216.73.217.22

Cosmic Leopard

· Published 21/12/2025 04:47 · Modified 21/12/2025 04:47 · Source: AlienVault

Essential information

Confidence
100/100
Published
21/12/2025 04:47
Modified
21/12/2025 04:47
Updated at
21/12/2025 04:47
Revoked
No
Author / Source
AlienVault
Resource level
—
Primary motivation
—
Related entities
1 reports, 15 attack patterns (mitre), 2 malware, 2 countries, 142 indicators

Description

No description.

Marking (TLP)

TLP:CLEAR

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Reports (1)

Attack patterns (MITRE) (15)

  • T1598 uses
    Phishing for Information
  • T1583 uses
    Acquire Infrastructure
  • T1204 uses
    User Execution
  • T1486 uses
    Data Encrypted for Impact
  • T1573 uses
    Encrypted Channel
  • T1489 uses
    Service Stop
  • T1059 uses
    Command and Scripting Interpreter
  • T1056 uses
    Input Capture
  • T1557 uses
    Adversary-in-the-Middle
  • T1608 uses
    Stage Capabilities
  • T1588 uses
    Obtain Capabilities
  • Search Closed Sources uses
    T1597
  • T1555 uses
    Credentials from Password Stores
  • T1592 uses
    Gather Victim Host Information
  • T1083 uses
    File and Directory Discovery

Malware (2)

  • HeavyLift uses
    Family
    Published 14/06/2024 08:31 · Modified 14/06/2024 08:31
  • GravityRAT - S0237 uses
    AlienVault Confidence 100
    First seen 01/01/1970 · Last seen 16/11/5138 Published 20/12/2025 19:44 · Modified 21/12/2025 04:47

Countries (2)

  • British Indian Ocean Territory targets
  • India targets

Indicators (142)