Skip to main content
Mallory
Back to threat actors
4 malware familiesExploits CVEs in the wild

angelalk21

Also known asangelalk21
Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial
MITRE ATT&CK

Tradecraft

14 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

11 of 15 tactics24 techniques×N= number of intelligence reports citing this technique
MITRE ATT&CK
TA0043
Reconnaissance
1 technique
T1596
Search Open Technical Databases
TA0001
Initial Access
1 technique
T1190
Exploit Public-Facing Application
TA0002
Execution
2 techniques
T1053
Scheduled Task/Job
T1053.003
Cron
T1059
Command and Scripting Interpreter
T1059.004
Unix Shell
TA0003
Persistence
1 technique
T1053
Scheduled Task/Job
T1053.003
Cron
TA0004
Privilege Escalation
1 technique
T1053
Scheduled Task/Job
T1053.003
Cron
TA0005
Stealth
2 techniques
T1027
Obfuscated Files or Information
T1070
Indicator Removal
T1070.004
File Deletion
TA0007
Discovery
1 technique
T1046
Network Service Discovery
TA0008
Lateral Movement
1 technique
T1021
Remote Services
T1021.004
SSH
TA0009
Collection
1 technique
T1005
Data from Local System
TA0011
Command and Control
3 techniques
T1095
Non-Application Layer Protocol
T1568
Dynamic Resolution
T1568.002
Domain Generation Algorithms
T1572
Protocol Tunneling
TA0040
Impact
1 technique
T1498
Network Denial of Service
T1498.001
Direct Network Flood
T1498.002
Reflection Amplification
ARSENAL

Associated malware families

4 malware families attributed to this actor across reporting.

FamilyContextEvidenceLast seen
DLRDLR Dropper The dropper ( /root/dlr/main.c ) is a minimal loader using raw syscalls with no libc dependency1Apr 25, 2026
MiraiThe operator -- a Chinese-speaking actor using the handle angelalk21 (QQ: 597118859, Telegram: @Kuru_x86) -- runs a Mirai-fork botnet with a novel DNS byte-swap anti-analysis technique that causes passive DNS researchers to track decoy IPs in Japan and the US while the real C2 sits in Germany.1Apr 25, 2026
SenNightThe SenNight botnet (森狞僵尸网络 -- "Forest Fierce Zombie Network") ran a Flask-based attack panel on port 5000.1Apr 25, 2026
SuccubusThe CNC runs Succubus , a commercial Mirai management framework with features well beyond a basic Mirai fork1Apr 25, 2026
WEAPONIZED

Associated vulnerabilities

1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.

CVE-2026-24061GNU Inetutils telnetd remote authentication bypass via USER argument injectionIn the wildEvidence1

Exploit Arsenal The C2 server contained a complete offensive toolkit spanning router exploits, DVR compromises, and mass loading infrastructure: CVE-2026-24061 -- GNU InetUtils telnetd Auth Bypass After gaining root, the exploit: Stops kworker_ds systemd service Removes all crontabs Cleans temp directories Blocks competitor IPs 204.10.161.71 and 204.10.161.82 via iptables Reboots the device

IOCS

Observables

40 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.

40 IOCsView more in app

IOC values are gated. View more in Mallory for domains, IPs, hashes, and other artifacts, or pipe them straight into your SIEM.

ACTIVITY FEED

Recent activity

No public activity tracked yet. Mallory keeps watching.

0 SOURCESView more in app

No public activity observed for this threat actor.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Start free trial
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping14

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal4

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs1

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables40

Domains, IPs, and hashes tied to this actor, refreshed continuously.