{"id":46139,"date":"2022-04-07T21:41:40","date_gmt":"2022-04-07T21:41:40","guid":{"rendered":"https:\/\/www.darkreading.com\/attacks-breaches\/blackcat-purveyor-shows-ransomware-operators-have-nine-lives"},"modified":"2022-04-07T21:41:40","modified_gmt":"2022-04-07T21:41:40","slug":"blackcat-purveyor-shows-ransomware-operators-have-9-lives","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/blackcat-purveyor-shows-ransomware-operators-have-9-lives\/","title":{"rendered":"BlackCat Purveyor Shows Ransomware Operators Have 9 Lives"},"content":{"rendered":"
<\/div>\n

A ransomware group boasting its members come from now-shuttered groups BlackMatter and REvil has emerged from the shadows to launch a new ransomware-as-a-service, already attacking an enterprise resource planning (ERP) service provider and an industrial firm, new research shows.<\/p>\n

The group, known as ALPHV, and its BlackCat malware have already infected “numerous corporate victims,” endpoint security firm Kaspersky said in an initial analysis posted on April 7. The operators of the new group advertise themselves as the strongest option to replace BlackMatter and REvil following international takedowns of those ransomware groups and their infrastructures. Kaspersky researchers have detected signs that at least some of the members likely had roles in a previous group, BlackMatter.<\/p>\n

The exact division of activities between the new group, its affiliates, and other cybercriminal services is unclear, says Kurt Baumgartner, principal security researcher at Kaspersky.<\/p>\n

“In all likelihood, the overall set of global BlackCat incidents is performed by a mix of both the group maintaining the code and service, and affiliates performing their own work,” he says. “Some of that work can be broken down further, too, into access brokers and penetration efforts performed by the individual groups.”<\/p>\n

The analysis \u2014 and the strong hint that at least some of the operators may have been part of BlackMatter \u2014 shows that taking down ransomware groups’ infrastructure does not stop them from again setting up shop.<\/p>\n

In the case of ALPHV, Kaspersky researchers discovered that the group used a private tool, dubbed Fendr, that has only been used by BlackMatter in the past. ALPHV used the tool to exfiltrate data from corporate victims in December 2021 and January 2022 before deploying ransomware, in a popular tactic known as double extortion.<\/p>\n

“Our telemetry suggests that at least some members of the new BlackCat group have links to the BlackMatter group, because they modified and reused a custom exfiltration tool we call Fendr and which has only been observed in BlackMatter activity,” Kaspersky stated in the threat brief<\/a>. “This use of a modified Fendr, also known as ExMatter, represents a new data point connecting BlackCat with past BlackMatter activity.”<\/p>\n

Malware Coders Take a Shine to Rust<\/strong>
The group is one of the few that has written their tools in the popular, but still uncommon, programming language Rust, which allows them to quickly compile tools for multiple platforms, Kaspersky stated in its blog post. Rust allows the group to release one version for Windows and Linux, because of cross-compilation, and has significant security checks to reduce the incident of vulnerabilities.<\/p>\n

“Rust is a cross-compilation language, so a number of BlackCat Linux samples quickly appeared in the wild shortly after their Windows counterparts,” the researchers stated in the analysis. Other security firms have seen an increase in Linux malware<\/a> in the past year.<\/p>\n

Kaspersky has detected BlackCat activity against a Middle Eastern provider of enterprise resource planning (ERP) services, with the attackers attempting to steal credentials as well as encrypt the drives. A second attack \u2014 against an oil, gas, mining, and construction company in South America \u2014 included the use of the Fendr exfiltration tool.<\/p>\n

REvil and BlackMatter Redux?<\/strong>
Divining the composition of the current group is a complex task, because ALPHAV is a collection of developers, RaaS services, affiliates, negotiators, and cash-out support, says Baumgartner. Could the ALPHAV group just be an affiliate who created their own organization and decide to use the REvil and BlackMatter brands for name recognition?<\/p>\n

“It’s possible, and certainly, ‘they’ \u2014 ALPHAV \u2014 claim to be composed of multiple parts of various past ransomware schemes including REvil and BlackMatter, but at the same time, they are completely unreliable sources with bad agendas of their own,” he says. “I will say that it’s clear for at least a portion of the BlackCat activity, there is a definitive lineage back to BlackMatter activity.”<\/p>\n

While both REvil<\/a> and BlackMatter<\/a> have been linked to the Russian actors, Baumgartner could not say whether ALPHV is itself made up of Russian nationals. Previous research has connected both to other groups<\/a> such as DarkSide and LockBit 2.0.<\/p>\n

Kaspersky has been the focus of a debate over whether the firm’s software could pose a threat to national security. In 2017, Russian cyber-espionage operators stole classified cyberattack and defense tools<\/a> from the home computer of a National Security Agency contractor by exploiting Kaspersky’s security software. The US government has since banned the software, but the issue has resurfaced with Russia’s invasion of Ukraine. According to a report in The Wall Street Journal<\/a>, the Biden administration is debating whether to sanction the firm.<\/p>\n

