216.73.217.22

Unfurling Hemlock

· Published 21/12/2025 05:40 · Modified 21/12/2025 05:40 · Source: AlienVault

Essential information

Confidence
100/100
Published
21/12/2025 05:40
Modified
21/12/2025 05:40
Updated at
21/12/2025 05:40
Revoked
No
Author / Source
AlienVault
Resource level
—
Primary motivation
—
Related entities
1 reports, 12 attack patterns (mitre), 5 malware, 35 indicators

Description

No description.

Marking (TLP)

TLP:CLEAR

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Reports (1)

Attack patterns (MITRE) (12)

  • T1195 uses
    Supply Chain Compromise
  • T1566 uses
    Phishing
  • T1059 uses
    Command and Scripting Interpreter
  • T1543 uses
    Create or Modify System Process
  • T1055 uses
    Process Injection
  • BITS Jobs uses
    T1197
  • T1027.002 uses
    Software Packing
  • T1027 uses
    Obfuscated Files or Information
  • T1071 uses
    Application Layer Protocol
  • T1140 uses
    Deobfuscate/Decode Files or Information
  • T1003 uses
    OS Credential Dumping
  • T1036 uses
    Masquerading

Malware (5)

  • Mystic Stealer uses
    Family
    Published 01/07/2024 10:54 · Modified 01/07/2024 10:54
  • SmokeLoader uses
    Family
    Published 16/09/2025 08:02 · Modified 16/09/2025 08:02
  • RisePro uses
    Family
    Published 16/12/2024 23:06 · Modified 16/12/2024 23:06
  • Amadey - S1025 uses
    Family
    Published 29/09/2025 08:06 · Modified 29/09/2025 08:06
  • Redline uses
    Family
    Published 08/05/2026 11:31 · Modified 08/05/2026 11:31

Indicators (35)