Tools

Tools observed in various incidents or known to be utilized against cloud environments

Name	Tags	Incidents	Techniques
4l4md4r loader and stager		Mimo Targets Magento, Docker, and Cloud Environments
9hits	CommercialDual-use	9hits Docker campaign	Proxyjacking
AADInternals		Storm-0501 Deploys Cloud-Based Ransomware
ADRecon	EnumerationActive Directory	Scattered Spider SaaS targeting (2024)
AgentTesla	RAT	8820 Gang targeting WebLogic
Akira ransomware	Ransomware	Veeam Vulnerability Exploited by Akira and Fog Ransomware Akira Ransomware Targeting Critical Vulnerability in SonicWall SSLVPN
alamdar.so rootkit		Mimo Targets Magento, Docker, and Cloud Environments
Albabat ransomware		Albabat Ransomware Targets Windows, Linux, and macOS Using GitHub Infrastructure
AlienFox	Attacker-sideToolkit	AlienFox campaign
Amadey loader		Amadey Loader Abuses Compromised Self-Hosted GitLab to Deliver StealC Infostealer
AndroxGh0st	Toolkit	AndroxGh0st usage (2024)Mozi Botnet Using AndroxGh0st Toolkit to Target Cloud Environments
AntSword	Toolkit	RedJuliett Exploiting VPN and Firewall Vulnerabilities
AnvilEcho powershell trojan	TrojanMalware
AnyDesk	CommercialDual-use	Peach Sandstorm targeting Azure Magnet Goblin campaign (2024)TargetCompany Abusing MSSQL Servers for Ransomware Storm-0501 Targeting Hybrid Environments with Ransomware Unauthenticated Remote Access via Triofox Vulnerability Exploited by UNC6485 GeoServer RCE Exploited in CoinMiner Campaigns
AquaPurge		China-nexus Campaign Exploits CVE-2025-20393 in Cisco Email Security Devices
AquaShell		China-nexus Campaign Exploits CVE-2025-20393 in Cisco Email Security Devices
AquaTunnel		China-nexus Campaign Exploits CVE-2025-20393 in Cisco Email Security Devices
ASN	OffSecDual-use	CRYSTALRAY: threat actors exploiting OSS tools
ASPXSpy	Webshell	DragonRank Targeting IIS Web Servers	Webshell deployment
Atomic Red Team	OffSecK8sAttacker-sideDual-use
AUDIODFX		JINX-0164 Targeting Cryptocurrency Development Infrastructure
Auto-Color malware		Auto-Color Malware Exploits SAP Vulnerability for Linux Backdoor
AWS tools for PowerShell		EC2 Grouper campaign
aws-ethereum-miner	CryptominerCloud
AWSealion	OffSecToolkitAttacker-sideDual-use
AzCopy		Storm-0501 Deploys Cloud-Based Ransomware
AzureChecker		Password spray attack leads to containers being used for cryptomining
AzureHound	OffSecToolkitAttacker-sideCloudDual-use	Peach Sandstorm targeting Azure Storm-0501 Deploys Cloud-Based Ransomware
Babuk	Ransomware	ESXiArgs ransomware campaign
BadIIS	MalwareBackdoor	DragonRank Targeting IIS Web Servers
Beavertail		PolinRider Campaign: DPRK-Linked Supply Chain Attack Infects GitHub Repositories
Behinder	Webshell	RevivalStone Campaign by Winnti	Webshell deployment Reverse shell
BlackBasta ransomware	Ransomware	Ransomware operators exploit ESXi vulnerability Black Basta Exploiting Vulnerabilities in Multiple Products
BlackSmith toolkit	Toolkit
BlueShell	OffSecDual-use
Boto3		JavaGhost SES abuse
BPFDoor	Malware	BPFDoor’s Hidden Controller Targets AMEA Sectors
BRICKSTEAL		BRICKSTORM Espionage Backdoor Targeting U.S. Tech and Legal Sectors
BRICKSTORM backdoor		BRICKSTORM Espionage Backdoor Targeting U.S. Tech and Legal Sectors
BRIGHTCREST	Malware
BRUSHFIRE		Critical Ivanti Connect Secure Vulnerability Exploited by China-linked Actor
Brute Ratel		SAP NetWeaver Visual Composer exploitation campaign
Buildkite Agent	Dual-use
BUSHWALK	Malware	Ivanti Connect Secure targeting campaign
BypassBoss		Earth Lamia Custom Toolkit Targets Multiple Sectors via Web Vulnerabilities
C3Bash	Cryptominer	RUBYCARP: Botnet Exploiting Vulnerabilities for Crypto
C3Pool	Cryptominer	C3Pool mining via Confluence vulnerability Exposed Jupyter Notebooks Targeted for Cryptomining
C3RB3R Ransomware	RansomwareMalware	Confluence targeting by C3RB3R	Vulnerability exploitation
CDK	OffSecK8sDual-use		Abusing exposed Docker socket Exploiting host mount to escape to host
Cdorked	BackdoorLinux	Cdorked campaign