Loading threat actor…
The Quarry is a modular phishing-as-a-service and malware-as-a-service cybercrime ecosystem active since at least April 2025. It is associated with a developer using the aliases RockyBelling, Rock, Rockky, and Mike, and appears to have been sold to nearly 200 operators or affiliates. The operation is heavily oriented toward phishing-led initial compromise, especially tax- and document-themed campaigns impersonating the Internal Revenue Service, the Social Security Administration, DocuSign, Adobe, Microsoft, Dropbox, and similar trusted brands. Observed victimology indicates a strong concentration on the United States, particularly American taxpayers and corporate users. The Quarry provides a turnkey toolkit that includes phishing pages, cloaking infrastructure, bulk email tooling, self-hosted remote access panels, and post-exploitation scripts. Its infrastructure uses filtering and traffic cloaking to block researchers, scanners, and non-target visitors, and it delivers real-time notifications and exfiltration through Telegram. The ecosystem has also been linked to a modified credential-harvesting panel possibly derived from Evilginx, indicating support for credential and session theft in addition to malware delivery. A defining feature of The Quarry is its routine delivery of legitimate remote monitoring and management software, especially ConnectWise ScreenConnect, as a trusted remote-access payload. In 2026 the operator added a VBS-based dropper that silently installed ScreenConnect while displaying a decoy document, further streamlining compromise. After access is established, affiliates deploy scripts for browser-history collection, W-2 and tax-document harvesting, and broader theft of sensitive financial and corporate data. The ecosystem has also promoted VioletRAT for credential dumping and cookie theft. The Quarry demonstrates capabilities spanning phishing-based initial access, credential theft, session theft, persistence through remote management tooling, defense evasion via cloaking and filtering, and post-exploitation data collection and exfiltration. Reporting has also linked the bulk-mailer MaDoO Blaster and the actor codemado to The Quarry as a supplier or customer relationship rather than as part of a formal command structure. Available reporting further assesses that stolen access may be monetized through financial fraud, tax-related identity theft, and possible initial access brokerage, including potential resale to ransomware operators.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
15 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
19 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Modular phishing and malware-as-a-service ecosystem selling phishing kits, cloaking infrastructure, bulk email tools, remote-access panels, and post-exploitation scripts; assessed as technically and commercially connected to Evilginx-derived tooling.
Phishing-as-a-service network materially connected to codemado as a supplier/client relationship rather than a command structure.
A phishing-as-a-service ecosystem mentioned as broader context and possibly a supplier relationship through promotion of MaDoO Blaster, but not directly tied to the three operators beyond that.
Phishing-as-a-Service operation selling a toolkit to nearly 200 operators for tax-themed and government-impersonation phishing campaigns, delivering remote access via ScreenConnect and supporting post-exploitation data theft.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.