216.73.217.22

GotoHTTP

AlienVault · Published 29/01/2026 17:47 · Modified 29/01/2026 17:47

Essential information

Confidence
100/100
Is family
No
Published
29/01/2026 17:47
Modified
29/01/2026 17:47
Revoked
No
Author / Source
AlienVault
Related entities
31 attack patterns (mitre), 2 intrusion sets (apt), 2 sectors, 5 countries, 98 indicators, 1 vulnerabilities (cve), 2 reports

Description

No description.

Marking (TLP)

TLP:CLEAR

Related entities

Attack patterns, malware, vulnerabilities, indicators, intrusion sets and other entities linked to this malware.

Attack patterns (MITRE) (31)

  • T1036 uses
    Masquerading
  • T1059.007 uses
    JavaScript
  • T1505.003 uses
    Web Shell
  • T1016 uses
    System Network Configuration Discovery
  • T1012 uses
    Query Registry
  • T1056.004 uses
    Credential API Hooking
  • T1055 uses
    Process Injection
  • T1140 uses
    Deobfuscate/Decode Files or Information
  • T1027 uses
    Obfuscated Files or Information
  • T1486 uses
    Data Encrypted for Impact
  • T1190 uses
    Exploit Public-Facing Application
  • T1070 uses
    Indicator Removal
  • T1059 uses
    Command and Scripting Interpreter
  • T1082 uses
    System Information Discovery
  • T1112 uses
    Modify Registry
  • T1078 uses
    Valid Accounts
  • T1136 uses
    Create Account
  • T1068 uses
    Exploitation for Privilege Escalation
  • T1547 uses
    Boot or Logon Autostart Execution
  • T1059.005 uses
    Visual Basic
  • T1083 uses
    File and Directory Discovery
  • T1059.001 uses
    PowerShell
  • T1566 uses
    Phishing
  • T1070.001 uses
    Clear Windows Event Logs
  • T1133 uses
    External Remote Services
  • T1543 uses
    Create or Modify System Process
  • T1057 uses
    Process Discovery
  • T1204 uses
    User Execution
  • T1562 uses
    Impair Defenses
  • T1027.002 uses
    Software Packing
  • T1505 uses
    Server Software Component

Intrusion sets (APT) (2)

  • Cardinal uses
    AlienVault Confidence 100
    First seen 01/01/1970 · Last seen 16/11/5138 Published 05/02/2026 21:39 · Modified 05/02/2026 21:39
  • UAT-8099 uses
    AlienVault Confidence 100
    First seen 01/01/1970 · Last seen 16/11/5138 Published 21/12/2025 18:10 · Modified 21/12/2025 18:10

Sectors (2)

  • Government targets
  • Technology targets

Countries (5)

  • Japan targets
  • British Indian Ocean Territory targets
  • Thailand targets
  • India targets
  • Pakistan targets

Indicators (98)

Vulnerabilities (CVE) (1)

CVE-2025-68947
5.7 Medium

NSecsoft 'NSecKrnl' is a Windows driver that allows a local, authenticated attacker to terminate processes owned by other users, including SYSTEM and …

Attack vector
Local
Published
13/01/2026
Modified
05/02/2026
Awaiting Analysis

Reports (2)