MMON

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Malware family tracked by Malpedia. ID: win.mmon

Threat Analysis

MMON is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

Intelligence Reports Mentioning MMON

Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials

The Hacker News· Jul 2, 2026

Catan and Mouse

Cisco Talos Blog· Jul 2, 2026

How to Conduct a Successful Audit of AI-Driven Software Development

SecurityWeek· Jul 2, 2026

CISA Adds One Known Exploited Vulnerability to Catalog

CISA Alerts· Jul 1, 2026

CISA Adds One Known Exploited Vulnerability to Catalog

CISA Alerts· Jun 29, 2026

Hijacked npm and Go Packages Use VS Code Tasks to Deploy Python Infostealer

The Hacker News· Jun 29, 2026

Surviving the Mythos Era: Richard Bejtlich on the Case for NDR

The Hacker News· Jun 25, 2026

The 36 Most Common Cyberattacks (2026) | Huntress

Huntress Blog· Jun 25, 2026

External References

→http://reversing.fun/posts/2022/01/02/mmon.html

Quick Facts

TypeAPT / Threat Group

Aliases3

Also Known As

win.mmonMMONKaptoxa

External Intelligence

Malpedia: win.mmon

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search MMON