216.73.217.22

GlassWorm

· Published 21/12/2025 18:54 · Modified 21/12/2025 18:54 · Source: AlienVault

Essential information

Confidence
100/100
Published
21/12/2025 18:54
Modified
21/12/2025 18:54
Updated at
21/12/2025 18:54
Revoked
No
Author / Source
AlienVault
Resource level
—
Primary motivation
—
Related entities
3 reports, 49 attack patterns (mitre), 2 malware, 1 sectors, 17 indicators

Description

No description.

Marking (TLP)

TLP:CLEAR

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Reports (3)

Attack patterns (MITRE) (49)

  • T1115 uses
    Clipboard Data
  • T1218 uses
    System Binary Proxy Execution
  • T1133 uses
    External Remote Services
  • T1547.001 uses
    Registry Run Keys / Startup Folder
  • T1543.003 uses
    Windows Service
  • T1204.002 uses
    Malicious File
  • T1562.001 uses
    Disable or Modify Tools
  • T1185 uses
    Browser Session Hijacking
  • T1036 uses
    Masquerading
  • T1056 uses
    Input Capture
  • T1518.001 uses
    Security Software Discovery
  • T1113 uses
    Screen Capture
  • T1059.001 uses
    PowerShell
  • T1056.001 uses
    Keylogging
  • T1571 uses
    Non-Standard Port
  • T1608.005 uses
    Link Target
  • T1027 uses
    Obfuscated Files or Information
  • T1497.001 uses
    System Checks
  • T1573 uses
    Encrypted Channel
  • T1059.003 uses
    Windows Command Shell
  • T1059 uses
    Command and Scripting Interpreter
  • T1554 uses
    Compromise Host Software Binary
  • T1539 uses
    Steal Web Session Cookie
  • T1498 uses
    Network Denial of Service
  • T1497.003 uses
    Time Based Checks
  • T1195.002 uses
    Compromise Software Supply Chain
  • T1102.003 uses
    One-Way Communication
  • T1608.001 uses
    Upload Malware
  • T1573.001 uses
    Symmetric Cryptography
  • T1140 uses
    Deobfuscate/Decode Files or Information
  • T1071 uses
    Application Layer Protocol
  • T1573.002 uses
    Asymmetric Cryptography
  • T1078 uses
    Valid Accounts
  • T1608.004 uses
    Drive-by Target
  • T1102 uses
    Web Service
  • T1195.001 uses
    Compromise Software Dependencies and Development Tools
  • T1105 uses
    Ingress Tool Transfer
  • T1195 uses
    Supply Chain Compromise
  • T1071.001 uses
    Web Protocols
  • T1021 uses
    Remote Services
  • T1205.001 uses
    Port Knocking
  • T1059.007 uses
    JavaScript
  • T1176 uses
    Software Extensions
  • T1102.001 uses
    Dead Drop Resolver
  • T1059.004 uses
    Unix Shell
  • T1555 uses
    Credentials from Password Stores
  • T1036.005 uses
    Match Legitimate Resource Name or Location
  • T1190 uses
    Exploit Public-Facing Application
  • T1056.004 uses
    Credential API Hooking

Malware (2)

  • GlassWorm uses
    Family
    Published 26/03/2026 20:45 · Modified 26/03/2026 20:45
  • GlassWASM uses
    Family
    Published 16/06/2026 04:27 · Modified 16/06/2026 04:27

Sectors (1)

  • Technology targets

Indicators (17)