216.73.217.22

Eagle Werewolf, ENERGETIC BEAR, Velvet Tempest, APT28, GrayCharlie

· Published 22/05/2026 09:12 · Modified 22/05/2026 09:12 · Source: AlienVault

Essential information

Confidence
100/100
Published
22/05/2026 09:12
Modified
22/05/2026 09:12
Updated at
22/05/2026 09:12
Revoked
No
Author / Source
AlienVault
Resource level
—
Primary motivation
—
Related entities
1 reports, 21 attack patterns (mitre), 24 malware, 2 sectors, 5 indicators, 1 vulnerabilities (cve)

Description

No description.

Marking (TLP)

TLP:CLEAR

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Reports (1)

Attack patterns (MITRE) (21)

  • T1027 uses
    Obfuscated Files or Information
  • T1583.001 uses
    Domains
  • T1078 uses
    Valid Accounts
  • T1059.001 uses
    PowerShell
  • T1562.001 uses
    Disable or Modify Tools
  • T1204.001 uses
    Malicious Link
  • T1543 uses
    Create or Modify System Process
  • T1136 uses
    Create Account
  • T1566.001 uses
    Spearphishing Attachment
  • T1098 uses
    Account Manipulation
  • T1036 uses
    Masquerading
  • T1071.004 uses
    DNS
  • T1573 uses
    Encrypted Channel
  • T1055 uses
    Process Injection
  • T1497 uses
    Virtualization/Sandbox Evasion
  • T1105 uses
    Ingress Tool Transfer
  • T1053 uses
    Scheduled Task/Job
  • T1106 uses
    Native API
  • T1140 uses
    Deobfuscate/Decode Files or Information
  • T1190 uses
    Exploit Public-Facing Application
  • T1071.001 uses
    Web Protocols

Malware (24)

  • Prism X uses
    Family
    Published 21/05/2026 23:03 · Modified 21/05/2026 23:03
  • EchoGather uses
    Family
    Published 21/05/2026 23:03 · Modified 21/05/2026 23:03
  • Mozi uses
    Family
    Published 21/05/2026 23:03 · Modified 21/05/2026 23:03
  • Cobalt Strike - S0154 uses
    AlienVault Confidence 100
    First seen 01/01/1970 · Last seen 16/11/5138 Published 20/12/2025 19:39 · Modified 27/05/2026 21:40
  • Termite uses
    Family
    Published 21/05/2026 23:03 · Modified 21/05/2026 23:03
  • SoullessRAT uses
    Family
    Published 21/05/2026 23:03 · Modified 21/05/2026 23:03
  • Mirai uses
    Family
    Published 21/05/2026 23:03 · Modified 21/05/2026 23:03
  • Phorpiex uses
    Family
    Published 21/05/2026 23:03 · Modified 21/05/2026 23:03
  • Gophish uses
    Family
    Published 21/05/2026 23:03 · Modified 21/05/2026 23:03
  • DynoWiper uses
    Family
    Published 21/05/2026 23:03 · Modified 21/05/2026 23:03
  • RondoDox uses
    Family
    Published 21/05/2026 23:03 · Modified 21/05/2026 23:03
  • Acunetix uses
    Family
    Published 21/05/2026 23:03 · Modified 21/05/2026 23:03
  • Keitaro uses
    Family
    Published 21/05/2026 23:03 · Modified 21/05/2026 23:03
  • Sliver uses
    Family
    Published 12/06/2026 21:29 · Modified 12/06/2026 21:29
  • Tactical RMM uses
    Family
    Published 21/05/2026 23:03 · Modified 21/05/2026 23:03
  • AquilaRAT uses
    Family
    Published 21/05/2026 23:03 · Modified 21/05/2026 23:03
  • LockBit Black uses
    Family
    Published 21/05/2026 23:03 · Modified 21/05/2026 23:03
  • NetSupport RAT uses
    Family
    Published 22/05/2026 13:08 · Modified 22/05/2026 13:08
  • Twizt uses
    Family
    Published 21/05/2026 23:03 · Modified 21/05/2026 23:03
  • HellsUchecker uses
    Family
    Published 21/05/2026 23:03 · Modified 21/05/2026 23:03
  • Phexia uses
    Family
    Published 21/05/2026 23:03 · Modified 21/05/2026 23:03
  • Hajime uses
    Family
    Published 21/05/2026 23:03 · Modified 21/05/2026 23:03
  • XMRig uses
    Family
    Published 28/05/2026 10:56 · Modified 28/05/2026 10:56
  • AsyncRAT uses
    Family
    Published 11/06/2026 16:31 · Modified 11/06/2026 16:31

Sectors (2)

  • Government targets
  • Energy targets

Indicators (5)

Vulnerabilities (CVE) (1)

CVE-2025-11953 KEV
9.8 Critical

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes …

Attack vector
NETWORK
Published
03/11/2025
Modified
07/02/2026
Awaiting Analysis