Loading threat actor…
Void Banshee is an advanced persistent threat actor associated with information-stealing campaigns for financial gain. The group is known for exploiting Windows MSHTML-related vulnerabilities, including CVE-2024-38112 and CVE-2024-43461, to deliver Atlantida Stealer. Reported activity in 2024 showed the actor abusing crafted internet shortcut and web content chains that relied on user interaction and social engineering, including lure documents disguised as PDF books, to trigger code execution through legacy Internet Explorer/MSHTML components. Void Banshee’s operations have targeted victims in North America, Europe, and Southeast Asia. Its intrusion chains have used malicious archives and staged payload delivery involving script-based downloaders, PowerShell execution, .NET loaders, and process injection before deploying the final stealer. Atlantida Stealer has been used to collect credentials, browser cookies, cryptocurrency wallet data, screenshots, desktop files, and other host information for exfiltration. The actor has also been linked to exploitation of additional similar MSHTML spoofing flaws in 2024, indicating repeated focus on this attack surface. The group’s observed tradecraft supports capabilities in initial access through social engineering and exploit delivery, credential theft, session hijacking via cookie theft, defense evasion, post-exploitation, process injection, and data exfiltration. No high-confidence attribution to a nation-state or specific country of origin is established from the available information. No additional aliases or confirmed sub-groups are established beyond Void Banshee.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
16 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 malware families attributed to this actor across reporting.
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
The vulnerability CVE-2024-38112 (ZDI-CAN-24433) was used as a zero-day to access and execute files through the disabled Internet Explorer using MSHTML.
...CVE-2024-43461 (CVSS score: 8.8)... actively exploited in the wild by a threat actor known as Void Banshee... characterized as an MSHTML platform spoofing vulnerability similar to CVE-2024-38112... exploited as a part of an attack chain relating to CVE-2024-38112...
7 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Void Banshee is known for exploiting MSHTML spoofing vulnerabilities to deliver the Atlantida Stealer malware.
Referenced as having exploited a Windows MSHTML (Internet Explorer engine) zero-day (CVE-2024-38112) in the wild; the article suggests CVE-2024-43573 may be similar and notes prior use of multiple MSHTML flaws in the same attack set.
Financially motivated group conducting information-stealing malware campaigns targeting various sectors, including financial, technology, and government organizations, primarily for data theft and financial gain.
Actively exploited MSHTML platform spoofing vulnerability CVE-2024-43461 as part of an attack chain related to CVE-2024-38112 to deliver Atlantida stealer malware (attack chain broken by July 2024 patch for CVE-2024-38112).
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.