injected the [SUNBURST](https://attack.mitre.org/software/S0559) backdoor into the SolarWinds Orion software update framework. It was used by [APT29](https://attack.mitre.org/groups/G0016) since at least February 2020.(Citation: CrowdStrike SUNSPOT…

First seen 01/01/1970 · Last seen 16/11/5138 ·
Cobalt Strike - S0154

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
WeaselStore

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Ranid Downloader

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·

← Previous

Page / 17

85–96 of 200

Sliver

The MITRE Corporation Confidence 100

[Sliver](https://attack.mitre.org/software/S0633) is an open source, cross-platform, red team command and control (C2) framework written in Golang. [Sliver](https://attack.mitre.org/software/S0633) includes its own package manager, "armory," for staging and downloading additional…
netsh

The MITRE Corporation Confidence 100

[netsh](https://attack.mitre.org/software/S0108) is a scripting utility used to interact with networking components on local or remote systems. (Citation: TechNet Netsh)
Pupy

The MITRE Corporation Confidence 100

[Pupy](https://attack.mitre.org/software/S0192) is an open source, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool. (Citation: GitHub Pupy) It is written in Python and can be generated as…
ipconfig

The MITRE Corporation Confidence 100

[ipconfig](https://attack.mitre.org/software/S0100) is a Windows utility that can be used to find information about a system's TCP/IP, DNS, DHCP, and adapter configuration. (Citation: TechNet Ipconfig)
BloodHound

The MITRE Corporation Confidence 100

[BloodHound](https://attack.mitre.org/software/S0521) is an Active Directory (AD) reconnaissance tool that can reveal hidden relationships and identify attack paths within an AD environment.(Citation: GitHub Bloodhound)(Citation: CrowdStrike BloodHound April 2018)(Citation: FoxIT…
Ping

The MITRE Corporation Confidence 100

[Ping](https://attack.mitre.org/software/S0097) is an operating system utility commonly used to troubleshoot and verify network connections. (Citation: TechNet Ping)
Net

The MITRE Corporation Confidence 100

The [Net](https://attack.mitre.org/software/S0039) utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. (Citation: Microsoft…
Mimikatz

The MITRE Corporation Confidence 100

[Mimikatz](https://attack.mitre.org/software/S0002) is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of…
Tasklist

The MITRE Corporation Confidence 100

The [Tasklist](https://attack.mitre.org/software/S0057) utility displays a list of applications and services with their Process IDs (PID) for all tasks running on either a local or a remote computer. It…
AdFind

The MITRE Corporation Confidence 100

[AdFind](https://attack.mitre.org/software/S0552) is a free command-line query tool that can be used for gathering information from Active Directory.(Citation: Red Canary Hospital Thwarted Ryuk October 2020)(Citation: FireEye FIN6 Apr 2019)(Citation:…
at

The MITRE Corporation Confidence 100

[at](https://attack.mitre.org/software/S0110) is used to schedule tasks on a system to run at a specified date or time.(Citation: TechNet At)(Citation: Linux at)
Reg

The MITRE Corporation Confidence 100

[Reg](https://attack.mitre.org/software/S0075) is a Windows utility used to interact with the Windows Registry. It can be used at the command-line interface to query, add, modify, and remove information. (Citation:…

← Previous

Page / 3

13–24 of 26

Contact About Legal notice Privacy policy Terms of use