MassgraveThreat actor
Massgrave is a hacking group that has developed a method to bypass Microsoft's software licensing for Windows and Office, enabling permanent activation of versions from Windows Vista to Windows 11. They are known for creating effective scripts for software activation, which are distributed through an unofficial repository at massgrave[.]dev.From MISP Galaxy
Last reported 2 days ago, by Zscaler ThreatLabz1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1053.005Scheduled Task
“…hive contains a Python 3.11 runtime, Pyarmor runtime files, and Armorsteal Python-based scripts.The installer creates the following scheduled tasks for persistence:Scheduled taskTriggerDescriptionSysCheck2User logonLaunches the remote access module with the highest privileges ava…”
- T1555.005Password Managers
“This module collects data from web browsers, password managers, cryptocurrency wallets, Discord clients, and Steam installations.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
SEO Poisoning Campaign Delivers New Armorsteal Malware“Fake Massgrave websiteThe second lure targeted users searching for terms such as “Microsoft Activation Scripts,” “MAS activation script,” or “Massgrave activation”.”
Indicators in its reports
named in the reports above- data[.]inin 1 report
- choclatey[.]orgin 1 report
- massgravel[.]netin 1 report
- workerstats[.]netin 1 report
- c1146fbcaa433385…a68db2cf31b4in 1 report
- 209.99.186[.]187in 1 report
- 104.21.87[.]146in 1 report
- 104.21.87.146[.]inin 1 report
- 82.153.135[.]80in 1 report
- 186.2.175[.]183in 1 report
- pymons[.]isin 1 report
- datamons[.]orgin 1 report
- community.choclatey[.]orgin 1 report
- domains[.]reviewin 1 report
- telemetry[.]reviewin 1 report
Copy these 15 indicators · defanged
Thanks — we review every report.