Loading threat actor…
NilePhish is an Egypt-focused phishing and surveillance operator known for targeting human rights defenders, journalists, media workers, and civil society organizations. The group has been associated with credential-harvesting and malware-delivery campaigns using spoofed login pages and themed lures, and has also been linked to delivery of FinSpy spyware through fake software-update infrastructure. Reported activity ties the actor to phishing operations active since at least 2018 and to later infrastructure used to distribute a FinSpy Windows dropper masquerading as an Adobe Flash Player update. Attribution links have included recurring infrastructure patterns, shared hosting choices, related phishing domains, and developer artifacts associated with the nickname “shenno.” Operationally, NilePhish has demonstrated initial-access tradecraft centered on phishing, spoofing, and malware staging. Additional linked tooling has included malicious macro-enabled documents, a .NET downloader, and later infrastructure acting as a reverse proxy to Cobalt Strike, indicating post-compromise capability beyond simple credential theft. The group’s victimology is strongly aligned with domestic Egyptian civil society and media targets, suggesting politically motivated surveillance rather than financially motivated cybercrime. NilePhish is best understood as a targeted intrusion actor focused on monitoring and compromising Egyptian dissidents and affiliated organizations.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
15 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.