Loading threat actor…
CodeFork is a cybercriminal group observed using the Andromeda (Gamarue) downloader to distribute cryptocurrency-mining modules across existing botnet infections. Public reporting places the group in the late-2017 cryptojacking ecosystem, where operators monetized compromised hosts by adding Monero mining capability to already established malware footholds. The group’s activity indicates operational use of modular botnet infrastructure for payload delivery and post-compromise monetization rather than purely standalone mining malware distribution. CodeFork has been associated with leveraging preexisting botnet access to deploy miner components at scale. This reflects capabilities in post-exploitation, persistence through botnet residency, and malware-based payload staging via downloader infrastructure. The observed use of Andromeda/Gamarue also implies reliance on established criminal malware ecosystems for distribution and victim reach. No high-confidence evidence in the supplied facts supports ransomware activity, destructive operations, or state sponsorship. Known alias usage in the supplied facts is limited to CodeFork.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 malware family attributed to this actor across reporting.
1 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.