APT / THREAT GROUP

Formbook

aliases

Last seen:Mar 17, 2026

Intelligence Profile

FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.

Threat Analysis

Formbook is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

Intelligence Reports Mentioning Formbook

Formbook Malware Campaign Uses Multiple Obfuscation Techniques to Avoid Detection

Infosecurity Magazine· Apr 20, 2026

External References

→http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/

→http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html

→http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html

→https://0xmrmagnezi.github.io/malware%20analysis/FormBook/

→https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/

Quick Facts

TypeAPT / Threat Group

Aliases3

Also Known As

Formbookwin.formbookwin.xloader

External Intelligence

Malpedia: win.formbook

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Formbook