216.73.217.22

WaterPlum

· Published 21/12/2025 14:11 · Modified 21/12/2025 14:11 · Source: AlienVault

Essential information

Confidence
100/100
Published
21/12/2025 14:11
Modified
21/12/2025 14:11
Updated at
21/12/2025 14:11
Revoked
No
Author / Source
AlienVault
Resource level
—
Primary motivation
—
Related entities
1 reports, 9 attack patterns (mitre), 8 malware, 2 sectors, 1 countries, 4 indicators

Description

No description.

Marking (TLP)

TLP:CLEAR

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Reports (1)

Attack patterns (MITRE) (9)

  • T1056.001 uses
    Keylogging
  • T1005 uses
    Data from Local System
  • T1082 uses
    System Information Discovery
  • T1552.001 uses
    Credentials In Files
  • T1555 uses
    Credentials from Password Stores
  • T1041 uses
    Exfiltration Over C2 Channel
  • T1059 uses
    Command and Scripting Interpreter
  • T1497 uses
    Virtualization/Sandbox Evasion
  • T1083 uses
    File and Directory Discovery

Malware (8)

  • OtterCookie uses
    Family
    Published 08/06/2026 10:05 · Modified 08/06/2026 10:05
  • RATatouille
  • BeaverTail uses
    Family
    Published 21/04/2026 12:09 · Modified 21/04/2026 12:09
  • FrostyFerret uses
    Family
    Published 01/04/2025 14:59 · Modified 01/04/2025 14:59
  • InvisibleFerret uses
    Family
    Published 21/04/2026 12:09 · Modified 21/04/2026 12:09
  • OtterCandy
  • GolangGhost uses
    Family
    Published 18/03/2026 10:49 · Modified 18/03/2026 10:49
  • DiggingBeaver

Sectors (2)

  • Technology targets
  • Finance targets

Countries (1)

  • Japan targets

Indicators (4)

  • modilus.io indicates
  • moralis-api-v3.cloud indicates
  • alchemy-api-v3.cloud indicates
  • chainlink-api-v3.cloud indicates