APT / THREAT GROUP

More eggs

Internal ID: More_eggs

aliases

Last seen:Mar 17, 2026

Intelligence Profile

More_eggs is a JavaScript backdoor used by the Cobalt group. It attempts to connect to its C&C server and retrieve tasks to carry out, some of which are:

- d&exec = download and execute PE file

- gtfo = delete files/startup entries and terminate

- more_eggs = download additional/new scripts

- more_onion = run new script and terminate current script

- more_power = run command shell commands

Threat Analysis

More eggs is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→http://www.secureworks.com/research/threat-profiles/gold-kingswood

→https://arcticwolf.com/resources/blog/venom-spider-uses-server-side-polymorphism-to-weave-a-web-around-victims/

→https://asert.arbornetworks.com/double-the-infection-double-the-fun/

→https://attack.mitre.org/software/S0284/

→https://blog.morphisec.com/cobalt-gang-2.0

Quick Facts

TypeAPT / Threat Group

Aliases4

Also Known As

SpicyOmelettejs.more_eggsSKIDMore_eggs

External Intelligence

Malpedia: js.more_eggs

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search More eggs