PhantomControl

PhantomControl is a sophisticated threat actor that emerged in November 2023. They utilize phishing emails as their initial infection vector and employ a ScreenConnect client to establish a connection for their malicious activities. Their arsenal includes a VBS script that hides its true intentions and reveals a complex mechanism involving PowerShell scripts and image-based data retrieval. PhantomControl has been associated with the Blind Eagle threat actors, showcasing their versatility and reach.

Bu aktor haqqında dərc edilmiş hesabatlar:

• https://www.esentire.com/blog/phantomcontrol-returns-with-ande-loader-and-swaetrat
• https://www.esentire.com/blog/operation-phantomcontrol
• https://securityonline.info/esentire-vs-phantom-unveiling-the-cyber-spooks-dance-of-darkness/

Mənbə: MISP Galaxy, Malpedia.