Loading threat actor…
Larva-26009 is an intrusion cluster associated with attacks on exposed MS-SQL servers that combine unauthorized remote access, persistence, post-compromise tooling, and cryptocurrency mining. Observed operations culminated in deployment of XMRig CoinMiner, but the actor also established multiple mechanisms for sustained control of compromised systems, indicating activity beyond simple opportunistic mining. Documented tradecraft includes abuse of MS-SQL server command execution to download additional payloads, installation of web shells on IIS servers, and use of remote administration and tunneling tools such as VShell, GotoHTTP, Chrome Remote Desktop, Cloudflared, and SoftEther VPN. SoftEther was configured in cascade mode, consistent with use of compromised hosts as relay or layered command-and-control infrastructure. The actor also created hidden backdoor user accounts to preserve access and support remote administration. Post-compromise behavior attributed to Larva-26009 includes attempted credential access through registry hive dumping and use of browser data theft tooling, privilege-escalation activity using multiple Potato-family tools, internal network scanning with Fscan, and in-memory execution of payloads through encrypted loaders and patched legitimate binaries. VShell usage provided remote command execution and file-management capability, while web shells and tunneling components supported persistence and covert control. Overall, Larva-26009 demonstrates a blend of initial access against internet-facing database infrastructure, defense evasion, persistence, credential theft, privilege escalation, reconnaissance, and cryptomining-oriented monetization.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
20 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
14 malware families attributed to this actor across reporting.
9 additional families tracked in Mallory.
17 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Targeted attacks against MS-SQL servers involving installation of XMRig CoinMiner and remote-control tools including VShell and GotoHTTP; the linked article title also indicates SoftEther VPN use.
Targets MS-SQL servers, likely via command execution after initial compromise, then installs remote access tooling, web shells, credential theft utilities, privilege escalation tools, scanners, proxy/tunneling components, XMRig coin mining payloads, and SoftEther VPN infrastructure to maintain control and obscure C2.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.