Malwarebox public intelligence surface

IIM Feeds for adversary infrastructure chains.

Published IIM chains from MANTIS, shaped for humans first: browse actor infrastructure, compare role flows, open evidence, and export the canonical JSON when you need the raw model.

Explore published chains Tracked actors Open feed API

confirmed12

likely5

tentative0

needs review6

IIM Atlas Board

Role matrix of the published feed

10 chains per page, each row opens the full chain view

chain	actor	conf	entry	redirector	staging	payload	c2	edges	published
`uac-0247-ukrvarta-fpv-dopomoga-2026-03` UAC-0247 - UKRVARTA FPV	MB-0006	confirmed	2 UkrVarta humanitarian-aid themed ZI...	1 search-ms:query=lnk&crumb=location:...	4 ukrvarta.online	6 https://ukrvarta.online/dopomoga/up...	1 109.237.97.4	14e / 13r	2026-05-20 17:04:53

Showing 1–1 of 1 matching chains

Page 1 of 1. Showing 1–1 of 1 matching chains, 17 total.

Technique pressure

top observed IIM techniques

IIM-T024

8 IIM-T002

7 IIM-T006

7 IIM-T011

7 IIM-T019

6 IIM-T010

5 IIM-T013

3 IIM-T020

3 IIM-T021

3 IIM-T001

3 IIM-T018

3 IIM-T026

Actor surface

published chain attribution

UAT-83024 UAC-00573 Webworm2 Glassworm1 MB-00011 UAT-100271 UAT-103621 unknown1 Silver Fox1 MB-00061 MB-00051

uac-0247-ukrvarta-fpv-dopomoga-2026-03

UAC-0247 - UKRVARTA FPV

confirmed

Campaign chain for a Ukraine-focused lure targeting FPV/UAV-related audiences. The flow starts with a humanitarian-aid themed archive/LNK and HTA delivery layer on ukrvarta.online, moves through external JavaScript and updater.txt payload staging, persists as OneDriveUpdater, injects a decoded shellcode stage into RuntimeBroker.exe, unpacks EncryptedReverseShell.exe, and communicates with 109.237.97.4:8443.

entry → entry → staging → staging → staging → payload → payload

MB-0006 14 entities 13 relations 2026-05-20 17:04:53

IIM-T002 IIM-T015 IIM-T019 IIM-T024 IIM-T026

Open chain analysis↗