BreakthroughMalware
There is no reference available for this family and all known samples have version 1.0.0. Pdb-strings in the samples suggest that this is an "exclusive" loader, known as "breakthrough" (maybe), e.g. C:\Users\Exclusiv\Desktop\хп-пробив\Release\build.pdb The communication url parameters are pretty unique in this combination: gate.php?hwid=&os=&build=1.0.0&cpu=8 is one of: Windows95 Windows98…From MISP Galaxy
Last reported 2 months ago, by Recorded Future2 reports
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1684Social Engineering
“High-risk individuals: list persons involved in the payment chain and assess their social engineering susceptibility.”
- T1213.003Code Repositories
“…though most attempts failed, the agent still gained administrative access to internal and production systems, accessed some source-code repositories, and used a stolen credential to connect external systems to the company network.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
The Hugging Face Incident Was a Governance Failure“A Capability Breakthrough and a Control Failure”
-
EvilTokens: AI PhaaS for automating BEC fraud - Part 2“Breakthrough AI-augmented post-compromise kit”
Indicators in its reports
named in the reports above- machinemind-market[.]comin 1 report
- tokenobj[.]emailin 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.