Loading threat actor…
Marko Polo is a Russian-speaking cybercrime group associated with cryptocurrency scam operations and malware delivery activity. It has been linked to traffer-style sub-teams, including Slavic Nation Empire, that use social engineering and shared distribution infrastructure to direct victims to spoofed web pages and malicious content. Marko Polo has been associated with ClickFix campaigns impersonating services such as Google Meet and other popular applications, using fake alerts, verification prompts, and technical error messages to trick users into manually executing malicious commands or downloading payloads. Activity tied to Marko Polo has targeted both Windows and macOS users and has delivered information-stealing malware including StealC, Rhadamanthys, and Atomic macOS Stealer. The group’s ecosystem has been described as part of a broader Russian-speaking cybercrime environment that overlaps with other scam teams such as CryptoLove and has shown infrastructure sharing or coordination through third-party services. Marko Polo-linked operations have also been discussed alongside other traffer groups such as CrazyEvil and Wagmi, indicating participation in a wider criminal distribution and scam ecosystem. Observed tradecraft includes impersonation of trusted brands and collaboration platforms, use of compromised websites and social media pages as lures, malware staging through PowerShell-based execution chains, and delivery methods designed to bypass browser-based protections by inducing user-assisted execution. The group’s operations are consistent with financially motivated cybercrime focused on credential and wallet theft, malware-enabled compromise, and follow-on exploitation of infected systems.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a trafficker team using more traditional malware-based approaches (contrast point to Rublevka Team’s JavaScript-based draining).
Named as a traffer group potentially linked via shared infrastructure to a broader crypto-theft/social-engineering ecosystem.
markopolo is a cybercrime group whose sub-team Slavic Nation Empire is involved in the ClickFix campaign, leveraging fake Google Meet and other service pages to deliver infostealers to Windows and macOS users.
Marko Polo is a Russian-speaking cybercrime group involved in cryptocurrency scams and information-stealing malware campaigns. They use the ClickFix social engineering tactic to deliver infostealers to users by impersonating services like Google Meet.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.