Twitter

Reported Context (2)

a distributed ecosystem of spoofed media websites, Telegram amplification networks, and coordinated X/Twitter bot account clusters to disseminate political narratives targeting Western audiences. Report Details Doppelgänger’s Resilient Influence Operations and Multi-Platform Reach
command and control (C2) servers but also use legitimate, third-party cloud services such as Dropbox, Twitter, and the Zimbra open-source webmail as C2 tunnels. Lotus Blossom Uses Sagerunex Backdoor Variants and Cloud Services in Espionage Campaigns

Malware (2)

People (2)

Threat Actors (7)

MITRE ATT&CK (17)

Vendors (1)

Products (17)

Tools (5)

Industries (4)

Countries (6)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.