PAS

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Malware family tracked by Malpedia. ID: php.pas

Threat Analysis

PAS is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

Intelligence Reports Mentioning PAS

New Avalon Malware Framework Packs CrownX Ransomware Capabilities

The Hacker News· Jul 3, 2026

PamStealer Uses Fake Maccy Sites and PAM Checks to Steal Mac Login Passwords

The Hacker News· Jul 3, 2026

ConsentFix and ClickFix: How Microsoft 365 Accounts are Hijacked in 3 Seconds

BleepingComputer· Jul 2, 2026

Opera rolls out Paste Protect feature to fight ClickFix attacks

BleepingComputer· Jul 2, 2026

New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos

The Hacker News· Jul 2, 2026

Hackers target Microsoft 365 accounts with 81 million login attempts

BleepingComputer· Jul 1, 2026

Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic

The Hacker News· Jul 1, 2026

Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique

Check Point Research· Jul 1, 2026

External References

→https://blog.erratasec.com/2016/12/some-notes-on-iocs.html

→https://securelist.com/apt-trends-report-q1-2021/101967/

→https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf

→https://www.domaintools.com/resources/blog/centreon-to-exim-and-back-on-the-trail-of-sandworm

→https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE-Russian-Malicious-Cyber-Activity

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

PASphp.pas

External Intelligence

Malpedia: php.pas

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search PAS