Loading threat actor…
IronWorm is a malware campaign name associated with software supply-chain compromises targeting developer ecosystems, particularly open-source package registries and Linux-focused environments. The activity has been linked to malicious packages that deliver Rust-based credential-stealing malware and, in some cases, an eBPF rootkit used to hide processes and network activity on Linux systems. Reported tradecraft includes abuse of package lifecycle hooks such as preinstall scripts, use of embedded native binaries, stealth through rootkit functionality, persistence mechanisms, and exfiltration of stolen data over anonymized infrastructure including Tor. The malware attributed to IronWorm has targeted developer and CI/CD environments by harvesting credentials, tokens, browser data, collaboration-platform artifacts, cloud secrets, cryptocurrency wallet material, and other sensitive configuration data. Observed capabilities include credential theft, session theft, persistence, privilege-escalation attempts, defense evasion through eBPF-based hiding, and exfiltration. The campaign has been discussed alongside other 2026 software supply-chain incidents affecting npm and Arch Linux package ecosystems, but no confirmed public linkage to other named campaigns is established in the available facts.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A separate npm supply-chain campaign involving a Rust malware payload, eBPF rootkit capability, Tor communications, and self-propagation via stolen npm and GitHub credentials.
Referenced as a prior campaign with a similar npm preinstall-script execution pattern involving an embedded binary.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.