Skip to main content
Mallory
Back to threat actors
3 malware families

Temp Zagros

Also known astemp_zagros
Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial
MITRE ATT&CK

Tradecraft

32 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

13 of 15 tactics46 techniques×N= number of intelligence reports citing this technique
MITRE ATT&CK
TA0043
Reconnaissance
1 technique
T1598
Phishing for Information
T1598.003
Spearphishing Link
TA0042
Resource Development
1 technique
T1584
Compromise Infrastructure
TA0001
Initial Access
2 techniques
T1078
Valid Accounts
T1566
Phishing
T1566.001
Spearphishing Attachment
T1566.002
Spearphishing Link
TA0002
Execution
2 techniques
T1059×2
Command and Scripting Interpreter
T1059.001×2
PowerShell
T1059.006
Python
T1059.007×3
JavaScript
T1574
Hijack Execution Flow
T1574.001×2
DLL
TA0003
Persistence
2 techniques
T1078
Valid Accounts
T1547
Boot or Logon Autostart Execution
T1547.001×2
Registry Run Keys / Startup Folder
TA0004
Privilege Escalation
2 techniques
T1078
Valid Accounts
T1547
Boot or Logon Autostart Execution
T1547.001×2
Registry Run Keys / Startup Folder
TA0005
Stealth
2 techniques
T1078
Valid Accounts
T1574
Hijack Execution Flow
T1574.001×2
DLL
TA0112
Defense Impairment
1 technique
T1553
Subvert Trust Controls
T1553.002
Code Signing
TA0006
Credential Access
4 techniques
T1003×2
OS Credential Dumping
T1003.002
Security Account Manager
T1110
Brute Force
T1110.003
Password Spraying
T1555
Credentials from Password Stores
T1558×2
Steal or Forge Kerberos Tickets
TA0007
Discovery
5 techniques
T1069
Permission Groups Discovery
T1082×2
System Information Discovery
T1087
Account Discovery
T1482
Domain Trust Discovery
T1518
Software Discovery
T1518.001
Security Software Discovery
TA0009
Collection
1 technique
T1113×2
Screen Capture
TA0011
Command and Control
4 techniques
T1071
Application Layer Protocol
T1090
Proxy
T1090.003
Multi-hop Proxy
T1105×4
Ingress Tool Transfer
T1219
Remote Access Tools
TA0010
Exfiltration
3 techniques
T1041
Exfiltration Over C2 Channel
T1048
Exfiltration Over Alternative Protocol
T1567×2
Exfiltration Over Web Service
T1567.002
Exfiltration to Cloud Storage
ARSENAL

Associated malware families

3 malware families attributed to this actor across reporting.

FamilyContextEvidenceLast seen
ChromElevatorBoth malicious files carried ChromElevator, a tool capable of stealing passwords, cookies, and payment data from web browsers.1May 27, 2026
DindoorThe group deployed two malware, a newly discovered backdoor called Dindoor and a Python-based tool called Fakeset, across multiple victim environments.1Mar 17, 2026
FakesetThe group deployed two malware, a newly discovered backdoor called Dindoor and a Python-based tool called Fakeset, across multiple victim environments.1Mar 17, 2026
IOCS

Observables

53 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.

53 IOCsView more in app

IOC values are gated. View more in Mallory for domains, IPs, hashes, and other artifacts, or pipe them straight into your SIEM.

ACTIVITY FEED

Recent activity

No public activity tracked yet. Mallory keeps watching.

0 SOURCESView more in app

No public activity observed for this threat actor.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Start free trial
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping32

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal3

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables53

Domains, IPs, and hashes tied to this actor, refreshed continuously.