Threat Actor
CL-CRI-1089
- First Reported
- May 20, 2026
- Latest Reported
- Jun 2, 2026
Reported Context (3)
- Unit 42 tracks this cybercrime activity cluster as responsible for malvertising campaigns distributing malicious payloads to Windows and macOS users; Operation FlutterBridge and JSCoreRunner are attributed to the cluster. Operation FlutterBridge Delivers macOS FlutterShell Backdoor Through Malvertising
- Unit 42 attributed distribution of trojanized applications to this cluster; it appears to target credentials and deploy adware and proxy-style payloads. Cybersecurity Roundup: 47 Zero-Days, Cloud Intrusions and AI-Driven Attacks
- Tracked cluster associated with trojanized productivity-app campaigns, malvertising, credential-focused activity, adware and occasional proxy-style payloads; the researchers describe it as a distinct cluster. Researchers Map Three TamperedChef-Style Malware Clusters Through Code and Certificate Reuse
CVE (2)
Malware (14)
People (6)
Threat Actors (7)
MITRE ATT&CK (27)
Vendors (12)
Products (33)
Tools (3)
Industries (4)
Countries (17)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.