COBALT KATANA
Also reported as Hunter Serpens, Hive0081 (IBM), SectorD01 (NHSC), xHunt campaign (Palo Alto), xHunt and 3 other names. Linked to Iran by one source.
Reports per quarter
CVEs named in reports
- CVE-2024-1708 KEV ransomware
- CVE-2024-1709 KEV ransomware
KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.
Reports
-
Threat Group Cards: A Threat Actor Encyclopedia
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia
-
xHunt Campaign_ New BumbleBee Webshell and SSH Tunnels Used for Lateral Movement
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor xHunt Campaign_ New BumbleBee Webshell and SSH Tunnels Used for Lateral Movement
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor unit42.paloaltonetworks.com-xHunt Campaign New BumbleBee Webshell and SSH Tunnels Used for Lateral Movement
-
xHunt Campaign- New BumbleBee Webshell and SSH Tunnels Used for Lateral Movement
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor xHunt Campaign- New BumbleBee Webshell and SSH Tunnels Used for Lateral Movement
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor xHunt Campaign- Newly Discovered Backdoors Using Deleted Email Drafts and DNS Tunneling for Command and Control
-
xHunt Campaign- New Watering Hole Identified for Credential Harvesting
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor xHunt Campaign- New Watering Hole Identified for Credential Harvesting
-
IBM X-Force IRIS ZeroCleare - Tehcnical Paper
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor IBM X-Force IRIS ZeroCleare - Tehcnical Paper
-
xHunt Campaign- xHunt Actor’s Cheat Sheet
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor xHunt Campaign- xHunt Actor’s Cheat Sheet
Show all 14 reports Show fewer
-
xHunt Campaign- New PowerShell Backdoor Blocked Through DNS Tunnel Detection
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor xHunt Campaign- New PowerShell Backdoor Blocked Through DNS Tunnel Detection
-
xHunt Campaign- Attacks on Kuwait Shipping and Transportation Organizations
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor xHunt Campaign- Attacks on Kuwait Shipping and Transportation Organizations
Newest first. Details opens the report in Explore.