LegionRelay

Reported Context (2)

The development comes as Team Cymru said it identified five additional LegionRelay command-and-control (C2) servers used in attacks targeting Ukrainian entities. The IP addresses are listed below - APT28 Targets NATO Entities With New Reflective Loader and Credential-Theft Techniques
GREYVIBE LegionRelay C2 servers Researchers Identify Five Additional LegionRelay C2 Servers Tied to Ukraine Campaign

CVE (2)

Malware (4)

Threat Actors (8)

MITRE ATT&CK (6)

Vendors (2)

Products (7)

Tools (1)

Industries (3)

Countries (5)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.