Void Banshee
Void Banshee is an advanced persistent threat (APT) actor associated in the provided content with exploitation of multiple Windows MSHTML/MHTML flaws, including CVE-2024-38112 and CVE-2024-43461, and referenced in relation to the similar CVE-2024-43573. The actor is described as targeting victims in North America, Europe, and Southeast Asia for information theft and financial gain. Reported delivery activity used malicious files disguised as PDF books, distributed via cloud-sharing sites, Discord servers, online libraries, and compromised websites. The documented attack chain abused .URL files, the MHTML protocol handler, x-usc directives, and the disabled-but-present Internet Explorer/MSHTML components to access and execute attacker-controlled content, leading to HTA, VBScript, PowerShell, and .NET stages. The final payload described in the content is Atlantida Stealer, which steals credentials, cookies, cryptocurrency wallet data, browser extension data, screenshots, desktop files, Telegram data, Steam data, FileZilla data, and system information before exfiltration. The content directly identifies the actor only as Void Banshee; no additional aliases or sub-groups are provided.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
16 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
4 malware families attributed to this actor across reporting.
Associated vulnerabilities
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
The vulnerability CVE-2024-38112 (ZDI-CAN-24433) was used as a zero-day to access and execute files through the disabled Internet Explorer using MSHTML.
...CVE-2024-43461 (CVSS score: 8.8)... actively exploited in the wild by a threat actor known as Void Banshee... characterized as an MSHTML platform spoofing vulnerability similar to CVE-2024-38112... exploited as a part of an attack chain relating to CVE-2024-38112...
Observables
7 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Void Banshee is known for exploiting MSHTML spoofing vulnerabilities to deliver the Atlantida Stealer malware.
Referenced as having exploited a Windows MSHTML (Internet Explorer engine) zero-day (CVE-2024-38112) in the wild; the article suggests CVE-2024-43573 may be similar and notes prior use of multiple MSHTML flaws in the same attack set.
Financially motivated group conducting information-stealing malware campaigns targeting various sectors, including financial, technology, and government organizations, primarily for data theft and financial gain.
Actively exploited MSHTML platform spoofing vulnerability CVE-2024-43461 as part of an attack chain related to CVE-2024-38112 to deliver Atlantida stealer malware (attack chain broken by July 2024 patch for CVE-2024-38112).
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.