RedRumMalware
- grinch
- thanos
- Tycoon
Ransomware.From MISP Galaxy
Last reported 11 days ago, by ANY.RUN12 reports
ATT&CK techniques
6 of 19 · each with the sentence it comes from- T1684Social Engineering
“AI makes convincing social engineering easier to scale, while techniques such as AiTM phishing and session theft make identity compromise increasingly difficult to prevent.”
- T1021.001Remote Desktop Protocol
“…unauthorised access into networks and systems, often through phishing attacks, exploitation of vulnerabilities, or compromising Remote Desktop Protocols (RDP).”
- T1059.009Cloud API
“Wire the rule to a workflow that calls the relevant cloud API and the SOC gets seconds-level containment.”
- T1069.003Cloud Groups
“| Permission Groups Discovery: Cloud | T1069.003 | Enumerating directory roles and transitive role assignments |”
- T1078.004Cloud Accounts
“| Valid Accounts: Cloud Accounts | T1078.004 | Stolen tokens used for Graph API access and M365 web app browsing |”
- T1087.004Cloud Account
“| Account Discovery: Cloud Account | T1087.004 | Graph enumeration of user profile, role memberships, contacts |”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
12 reports, newest first · the exact sentence from each-
What’s Really Attacking Your Industry? Insights From 74K Sandbox Analyses“For example, Sneaky2FA and Tycoon were observed in roughly 7 out of 10 organizations.”
-
Phishing Risk Across 5 Key US Industries: ANY.RUN Data & Mitigation Strategies“Tycoon and EvilProxy use AiTM phishing techniques to capture credentials and authentication data, while EvilTokens targets access tokens and authenticated sessions.”
-
Global analysis of Adversary-in-the-Middle phishing threats“According to this methodology, the most widespread phishing kits are Tycoon 2FA, Storm-1167, NakedPages, Sneaky 2FA, EvilProxy, and Evilginx.”
-
Cyber Threat Actors Impacting the Financial Sector in 2024“Phishing-as-a-Service kits like Tycoon 2FA and Sneaky 2FA democratise Adversary-in-the-Middle attacks that bypass MFA.”
-
Sneaky 2FA: exposing a new AiTM Phishing-as-a-Service“This detection approach is relevant for multiple AiTM PhaaS, such as Dadsec (missing User-Agent), Tycoon 2FA (very rare User-Agent values), W3LL OV6 (inconsistent browser versions among User-Agent values), and others.”
-
Mamba 2FA: A new contender in the AiTM phishing ecosystem“At first, these characteristics look like the Tycoon 2FA phishing-as-a-service platform, but further inspection found that the campaign leveraged a previously unknown adversary-in-the-middle (AiTM) phishing kit, that Sekoia track as Mamba 2FA.”
-
Detecting Tycoon 2FA AiTM attacks across Entra ID and Google Workspace“Detecting Tycoon 2FA AiTM attacks across Entra ID and Google Workspace”
-
This month in security with Tony Anscombe – March 2026 edition“A Europol-led operation has taken down the Tycoon 2FA phishing platform that up to the middle of 2025 accounted for 62% of all phishing attempts blocked by Microsoft,”
-
Europol, Microsoft, TrendAI™ and Collaborators Halt Tycoon 2FA Operations“Europol, Microsoft, TrendAI™ and Collaborators Halt Tycoon 2FA Operations”
-
The (!FALSE) Pattern“MARVEL\thanos”
-
SDFlags“Members: captain, thor, thanos”
-
PerfMon! What Is It Good For?“This also provides significant insight into the attack: the attacker touched our accounts, Thanos and Warmachine, which are configured not to require pre-authentication.”
Indicators in its reports
named in the reports above- sites.google[.]comin 1 report
- office365.context.correlation[.]idin 1 report
- okta-revolut[.]comin 1 report
- revolut-okta[.]comin 1 report
- hxxps://mysilverfox.com[.]my/00/#[email redacted]in 1 report
- mysilverfox.com[.]myin 1 report
- hxxps://highnationservices[.]com/n/#[email redacted]in 1 report
- highnationservices[.]comin 1 report
- hxxps://kagumigroup[.]id/wp-content/plugins/well/auth/j9P8KGpfDZyoHplo5XdnHOw79OCkDYo2l7TQcrrnclSz2XGLzmtCghFJwIWR1AaW33Rk36Z0ymZc6DIgMy4EFqTsiiqAKEBIN5jiTbYAUk1BfG4uoVhetLa2XWebUSShQOFq7L8Mpx1vf4Pum0xBVx/verifyin 1 report
- kagumigroup[.]idin 1 report
- hxxps://mysilverfox.com[.]my/00/7N0tV3XAh1yp4NFo9X6YsH3cOam6DYJhmMEXRky24mzGUuTE2RpwIIlI4olBypVCEYqiKFPDTAsRvKrS8bgiKBOZiPOUnxoCSHveA0zk5hcdjQ1UltSxdw7rdgZoo7HDWorfj9CzN8gc0q5PQ19nZe/indexin 1 report
- hxxps://highnationservices[.]com/n/uswDOVS70y9sjyPwtLieCJdZiEUGhokxRUvY7JApYlFo35Sb9o66AvhK8oNrHPTgj9aaJDHItTWDnPOo3t4mz8Tfhf7GBem0YE1cqx8O13VoKuWIbN4knGg6fRrvMIZXRQ2xgdEFzj2mVBzwSbpe5c/validatein 1 report
- 5d91563b6acd5446…c2195b9f6cbfin 1 report
- 8c4e78b1bc0a0923…5d2fddc5488din 1 report
- hxxps://href[.]li/?https://en.wikipedia.org/wiki/Category:Office_365in 1 report
- href[.]liin 1 report
- hxxps://href[.]li/?https://en.wikipedia.org/wiki/Client_access_licensein 1 report
- hxxps://href[.]li/?https://en.wikipedia.org/wiki/Emailin 1 report
- hxxps://href[.]li/?https://en.wikipedia.org/wiki/Email_clientin 1 report
- hxxps://href[.]li/?https://en.wikipedia.org/wiki/Internet_Explorer_11in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.