TF-MAL-js.griffon
📛 Threat Title
Malware family: Griffon
Description
ThreatFox malware family `js.griffon`. Printable name: Griffon. Aliases: Harpy.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
js.griffon
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/js.griffon
IOC database
- Type
- domain
- Value
js.griffon- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-js.griffon
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/js.griffon
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:apt.etda.or.th
Tool: Griffon ... Last change to this tool card: 29 December 2022 Download this tool card in JSON format
-
web:attack.mitre.org
The Record. (2022, January 7). FBI: FIN7 hackers target US companies with BadUSB devices to install ransomware. Retrieved January 14, 2022. Microsoft. (2022, May 9). Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself. Retrieved March 10, 2023.
-
web:consumer.ftc.gov
Malware is one of the biggest threats to the security of your computer, tablet, phone, and other devices. Learn how to protect yourself, how to tell if your device has malware , and how to remove it.
-
web:detection.fyi
Griffon Malware Attack Pattern Aug 12, 2024 · attack.execution detection.emerging-threats · Share on: Detects process execution patterns related to Griffon malware as reported by Kaspersky Sigma rule (View on GitHub)
-
web:malpedia.caad.fkie.fraunhofer.de
The malware is designed for receiving modules to be executed in-memory and sending the results to C2s. The first module downloaded by the GRIFFON malware to the victim's computer is an information-gathering JavaScript, which allows the cybercriminals to understand the context of the infected workstation.
-
web:ociso.ucla.edu
To do this, FIN7 uses a variety of tools including Metasploit, Cobalt Strike, PowerShell scripts, and the Carbanak, GRIFFON , BOOSTWRITE, and RDFSNIFFER malware . There have been reports of several packages containing items including a USB device sent to US businesses in the retail, restaurant, and hotel industry.
-
web:www.anavem.com
KB890830 delivers the March 2026 update for Windows Malicious Software Removal Tool (MSRT), adding detection and removal capabilities for 47 new malware families including advanced ransomware variants and AI-powered threats targeting Windows 10, Windows 11, and Windows Server systems.
-
web:www.breachsense.com
Complete malware remediation now requires addressing both the infected endpoint and the stolen authentication data. Your malware incident response playbook must account for both.
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.microsoft.com
Sangria Tempest (ELBRUS), a financially motivated threat actor group tracked by Microsoft, is the developer and deployer of the Griffon backdoor. It is a custom malware family used for persistence. Sangria Tempest was also very active in compromising organizations using phishing campaigns leading to Griffon malware .
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.