Threats Tagged 'emmenhtal'
View all threats tagged with 'emmenhtal'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'emmenhtal'
Click on any threat for detailed analysis and mitigation recommendations
A Malware-as-a-Service operation utilizing Amadey for payload delivery has been identified, with connections to a SmokeLoader phishing campaign targeting Ukrainian entities. The operation exploits fake GitHub accounts to host payloads and tools, bypassing web filtering. Emmenhtal, a multistage downloader, is used to download Amadey and other malware. The activity involves various malware families and GitHub repositories for staging custom payloads. Similarities in tactics and indicators between the SmokeLoader campaign and Amadey MaaS activity have been observed. The operation demonstrates adaptability in delivering diverse tooling, including legitimate software like PuTTY. The threat actors employ sophisticated obfuscation techniques and leverage public platforms for malware distribution. Join the discussion | AlienVault OTX General | 07/17/2025, 14:59:53 UTC Added: 07/17/2025, 19:46:10 UTC |
Showing 1 to 1 of 1 result