Malware
M-RED-TEAM v6.4
- First Reported
- Jul 14, 2026
- Latest Reported
- Jul 14, 2026
Reported Context (2)
- The Stage 3 runtime explicitly self-identifies as "M-RED-TEAM v6.4" in code comments describing beacon encryption and C2 communication protocols. The extracted configuration file sets giteaPackagesOrg to AsyncAPI Supply-Chain Attack Uses GitHub Actions Misconfiguration to Steal Credentials and Publish Malicious npm Packages
- ends in a persistent implant with a real remote shell. The payload framework self-identifies as M-RED-TEAM v6.4 in its own code comments. Credential harvesting and self-propagation are present in the code but Backdoored AsyncAPI npm Packages Used GitHub Actions Workflow to Steal Publish Token
MITRE ATT&CK (15)
Products (7)
Tools (1)
Industries (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.