Introduction
ModernStealer is linked to underground posts offering sensitive military, government, nuclear, and aerospace material, with connections to a Session contact identifier and a Telegram account named Sassoon Don. Analysts identified five ModernStealer listings and eight government-related listings, including references to Pakistan’s NUST and SUPARCO, as well as US defense entities. The shared identifier suggests operational overlap with other identities, but does not confirm a direct link between them. The actor exemplifies the importance of tracking durable identifiers over forum names in threat intelligence.
Activities and Tactics
Information pending cataloguing.
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
Information pending cataloguing.
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
- SPACESHIP:
- Nuclear RAT:
Attribution and Evidence
Information pending cataloguing.
References
References pending cataloguing.