ITHKRPAW
ITHKRPAW is a malware delivery campaign identified by Acronis TRU in January targeting organizations in Vietnam, particularly the financial sector. The campaign used a malicious LNK file to invoke Cloudflare Workers, which served a PowerShell dropper. That dropper fetched a payload from a Hugging Face dataset repository, saved it as microsoft-update-assist.exe in the victim's temporary directory, and opened a benign cat image as a decoy to mask activity. Supporting reporting states the downloaded payload was omni-agent-v4.exe. Researchers assessed with moderate confidence that the PowerShell script was LLM-generated based on embedded Vietnamese-language comments. The activity was described in the context of broader abuse of trusted AI platforms, specifically Hugging Face, as staging and payload-hosting infrastructure for multi-stage malware infection chains. No additional aliases or sub-groups beyond ITHKRPAW are provided in the source content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Financials
Where they target
Geographies tied to known operations.
- 🇻🇳 Vietnam
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Campaign abusing Hugging Face repositories as staging infrastructure to target Vietnamese financial organizations with a multi-stage infection chain.
Malware delivery campaign abusing Hugging Face repositories and Cloudflare Workers to stage and drop payloads disguised as benign files, including a fake update assistant, with targeting focused on financial-sector organizations and entities in Vietnam.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.