FishMaster

aliases

Last seen:Mar 17, 2026

Intelligence Profile

A custom loader for CobaltStrike.

Threat Analysis

FishMaster is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://decoded.avast.io/luigicamastra/backdoored-client-from-mongolian-ca-monpass/

→https://media-exp1.licdn.com/dms/document/C561FAQHhWFRcWmdCPw/feedshare-document-pdf-analyzed/0/1639591145314?e=1658966400&v=beta&t=_uCcyEVg6b_VDiBTvWQIXtBOdQ1GQAAydqGyq62KA3E

→https://speakerdeck.com/aragorntseng/winnti-is-coming-evolution-after-prosecution-at-hitcon2021

Quick Facts

TypeAPT / Threat Group

Aliases3

Also Known As

FishMasterwin.fishmasterJollyJellyfish

External Intelligence

Malpedia: win.fishmaster

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search FishMaster