Loading threat actor…
Operation Spalax is a named intrusion campaign associated with targeted malware deployment in Latin America and assessed as part of the region’s relatively limited but notable cyberespionage activity. The operators have used commodity and open-source remote access tooling, including AsyncRAT, in a more targeted operational context. Observed tradecraft includes the use of Nullsoft Scriptable Install System (NSIS) scripts to install malware, droppers that perform anti-analysis checks before executing payloads, and staging of malware on legitimate hosting services to blend malicious delivery with normal network traffic. The campaign also relied on extensive domain registration through dynamic DNS providers, indicating deliberate infrastructure scaling and flexibility for payload delivery or command-and-control support. Operation Spalax demonstrates a combination of initial payload delivery, defense evasion, and post-compromise remote access capabilities consistent with espionage-oriented operations. Publicly available facts in this record do not support high-confidence attribution to a specific named threat group or country of origin, nor do they establish a definitive victim sector list beyond a general Latin American targeting context.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as a named campaign in which AsyncRAT was weaponized.
Mentioned only as an example of another documented Latin American campaign.
Activity cluster in which operators used droppers that performed anti-analysis checks before executing malware on compromised hosts.
Activity cluster using NSIS scripts to install malware.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.