216.73.217.22

Hive0163, Rhysida, Vanilla Tempest, TAG-124, ITG23

· Published 15/06/2026 20:15 · Modified 15/06/2026 20:15 · Source: AlienVault

Essential information

Confidence
100/100
Published
15/06/2026 20:15
Modified
15/06/2026 20:15
Updated at
15/06/2026 20:15
Revoked
No
Author / Source
AlienVault
Resource level
—
Primary motivation
—
Related entities
1 reports, 22 attack patterns (mitre), 24 malware, 18 sectors, 1 countries, 133 indicators, 2 vulnerabilities (cve)

Description

No description.

Marking (TLP)

TLP:CLEAR

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Reports (1)

Attack patterns (MITRE) (22)

  • T1566 uses
    Phishing
  • T1490 uses
    Inhibit System Recovery
  • T1018 uses
    Remote System Discovery
  • T1105 uses
    Ingress Tool Transfer
  • T1059.001 uses
    PowerShell
  • T1204 uses
    User Execution
  • T1059.003 uses
    Windows Command Shell
  • T1087.002 uses
    Domain Account
  • T1053.005 uses
    Scheduled Task
  • T1003 uses
    OS Credential Dumping
  • T1083 uses
    File and Directory Discovery
  • T1021.001 uses
    Remote Desktop Protocol
  • T1486 uses
    Data Encrypted for Impact
  • T1140 uses
    Deobfuscate/Decode Files or Information
  • T1218.011 uses
    Rundll32
  • T1547.001 uses
    Registry Run Keys / Startup Folder
  • T1189 uses
    Drive-by Compromise
  • T1203 uses
    Exploitation for Client Execution
  • T1190 uses
    Exploit Public-Facing Application
  • T1027.002 uses
    Software Packing
  • T1055 uses
    Process Injection
  • T1482 uses
    Domain Trust Discovery

Malware (24)

  • PortStarter uses
    Family
    Published 12/06/2026 21:29 · Modified 12/06/2026 21:29
  • Supper uses
    Family
    Published 12/06/2026 21:29 · Modified 12/06/2026 21:29
  • NodeSnake uses
    Family
    Published 12/06/2026 21:29 · Modified 12/06/2026 21:29
  • Dave uses
    Family
    Published 12/06/2026 21:29 · Modified 12/06/2026 21:29
  • Plus Keylogger uses
    Family
    Published 12/06/2026 21:29 · Modified 12/06/2026 21:29
  • Gootloader uses
    Family
    Published 12/06/2026 21:29 · Modified 12/06/2026 21:29
  • Brave Prince - S0252 uses
    AlienVault Confidence 100
    First seen 01/01/1970 · Last seen 16/11/5138 Published 21/12/2025 06:47 · Modified 21/12/2025 06:47
  • InterlockRAT uses
    Family
    Published 12/06/2026 21:29 · Modified 12/06/2026 21:29
  • Vidar uses
    Family
    Published 16/06/2026 09:50 · Modified 16/06/2026 09:50
  • Mallard uses
    Family
    Published 12/06/2026 21:29 · Modified 12/06/2026 21:29
  • Interlock uses
    Family
    Published 12/06/2026 21:29 · Modified 12/06/2026 21:29
  • Sliver uses
    Family
    Published 12/06/2026 21:29 · Modified 12/06/2026 21:29
  • Latrodectus uses
    Family
    Published 12/06/2026 21:29 · Modified 12/06/2026 21:29
  • ModeloRAT uses
    Family
    Published 12/06/2026 21:29 · Modified 12/06/2026 21:29
  • SystemBC uses
    Family
    Published 12/06/2026 21:29 · Modified 12/06/2026 21:29
  • Berserk Stealer uses
    Family
    Published 12/06/2026 21:29 · Modified 12/06/2026 21:29
  • JunkFiction uses
    Family
    Published 12/06/2026 21:29 · Modified 12/06/2026 21:29
  • Endico uses
    Family
    Published 12/06/2026 21:29 · Modified 12/06/2026 21:29
  • SocGholish uses
    Family
    Published 12/06/2026 21:29 · Modified 12/06/2026 21:29
  • NtlmThief uses
    Family
    Published 12/06/2026 21:29 · Modified 12/06/2026 21:29
  • Broomstick uses
    Family
    Published 12/06/2026 21:29 · Modified 12/06/2026 21:29
  • Tomb uses
    AlienVault Confidence 100
    First seen 01/01/1970 · Last seen 16/11/5138 Published 15/06/2026 20:15 · Modified 15/06/2026 20:15
  • Rhysida uses
    Family
    Published 12/06/2026 21:29 · Modified 12/06/2026 21:29
  • MintLoader uses
    Family
    Published 12/06/2026 21:29 · Modified 12/06/2026 21:29

Sectors (18)

  • Education targets
  • Government targets
  • Construction targets
  • Agriculture targets
  • Aerospace targets
  • Finance targets
  • Defense targets
  • Telecommunications targets
  • Chemical targets
  • Transportation targets
  • Retail targets
  • Energy targets
  • Media targets
  • Hospitality targets
  • Healthcare targets
  • NGO targets
  • Technology targets
  • Manufacturing targets

Countries (1)

  • United States of America targets

Indicators (133)

Vulnerabilities (CVE) (2)

CVE-2023-36036 KEV
7.8 High

Microsoft Windows Cloud Files Mini Filter Driver contains a privilege escalation vulnerability that could allow an attacker to gain SYSTEM privileges.

Attack vector
Local
Published
14/11/2023
Modified
15/06/2026
CVE-2026-20131 KEV
10.0 Critical

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to …

Attack vector
NETWORK
Complexity
Low
Published
04/03/2026
Modified
14/04/2026