PhantomCore
· Published 23/01/2026 12:02 · Modified 23/01/2026 12:02
· Source: AlienVault
Essential information
- Confidence
- 100/100
- Published
- 23/01/2026 12:02
- Modified
- 23/01/2026 12:02
- Updated at
- 23/01/2026 12:02
- Revoked
- No
- Author / Source
- AlienVault
- Resource level
- —
- Primary motivation
- —
- Related entities
- 1 reports, 10 attack patterns (mitre), 2 malware, 9 sectors, 2 countries, 18 indicators
Description
No description.
Marking (TLP)
TLP:CLEAR
Related entities
Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.
Reports (1)
-
7 MITREs 2 Malwares 7 Observables 1 APT
Attack patterns (MITRE) (10)
-
T1071 usesApplication Layer Protocol MITRE
-
T1016 usesSystem Network Configuration Discovery MITRE
-
T1132 usesData Encoding MITRE
-
T1082 usesSystem Information Discovery MITRE
-
T1059.001 usesPowerShell MITRE
-
T1204 usesUser Execution MITRE
-
T1027 usesObfuscated Files or Information MITRE
-
T1566 usesPhishing MITRE
-
T1105 usesIngress Tool Transfer MITRE
-
T1053.005 usesScheduled Task MITRE
Malware (2)
-
PhantomCore.PollDL usesFamily
-
PhantomCore usesFamily
Sectors (9)
-
Finance targets
-
Government targets
-
Aerospace targets
-
Chemical targets
-
Retail targets
-
Manufacturing targets
-
Energy targets
-
Technology targets
-
Construction targets
Countries (2)
-
Belarus targets
-
Russian Federation targets
Indicators (18)
-
81091ae754af253612f9d90329ec304568b5a1bad4083982449e9dadb2c630c2indicates -
www.act-print.ruindicates -
metelkova.ruindicates -
https://spareline.ru/wp‑includes/widgets/class‑wp‑widget‑index.htmlindicates -
tk-luch.ruindicates -
shibargan.ruindicates