s2
--:--:--UTC

Searching APEX

Starting…

  1. Searching Threats, IOCs & Threat Intelligence locally
  2. Querying external providers
  3. Asking AI Forensic Validator
  4. Creating new entry from validated hit

0s elapsed

TF-MAL-elf.chisel

📛 Threat Title

Malware family: Chisel

Category: Chisel First seen: Last updated: Source: ThreatFox Malwares

Description

ThreatFox malware family `elf.chisel`. Printable name: Chisel.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

domain elf.chisel VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.chisel

IOC database

Type
domain
Value
elf.chisel
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Extracted from Threat TF-MAL-elf.chisel

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.chisel

References (1)

Remediations (10)

  • web:blog.netmanageit.com

    The Infamous Chisel malware is being investigated by the United States National Security Agency (CISA), which is working with the Australian National Cyber Security Centre (NCSC), New Zealand and Australia.

  • web:cybernews.com

    The FBI warns of a surge in ATM jackpotting attacks, with more than 700 incidents in 2025 alone. Hackers use Ploutus malware to force machines to dispense cash.

  • web:cybersecuritynews.com

    Cybercriminals use tools like PoshC2 & Chisel to target African banks, blending attacks with admin tasks to evade detection.

  • web:github.com

    The Chisel library is required for us to establish a reverse tunnel to Edge Agent environments, and is being falsely identified as malicious by Defender. You can find in-depth discussion of this kind of flagging happening before to Chisel in their GitHub repo.

  • web:malpedia.caad.fkie.fraunhofer.de

    Chisel is an open-source project by Jaime Pillora (jpillora) that allows tunneling TCP and UDP connections via HTTP. It is available across platforms and written in Go.

  • web:nsarchive.gwu.edu

    CISA: Infamous Chisel Malware Analysis Report Open PDF in new window View OCR of the document of 0

  • web:www.cisa.gov

    Infamous Chisel-A collection of components associated with Sandworm designed to enable remote access and exfiltrate information from Android phones. Executive Summary Infamous Chisel is a collection of components targeting Android devices. This malware is associated with Sandworm activity.

  • web:www.ncsc.govt.nz

    Malware summary Infamous Chisel is a collection of components which enable persistent access to an infected Android device over the Tor network, and which periodically collates and exfiltrates victim information from compromised devices. The information exfiltrated is a combination of system device information, commercial application information and applications specific to the Ukrainian military.

  • web:www.nsa.gov

    U.S. federal agencies and international partners published a report warning of a new malware campaign from Russian military cyber actors known publicly as Sandworm.

  • web:www.securitymagazine.com

    The malware analysis report provides technical details of a new kind of malware used to target Android devices in use by Ukrainian military personnel. The malware , called Infamous Chisel , enables unauthorized access to compromised devices and is designed to scan files, monitor traffic and periodically steal sensitive information.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.