MALWAREBOX::IIM FEEDS published infrastructure chains

Malwarebox public intelligence surface

IIM Feeds for adversary infrastructure chains.

Published IIM chains from MANTIS, shaped for humans first: browse actor infrastructure, compare role flows, open evidence, and export the canonical JSON when you need the raw model.

Explore published chains Submit chain Tracked actors Open feed API

community intake

Submit sourced IIM chains for review

local storage, validator, anti-spam cap and contribution board

Analysts can paste a chain directly into the public surface, pass validation and store it as a dated local JSON file for manual Malwarebox review.

Submit chain Contribution board
source link required 1000/day global cap duplicate filter captcha local
confirmed32
likely7
tentative0
needs review12

IIM Atlas Board

Role matrix of the published feed

10 chains per page, each row opens the full chain view
chain actor conf entryredirectorstagingpayloadc2 edges published
webworm-graphworm-wormfrp-cloud-service-c2-and-exfiltration-lane Webworm GraphWorm / WormFrp cloud-service C2 and exfiltration lane Webworm confirmed — — 1 wamanharipethe.s3.ap-south-1.amazon... 2 GraphWorm payload 2 graph.microsoft.com / Microsoft Graph API 5e / 4r 2026-05-26 14:05:46
iim.chain.apt.2026.05.009 Webworm GitHub staging to EchoCreep Discord C2 Webworm confirmed — 1 64[.]176[.]85[.]158 1 github[.]com/anjsdgasdf/WordPress 1 EchoCreep DLL 1 discord[.]com / Discord API 4e / 3r 2026-05-26 14:05:20
uat-8302-snowlight-vshell-via-update-kaspersky.workers.dev UAT-8302 SNOWLIGHT / VSHELL via update-kaspersky.workers.dev UAT-8302 confirmed 1 benign executable loading wininet.dll — 1 SNOWLIGHT / SNOWRUST stager 1 VSHELL payload 2 image.update-kaspersky.workers[.]dev 5e / 4r 2026-05-26 14:00:43
iim.chain.apt.2026.05.006 UAT-8302 CloudSorcerer v3 dead-drop resolver to drivelivelime / msiidentity C2 UAT-8302 confirmed — 2 github[.]com / public dead-drop resolver — 1 CloudSorcerer v3 side-loaded DLL triad 3 www.drivelivelime[.]com 6e / 7r 2026-05-26 13:35:13
iim.chain.apt.2026.05.005 UAT-8302 NetDraft / FringePorch side-load to Microsoft Graph C2 UAT-8302 confirmed 1 benign executable used for DLL side-loading — — 1 NetDraft / FringePorch backdoor 2 graph.microsoft.com / Microsoft Graph API 4e / 3r 2026-05-26 13:33:29
Showing 11–15 of 15 matching chains
Reset
Page 2 of 2. Showing 11–15 of 15 matching chains, 39 total.

webworm-graphworm-wormfrp-cloud-service-c2-and-exfiltration-lane

Webworm GraphWorm / WormFrp cloud-service C2 and exfiltration lane

confirmed

ESET-documented Webworm infrastructure lane using Microsoft Graph / OneDrive for GraphWorm command traffic and Amazon S3 infrastructure for WormFrp-related reconnaissance/exfiltration.

payload → c2 → c2 → payload → staging
Webworm 5 entities 4 relations 2026-05-26 14:05:46
IIM-T002 IIM-T006 IIM-T018
Open chain analysis↗

iim.chain.apt.2026.05.009

Webworm GitHub staging to EchoCreep Discord C2

confirmed

ESET-documented Webworm lane targeting European government entities: malware stages from GitHub repository content and EchoCreep uses Discord API traffic as its C2 channel.

staging → payload → c2 → redirector
Webworm 4 entities 3 relations 2026-05-26 14:05:20
IIM-T002 IIM-T006 IIM-T018 IIM-T026
Open chain analysis↗

uat-8302-snowlight-vshell-via-update-kaspersky.workers.dev

UAT-8302 SNOWLIGHT / VSHELL via update-kaspersky.workers.dev

confirmed

UAT-8302 side-load chain in which a SNOWLIGHT/SNOWRUST stager downloads or launches a VSHELL payload and communicates with Cloudflare Workers infrastructure.

entry → staging → payload → c2 → c2
UAT-8302 5 entities 4 relations 2026-05-26 14:00:43
IIM-T005 IIM-T006
Open chain analysis↗

iim.chain.apt.2026.05.006

UAT-8302 CloudSorcerer v3 dead-drop resolver to drivelivelime / msiidentity C2

confirmed

CloudSorcerer v3 lane where malware retrieves C2 information from public web services and then connects to decoded UAT-8302 C2 domains published by Talos.

payload → redirector → redirector → c2 → c2 → c2
UAT-8302 6 entities 7 relations 2026-05-26 13:35:13
IIM-T006 IIM-T010 IIM-T011 IIM-T013
Open chain analysis↗

iim.chain.apt.2026.05.005

UAT-8302 NetDraft / FringePorch side-load to Microsoft Graph C2

confirmed

Cisco Talos-documented UAT-8302 chain in which side-loaded NetDraft/FringePorch uses Microsoft Graph / OneDrive as a C2 channel.

entry → payload → c2 → c2
UAT-8302 4 entities 3 relations 2026-05-26 13:33:29
IIM-T006 IIM-T018
Open chain analysis↗