Product
Hatching Triage
- First Reported
- Jul 16, 2024
- Latest Reported
- Sep 3, 2024
Reported Context (3)
- While combing through files on Hatching Triage, one name stood out, prompting us to investigate further and share our findings in this article. ToneShell Malware Targets IISS Defence Summit Attendees in Suspected Espionage Campaign
- During routine research on Hatching Triage, we discovered a submission for the domain tneunarchiver[.]com. This site, designed to mimic the legitimate theunarchiver[.]com, replicated the web page precisely, except for Mac Malware Impersonates The Unarchiver to Steal User Data
- Analyzing the DMG in Hatching Triage, we see a large hex-encoded Apple Script resembling Poseidon/AMOS/Rodrigo stealer. In this case, the IP used for exfil, 79.137.192_4, matched a report by Malwarebytes in a similar SEO-Poisoned Software Sites Spread Poseidon, Gh0stRAT and Other Malware
Malware (8)
People (2)
Threat Actors (6)
MITRE ATT&CK (7)
Vendors (3)
Products (10)
Tools (4)
Industries (2)
Countries (3)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.