3 malware familiesExploits CVEs in the wild

Poseidon Group

Also known asPoseidon Group

Poseidon Group is a threat actor referenced in the provided content as using PowerShell and discovery-focused tradecraft. The content states that after compromising a victim, Poseidon Group lists running processes and discovers running services. It also states that the group searches for administrator accounts on both the local victim machine and the network, aligning with domain account discovery behavior. The group's Information Gathering Tool (IGT) includes PowerShell components. The content further states that Poseidon Group tools attempt to spoof anti-virus processes as a means of self-defense. ATT&CK technique references in the content associated with Poseidon Group include T1059.001 (PowerShell), T1087.002 (Domain Account Discovery), T1552 (Unsecured Credentials), T1003 (OS Credential Dumping), and T1129 (Shared Modules). No additional aliases or sub-groups beyond "poseidon_group" are provided in the content.

Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial

MITRE ATT&CK

Tradecraft

35 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

11 of 15 tactics49 techniques×N= number of intelligence reports citing this technique

MITRE ATT&CK

TA0043

Reconnaissance

1 technique

T1592

Gather Victim Host Information

TA0042

Resource Development

1 technique

T1608

Stage Capabilities

TA0002

Execution

5 techniques

T1053

Scheduled Task/Job

T1053.005

Scheduled Task

T1059

Command and Scripting Interpreter

T1059.001×27

PowerShell

T1129

Shared Modules

T1204

User Execution

T1204.002×2

Malicious File

T1574

Hijack Execution Flow

TA0003

Persistence

3 techniques

T1053

Scheduled Task/Job

T1053.005

Scheduled Task

T1112

Modify Registry

T1546

Event Triggered Execution

T1546.015

Component Object Model Hijacking

TA0004

Privilege Escalation

3 techniques

T1053

Scheduled Task/Job

T1053.005

Scheduled Task

T1055

Process Injection

T1546

Event Triggered Execution

T1546.015

Component Object Model Hijacking

TA0005

Stealth

5 techniques

T1027

Obfuscated Files or Information

T1027.005

Indicator Removal from Tools

T1027.010

Command Obfuscation

T1036×2

Masquerading

T1036.005×2

Match Legitimate Resource Name or Location

T1055

Process Injection

T1218

System Binary Proxy Execution

T1218.011

Rundll32

T1574

Hijack Execution Flow

TA0112

Defense Impairment

1 technique

T1112

Modify Registry

TA0006

Credential Access

3 techniques

T1003×4

OS Credential Dumping

T1552

Unsecured Credentials

T1649

Steal or Forge Authentication Certificates

TA0007

Discovery

8 techniques

T1007

System Service Discovery

T1012

Query Registry

T1049×3

System Network Connections Discovery

T1057×2

Process Discovery

T1069

Permission Groups Discovery

T1069.001×4

Local Groups

T1069.002×4

Domain Groups

T1087×2

Account Discovery

T1087.001×6

Local Account

T1087.002×15

Domain Account

T1482×5

Domain Trust Discovery

T1518

Software Discovery

TA0011

Command and Control

3 techniques

T1105

Ingress Tool Transfer

T1219

Remote Access Tools

T1571

Non-Standard Port

TA0040

Impact

1 technique

T1531

Account Access Removal

ARSENAL

Associated malware families

3 malware families attributed to this actor across reporting.

FamilyContextEvidenceLast seen

Brute Ratel C4This activity is significant as it may indicate the presence of Brute Ratel C4, a sophisticated remote access tool used for credential dumping and other malicious activities.1Mar 17, 2026

Cobalt StrikeDetects the PowerShell pattern used at the end of a Cobalt Strike PowerShell loader to perform the decompression of the executable. This loader is used in attacks such as scripted web delivery. Cobalt Strike is a legitimate, commercial penetration testing tool that has been largely co-opted by ransomware gangs to launch attacks. Cobalt Strike's popularity is mainly due to its beacons or payload being stealthy, and easily customizable. Cobalt Strike Beacon provides encrypted communication with the C&C server to send information and receive commands.1May 6, 2026

NishangThe following analytic detects the use of the Nishang Invoke-PowerShellTCPOneLine utility, which initiates a callback to a remote Command and Control (C2) server.1Mar 17, 2026

WEAPONIZED

Associated vulnerabilities

1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.

CVE-2025-9491Microsoft Windows LNK File UI Misrepresentation Remote Code Execution VulnerabilityIn the wildEvidence2

This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.

ACTIVITY FEED

Recent activity

20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

20 SOURCESView more in app

splunk researchNews

Apr 22, 2026

Detection: PowerShell PInvoke Process Injection API Chain | Splunk Security Content

Listed as a threat actor associated with the PowerShell P/Invoke process injection API chain detection and related ATT&CK techniques.

splunk researchNews

Apr 20, 2026

Detection: PowerShell Environment Variable Execution | Splunk Security Content

Listed as a threat actor associated with PowerShell execution behavior relevant to this detection analytic.

splunk researchNews

Apr 13, 2026

Detection: Windows PowerShell Module File Created | Splunk Security Content

Listed as a threat actor associated with PowerShell module DLL creation / shared modules, PowerShell execution, and hijack execution flow techniques in the detection annotations.

splunk researchNews

Apr 13, 2026

Detection: Windows LAPS Password Gathering Via PowerShell Script | Splunk Security Content

Referenced as a threat actor associated with credential access behavior, specifically techniques involving unsecured credentials and OS credential dumping in the context of LAPS password gathering via PowerShell.

+82 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.

Start free trial

Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping35

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal3

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs1

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables

Domains, IPs, and hashes tied to this actor, refreshed continuously.