RijndaelMalware
ransomwareFrom MISP Galaxy
Last reported 3 months ago, by Huntress1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1036Masquerading
“…elf-evident reasons: the use of Claude to host the malicious loader as a Claude Artifact, and the use of Claude Desktop itself as the masquerading application.”
- T1053.005Scheduled Task
“…s to download and stage the initial payload (ClaudeDesktop.exe) and the other (DockerDesktop.exe) is written to disk as a persistent scheduled task to repeatedly reinfect the computer.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT“Peeling it back a bit, we recovered the Rijndael S-box stored within the shader, as well as the key materials.”
Indicators in its reports
named in the reports above- claude.ai.download-app[.]usin 1 report
- 2.24.131[.]246in 1 report
- download-app[.]usin 1 report
- polse[.]usin 1 report
- 5ca8758c-02d0-4a72-89c8-d468b66dda41[.]comin 1 report
- 1cd58cfba596da29…c53563f4e3bbin 1 report
- 26bae4d7012bf598…2c6d0d21394ain 1 report
- 1fe3646d27d286db…c28869a91664in 1 report
- f8acb8f5cf88b77a…47d818da3ed0in 1 report
- fd826215add30c13…fe8a88de7939in 1 report
- 107.189.24[.]67in 1 report
- 104.194.133[.]210in 1 report
- 107.189.26[.]86in 1 report
- 107.189.21[.]86in 1 report
- 45.59.124[.]17in 1 report
- 45.59.125[.]228in 1 report
- 45.59.122[.]82in 1 report
- 107.189.17[.]143in 1 report
- 45.59.122[.]134in 1 report
- 45.59.122[.]235in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.