Aggah
Aggah is a threat actor name used by third-party researchers for activity clusters observed using Rhadamanthys and related malware. In the provided reporting, Proofpoint notes that Rhadamanthys has been used in numerous unattributed clusters, including activity tracked by third parties as Aggah, and that a tax-themed malware delivery campaign aligned with activity attributed to Aggah. In that campaign, URLs downloaded a JavaScript file hosted on Microsoft Azure; the JavaScript executed PowerShell, which ran a remote PowerShell script that deployed Rhadamanthys and then downloaded and executed zgRAT. The activity used tax-themed lures impersonating a tax software solutions organization. Based on the provided content, Aggah is associated with malware delivery and likely credential and information theft via Rhadamanthys, as well as follow-on RAT deployment via zgRAT. No nation-state attribution, targeting beyond the observed tax-themed campaign context, or additional confirmed aliases or sub-groups are provided in the content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
2 malware families attributed to this actor across reporting.
Observables
7 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Externally tracked threat actor associated with distributing Rhadamanthys as part of broader crimeware activity.
Associated with a tax-themed malware delivery campaign impersonating a tax software solutions organization. The campaign used a JavaScript downloader hosted on Microsoft Azure, which invoked PowerShell to execute Rhadamanthys, followed by download and execution of zgRAT.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.