Loading malware…
Veil, also known as the Veil Evasion Framework, is an openly available offensive-security framework for generating executables designed to evade antivirus detection. It can package Cobalt Strike payloads into evasive executables and is used in both authorized penetration testing and malicious operations. Its primary function is payload generation and detection evasion; the capabilities of the resulting executable depend on the embedded payload.
Cybercrime actors have used Veil-generated payloads as first-stage components of infection chains. Go-compiled Veil samples have also appeared prominently in malware collections, reflecting its use of Go for generated payloads. Windows payloads are documented. Veil's antivirus-evasion functionality does not guarantee that generated executables will bypass security products.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Publicly accessible antivirus-evasion framework referenced as part of the ecosystem of tools that lower the barrier to creating evasive malware.
Offensive framework mentioned as being used by cybercrime actors as a first-stage payload (no further detail provided).
Offensive framework mentioned as being used as a first-stage payload by cybercrime actors.
A prominent Go-based malware/tool family in the dataset, categorized primarily with penetration-testing activity.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.