Larva-208

Reports per quarter

Techniques seen in the last two years

• T1005 1 report
• T1027 1 report
• T1041 1 report
• T1059.001 1 report
• T1071.001 1 report
• T1082 1 report
• T1210 1 report
• T1213 1 report
• T1219 1 report
• T1555.003 1 report

Counts come from technique IDs in the actor's report text.

CVEs named in reports

• CVE-2009-3960 KEV ransomware
• CVE-2010-2861 KEV ransomware
• CVE-2017-0199 KEV ransomware
• CVE-2018-13379 KEV ransomware
• CVE-2021-31207 KEV ransomware
• CVE-2021-34473 KEV ransomware
• CVE-2023-2868 KEV
• CVE-2024-0012 KEV ransomware
• CVE-2024-24919 KEV ransomware
• CVE-2024-50623 KEV ransomware
• CVE-2025-26633 KEV ransomware
• CVE-2027-11882

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

1. 16 July 2025

   LARVA-208’s New Campaign Targets Web3 Developers

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor LARVA-208’s New Campaign Targets Web3 Developers

2. 28 March 2025

   A Deep Dive into Water Gamayun's Arsenal and Infrastructure

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor A Deep Dive into Water Gamayun's Arsenal and Infrastructure

3. 13 March 2025

   TRACKING RANSOMWARE - FEBRUARY 2025 - CYFIRMA

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor TRACKING RANSOMWARE - FEBRUARY 2025 - CYFIRMA

4. 6 March 2025

   Unveiling EncryptHub: Analysis of a multi-stage malware campaign

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Unveiling EncryptHub: Analysis of a multi-stage malware campaign

5. 12 April 2019

   Blog Archive - SpamTitan Email Security

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Blog Archive - SpamTitan Email Security

Newest first. Details opens the report in Explore.