MontysThree

  • First known sample

    2018
  • Discovery

    2020
  • Number of targets

    1-100
  • Current status

    Active
  • Type

    Malware toolset
  • Targeted platforms

    Windows
MONTYSTHREE

More about the MontysThree toolset, its targets and capabilities

Learn more
  • The way of propagation

    File infection
  • Purpose/Functions

    Cyberespionage
  • Targets

    Industrial holdings
  • Artefacts/Attribution

    Russian-speaking

  • Description

    This previously unknown toolset was uncovered in summer 2020, but its activity dates back to at least 2018. It’s being deployed by what appears to be a new threat actor in highly targeted espionage campaigns against industrial holdings in Russia. The four-module malware is spread inside self-extracting archives with titles meant to spearphish the targets. The main malicious payload is disguised using custom-made steganography and targets victims’ corporate documents, namely Adobe Acrobat and Word files.

    Additional information