BABYSHARK

Overview 10 indicators

No published description. This group is tracked by Maltrail from vendor reporting but is not named in MITRE ATT&CK, so there is no curated profile to show.

Principal sources 3 reports

Ranked by how many of this actor's indicators each report brought in.

• 9huntress.com/blog/targeted-apt-activity-babyshark-is…
• 1github.com/Neo23x0/signature-base/blob/master/yara…
• 1otx.alienvault.com/pulse/5d932d449de02b0e8c0b8cba

Related groups 1

What the sources have in common — not a claim that these are the same actor. See the whole graph.

• Kimsuky G0094
  1 shared indicator

Timeline 10 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.

1. 2022-03-02 4 domain, 2 url_path4 yrs ago

   huntress.com/blog/targeted-apt-activity-babyshark-is…

   domain	beastmodser.club
   domain	frebough.com
   domain	hodbeast.com
   domain	retmodul.com
   url_path	/onedrive/winmm.php
   url_path	/sil/0304/d.php

   copy batch

2. 2021-07-27 1 domain5 yrs ago

   huntress.com/blog/targeted-apt-activity-babyshark-is…

   worldinfocontact.club

   copy batch

3. 2019-10-01 2 url_path7 yrs ago

   huntress.com/blog/targeted-apt-activity-babyshark-is…

   /gate/connect

   /gate/test

   copy batch

4. 2019-10-01 1 url7 yrs ago

   github.com/Neo23x0/signature-base/blob/master/yara… · otx.alienvault.com/pulse/5d932d449de02b0e8c0b8cba

   http://212.73.150.246

   copy batch

Further reading 3

• huntress.com/blog/targeted-apt-activity-babyshark-is…
• github.com/Neo23x0/signature-base/blob/master/yara…
• otx.alienvault.com/pulse/5d932d449de02b0e8c0b8cba