Loading threat actor…
IronHusky is a Chinese-speaking advanced persistent threat group active since at least 2017 and associated with cyberespionage operations focused on geopolitical targets in Central and East Asia. The actor has shown a sustained interest in Mongolia and Russia, particularly government organizations, and has also been linked to broader targeting aligned with regional intelligence collection priorities. IronHusky has been described as related to the TA428 cluster in some reporting, though that relationship is not uniformly resolved and should be treated as an association rather than a definitive synonym. The group is known for using document-based lures and exploitation of public vulnerabilities for initial access, including CVE-2017-11882 and activity connected to MysterySnail investigations that followed exploitation of CVE-2021-40449. IronHusky has used commodity and custom malware families including PlugX, PoisonIvy, and MysterySnail RAT. In 2025, the actor was observed reviving and updating MysterySnail in campaigns against government entities in Mongolia and Russia. Those intrusions used a malicious MMC script disguised as a government-themed document, persistence via autorun mechanisms, and DLL sideloading through a legitimate executable to launch an intermediary backdoor before deploying MysterySnail components. IronHusky’s post-compromise tradecraft includes persistence through services and autorun mechanisms, DLL sideloading, reflective loading via DLL hollowing, and modular backdoor deployment. Recent MysterySnail variants attributed to the group supported command execution, file management, process control, service management, and access to network resources, while a lighter follow-on variant used WebSocket-based communications after some intrusions were disrupted. The actor’s operations are consistent with long-term intelligence collection rather than disruptive or financially motivated activity.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
16 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
6 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
IronHusky is updating the MysterySnail RAT to target entities in Russia and Mongolia.
Mentioned as a suspected related actor in the actor disambiguation section, associated by proximity to the TA428/ThunderCats activity discussed in the article.
Mentioned as a suspected related actor in the disambiguation section, connected to the broader activity cluster around TA428/ThunderCats.
Chinese-speaking threat actor linked to MysterySnail RAT intrusions, targeting government organizations in Mongolia and Russia and continuing to reuse and update the MysterySnail malware family over multiple years.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.