Motnug
Motnug is a loader malware family associated with SparklingGoblin and also reported in activity involving Red Kelpie (APT41). In the provided reporting, ESET observed attackers deploy a variant of Motnug during an intrusion linked to FamousSparrow activity, noting it as a loader used by SparklingGoblin. Separately, PwC reported Red Kelpie (aka APT41) using its Motnug loader malware against a Pakistan-based provider. Based on the available content, Motnug’s confirmed role is as a loader used in espionage-oriented intrusions by China-linked threat activity clusters. No additional high-confidence technical details, infection vector specifics, persistence mechanisms, or indicators of compromise for Motnug itself are provided in the source content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"...attackers deployed a variant of Motnug that is a loader used by SparklingGoblin."
"...attackers deployed a variant of Motnug that is a loader used by SparklingGoblin."
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Loader malware; a variant was observed deployed in an incident connected to FamousSparrow, and it is noted as a loader used by the SparklingGoblin group.
Motnug is a loader malware used by Red Kelpie (APT41) to deploy additional payloads in targeted environments.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.