ctrlINT What the industry said about every indicator, with the quote

DrokbkMalware

Drokbk stands out for its use of the GitHub platform as part of its C&C infrastructure. This makes it difficult to detect and remove, as GitHub is not traditionally associated with malicious activities. Drokbk attacks have been linked to the Iranian APT group Nemesis Kitten. This group is believed to use Drokbk for cyberespionage and financial information theft activities.From MISP Galaxy

Last reported 18 days ago, by Palo Alto Unit 421 report

ATT&CK techniques

4 techniques · each with the sentence it comes from
  1. T1036Masquerading

    “We discovered that an Iranian state-aligned threat actor has been masquerading as the Dubai Airports IT department to deliver trojanized coding challenges to high-value targets.”

    Palo Alto Unit 42Vendor
  2. T1047Windows Management Instrumentation

    “Windows Management Instrumentation (WMI)”

    Palo Alto Unit 42Vendor
  3. T1127Trusted Developer Utilities Proxy Execution

    “This technique is classified as Trusted Developer Utilities Proxy Execution.”

    Palo Alto Unit 42Vendor
  4. T1684Social Engineering

    “The attackers used tailored social engineering tactics, weaponizing recruitment lures aimed at Iraqi software developers and engineers.”

    Palo Alto Unit 42Vendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

1 report, newest first · the exact sentence from each

  1. “Similarly, Drokbk malware uses the GitHub API to parse a specific repository file to locate and re-establish its C2 connection.”

    Palo Alto Unit 42Vendor
    Blinder Tunnel Campaign Targets Iraqi Infrastructure

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with Drokbk here?
No account needed. We do not store your IP address.