MALLARD SPIDER

Reports per quarter

Techniques seen in the last two years

• T1053.005 1 report
• T1055.001 1 report
• T1078.002 1 report
• T1566 1 report
• T1567 1 report

Counts come from technique IDs in the actor's report text.

CVEs named in reports

• CVE-2017-0199 KEV ransomware
• CVE-2018-13379 KEV ransomware
• CVE-2019-0604 KEV ransomware
• CVE-2019-11510 KEV ransomware
• CVE-2019-19781 KEV ransomware
• CVE-2020-0688 KEV ransomware
• CVE-2020-10189 KEV
• CVE-2020-1472 KEV ransomware
• CVE-2020-2021 KEV ransomware
• CVE-2021-21974
• CVE-2022-27924 KEV ransomware
• CVE-2022-30190 KEV ransomware

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

1. 6 April 2026

   QakBot (Malware Family)

   date ORKL added it fromORKL

   The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor QakBot (Malware Family)

2. 3 March 2025

   Black Basta and Cactus Ransomware Groups Add BackConnect Malware to Their Arsenal

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Black Basta and Cactus Ransomware Groups Add BackConnect Malware to Their Arsenal

3. 20 February 2025

   48 Minutes: How Fast Phishing Attacks Exploit Weaknesses

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor 48 Minutes: How Fast Phishing Attacks Exploit Weaknesses

4. 30 January 2025

   Ongoing Email Bombing Campaigns leading to Remote Access and Post-Exploitation

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Ongoing Email Bombing Campaigns leading to Remote Access and Post-Exploitation

5. 23 January 2025

   Unit42-timely-threat-intel/2025-01-17-IOCs-for-infrastructure-used-by-affiliate-of-Dark-Scorpius.txt at main · PaloAltoNetworks/Unit42-timely-threat-intel

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Unit42-timely-threat-intel/2025-01-17-IOCs-for-infrastructure-used-by-affiliate-of-Dark-Scorpius.txt at main · PaloAltoNetworks/Unit42-timely-threat-intel

6. 20 January 2025

   Qbot is Back.Connect

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Qbot is Back.Connect

7. 29 September 2023

   2023 State of The Threat – A Year in Review

   Malpedia library date Secureworks fromORKL

   Archived copy on ORKL Detailsfor 2023 State of The Threat – A Year in Review

8. 26 October 2021

   CERTFR-2021-CTI-009

   Malpedia library date fromORKL

   The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor CERTFR-2021-CTI-009

9. 4 August 2021

   Detecting Cobalt Strike- Cybercrime Attacks (GOLD LAGOON)

   date in the title fromORKL

   The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Detecting Cobalt Strike- Cybercrime Attacks (GOLD LAGOON)

10. 23 February 2021

    Report2021GTR.pdf

    Malpedia library date fromORKL

    Archived copy on ORKL Detailsfor Report2021GTR.pdf

Newest first. Details opens the report in Explore.