Loading threat actor…
Tangelo is a sparsely documented threat actor designation that appears in malware-reference and actor-alias indexing contexts, including associations with multiple Windows malware families such as Metamorfo, DarkVNC, Raccoon, Kpot Stealer, DanaBot, Zloader, and Kapeka. Available information does not provide a corroborated narrative of Tangelo’s operations, victimology, geographic origin, or organizational structure. The name also appears alongside Stealth Mango in actor-association references, but the relationship between the two designations is not sufficiently established from the available facts. No high-confidence attribution to a nation state, criminal ecosystem, or specific campaign cluster is currently available. Because the available evidence is limited to naming and malware-association references without supporting operational detail, Tangelo should be treated as an underdocumented actor label rather than a well-characterized intrusion set.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as a comparison to similar mobile surveillance behavior.
Listed as a named threat actor in association with the win.danabot entry.
Listed as a named threat actor in source data associated with the win.raccoon entry.
Listed as a named actor in association with win.zloader.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.