SiestaGraph

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Malware family tracked by Malpedia. ID: win.siesta_graph

Threat Analysis

SiestaGraph is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://www.elastic.co/de/security-labs/naplistener-more-bad-dreams-from-the-developers-of-siestagraph

→https://www.elastic.co/security-labs/ref2924-howto-maintain-persistence-as-an-advanced-threat

→https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry

→https://www.elastic.co/security-labs/update-to-the-REF2924-intrusion-set-and-related-campaigns

→https://www.virusbulletin.com/uploads/pdf/conference/vb2024/papers/Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdf

Quick Facts

TypeAPT / Threat Group

Aliases3

Also Known As

win.siesta_graphDRAFTGRAPHSiestaGraph

External Intelligence

Malpedia: win.siesta_graph

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search SiestaGraph