Loading threat actor…
Frankenstein is an intrusion activity cluster associated with spearphishing-based initial access using trojanized Microsoft Word documents that prompt victims to enable macros. The activity uses PowerShell extensively for staged execution, including Base64-encoded commands that act as downloaders and host-enumeration stagers. Operators have used the Empire post-exploitation framework to gather local system information such as machine name, username, administrative privileges, running processes, and public IP address, and to return collected data to command-and-control infrastructure. Frankenstein has also transferred files to and from compromised systems to deploy additional plugins or payloads. For persistence, Frankenstein has created a scheduled task masquerading as a Windows update mechanism. Command-and-control communications have used encrypted channels including RC4 byte streams and AES-CBC. Observed tradecraft indicates a workflow centered on phishing-enabled user execution, PowerShell-based staging, host reconnaissance, persistence through scheduled tasks, encrypted command-and-control, and follow-on post-exploitation through modular tooling. Known aliases include Frankenstein, frankenstein_(activity), and frankenstein_(cisco).
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
18 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
22 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Campaign in which operators used Empire to obtain compromised machine names.
Campaign involving Empire for host enumeration and collection of username and privilege information.
Uses Base64-encoded PowerShell commands as a stager and for host enumeration.
Enumerated hosts to identify public IP addresses.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.