Loading threat actor…
BlackToad is a financially motivated cybercrime cluster associated with phishing-led malware delivery and remote access trojan operations. The group has been linked behaviorally to the broader SilverTerrier ecosystem, a collection of West African financially motivated threat activity, and has also been connected to the BoredFluff campaign. Available evidence places observed operational infrastructure in Nigeria. BlackToad has targeted corporate networks using localized financial lures, including Thai-language messages themed as business payment slips. Its intrusion chain relies on social engineering and user execution of disguised payloads delivered through self-extracting archives and deceptive double-extension files. After execution, the malware chain launches script-based stages that temporarily disrupt host network connectivity to reduce the chance of network-based detection during subsequent payload deployment. The operation then uses a renamed AutoIt interpreter and encrypted configuration data to initialize Remcos RAT, providing the operators with remote access to compromised systems. Observed tradecraft includes initial access via phishing, defense evasion through file masquerading, obfuscation and staged execution, use of redundant command-and-control infrastructure, and post-compromise remote administration through Remcos RAT. The cluster’s tooling has included specialized crypters distinct from previously documented sub-clusters within the wider ecosystem. BlackToad is best understood as a Nigeria-linked financially motivated intrusion set operating within or alongside the SilverTerrier cybercrime landscape.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
Attributed origin per open-source reporting.
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
2 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.