Read More HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Members of BlackMatter, and possibly REvil, have likely resurfaced in the new ransomware-as-a-service group ALPHV, whose primary tool is the BlackCat malware.Read More HERE<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[151],"tags":[],"class_list":["post-46139","post","type-post","status-publish","format-standard","hentry","category-darkreading-ti"],"yoast_head":"\nBlackCat Purveyor Shows Ransomware Operators Have 9 Lives 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/blackcat-purveyor-shows-ransomware-operators-have-9-lives\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"BlackCat Purveyor Shows Ransomware Operators Have 9 Lives 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/blackcat-purveyor-shows-ransomware-operators-have-9-lives\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2022-04-07T21:41:40+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/bltb5565ff0cc8601e9\/624f596266aa7f1348924533\/blackcat_Lifeonwhite_Alamy_Stock_Photo.jpeg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/blackcat-purveyor-shows-ransomware-operators-have-9-lives\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/blackcat-purveyor-shows-ransomware-operators-have-9-lives\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"BlackCat Purveyor Shows Ransomware Operators Have 9 Lives\",\"datePublished\":\"2022-04-07T21:41:40+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/blackcat-purveyor-shows-ransomware-operators-have-9-lives\\\/\"},\"wordCount\":763,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/blackcat-purveyor-shows-ransomware-operators-have-9-lives\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/bltb5565ff0cc8601e9\\\/624f596266aa7f1348924533\\\/blackcat_Lifeonwhite_Alamy_Stock_Photo.jpeg\",\"articleSection\":[\"DarkReading |TI\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/blackcat-purveyor-shows-ransomware-operators-have-9-lives\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/blackcat-purveyor-shows-ransomware-operators-have-9-lives\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/blackcat-purveyor-shows-ransomware-operators-have-9-lives\\\/\",\"name\":\"BlackCat Purveyor Shows Ransomware Operators Have 9 Lives 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/blackcat-purveyor-shows-ransomware-operators-have-9-lives\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/blackcat-purveyor-shows-ransomware-operators-have-9-lives\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/bltb5565ff0cc8601e9\\\/624f596266aa7f1348924533\\\/blackcat_Lifeonwhite_Alamy_Stock_Photo.jpeg\",\"datePublished\":\"2022-04-07T21:41:40+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/blackcat-purveyor-shows-ransomware-operators-have-9-lives\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/blackcat-purveyor-shows-ransomware-operators-have-9-lives\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/blackcat-purveyor-shows-ransomware-operators-have-9-lives\\\/#primaryimage\",\"url\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/bltb5565ff0cc8601e9\\\/624f596266aa7f1348924533\\\/blackcat_Lifeonwhite_Alamy_Stock_Photo.jpeg\",\"contentUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/bltb5565ff0cc8601e9\\\/624f596266aa7f1348924533\\\/blackcat_Lifeonwhite_Alamy_Stock_Photo.jpeg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/blackcat-purveyor-shows-ransomware-operators-have-9-lives\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"BlackCat Purveyor Shows Ransomware Operators Have 9 Lives\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"BlackCat Purveyor Shows Ransomware Operators Have 9 Lives 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/blackcat-purveyor-shows-ransomware-operators-have-9-lives\/","og_locale":"en_US","og_type":"article","og_title":"BlackCat Purveyor Shows Ransomware Operators Have 9 Lives 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/blackcat-purveyor-shows-ransomware-operators-have-9-lives\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2022-04-07T21:41:40+00:00","og_image":[{"url":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/bltb5565ff0cc8601e9\/624f596266aa7f1348924533\/blackcat_Lifeonwhite_Alamy_Stock_Photo.jpeg","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/blackcat-purveyor-shows-ransomware-operators-have-9-lives\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/blackcat-purveyor-shows-ransomware-operators-have-9-lives\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"BlackCat Purveyor Shows Ransomware Operators Have 9 Lives","datePublished":"2022-04-07T21:41:40+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/blackcat-purveyor-shows-ransomware-operators-have-9-lives\/"},"wordCount":763,"commentCount":0,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/blackcat-purveyor-shows-ransomware-operators-have-9-lives\/#primaryimage"},"thumbnailUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/bltb5565ff0cc8601e9\/624f596266aa7f1348924533\/blackcat_Lifeonwhite_Alamy_Stock_Photo.jpeg","articleSection":["DarkReading |TI"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.threatshub.org\/blog\/blackcat-purveyor-shows-ransomware-operators-have-9-lives\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/blackcat-purveyor-shows-ransomware-operators-have-9-lives\/","url":"https:\/\/www.threatshub.org\/blog\/blackcat-purveyor-shows-ransomware-operators-have-9-lives\/","name":"BlackCat Purveyor Shows Ransomware Operators Have 9 Lives 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/blackcat-purveyor-shows-ransomware-operators-have-9-lives\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/blackcat-purveyor-shows-ransomware-operators-have-9-lives\/#primaryimage"},"thumbnailUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/bltb5565ff0cc8601e9\/624f596266aa7f1348924533\/blackcat_Lifeonwhite_Alamy_Stock_Photo.jpeg","datePublished":"2022-04-07T21:41:40+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/blackcat-purveyor-shows-ransomware-operators-have-9-lives\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/blackcat-purveyor-shows-ransomware-operators-have-9-lives\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/blackcat-purveyor-shows-ransomware-operators-have-9-lives\/#primaryimage","url":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/bltb5565ff0cc8601e9\/624f596266aa7f1348924533\/blackcat_Lifeonwhite_Alamy_Stock_Photo.jpeg","contentUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/bltb5565ff0cc8601e9\/624f596266aa7f1348924533\/blackcat_Lifeonwhite_Alamy_Stock_Photo.jpeg"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/blackcat-purveyor-shows-ransomware-operators-have-9-lives\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"BlackCat Purveyor Shows Ransomware Operators Have 9 Lives"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/46139","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=46139"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/46139\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=46139"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=46139"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=46139"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}