Loading threat actor…
MUT-4831 is a malicious software supply-chain activity cluster associated with the distribution of Vidar Stealer through npm packages masquerading as legitimate developer tooling and SDK components. The cluster has been observed publishing multiple malicious packages to the npm ecosystem and using installation hooks to retrieve and execute additional payloads on victim systems. This activity represents an intrusion set focused on compromising developers and downstream users through trusted open-source package workflows. The cluster’s known tradecraft centers on initial access via poisoned npm packages, particularly through postinstall execution paths that trigger payload download and launch after package installation. The delivered malware is Vidar Stealer, an information-stealing family commonly used to harvest credentials and other sensitive data from infected hosts. Observed variants include JavaScript- and PowerShell-based post-install mechanisms, indicating flexibility in execution methods across package variants. Command-and-control resolution for the Vidar payloads has included dead-drop style mechanisms using third-party online services. MUT-4831’s operations fit the pattern of financially motivated cybercrime rather than espionage. The activity is notable for abuse of the software supply chain and developer ecosystems rather than direct targeting of a single vertical or geography. No high-confidence attribution to a nation-state or a specific country of origin is established from the available facts.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.