Koofr

Reported Context (1)

sits on the C2 side. Instead of standard HTTP, APT28 built a custom bridge that uses the legitimate Koofr cloud service, with tasks and results travelling as encrypted files inside the operator’s Koofr account. APT28’s Tradecraft Evolves from X-Agent to LLM-Driven Malware

CVE (2)

Malware (16)

People (1)

Threat Actors (35)

Vendors (1)

Products (17)

Tools (4)

Industries (8)

Countries (9)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.