Snifula

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Malware family tracked by Malpedia. ID: win.snifula

Threat Analysis

Snifula is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://kostas-ts.medium.com/ursnif-vs-italy-il-pdf-del-destino-5c83d6281072

→https://mal-eats.net/en/2021/05/11/campo_new_attack_campaign_targeting_japan/

→https://malware.love/malware_analysis/reverse_engineering/2020/11/27/analyzing-a-vbs-dropper.html

→https://medium.com/csis-techblog/chapter-1-from-gozi-to-isfb-the-history-of-a-mythical-malware-family-82e592577fef

→https://www.circl.lu/assets/files/tr-13/tr-13-snifula-analysis-report-v1.3.pdf

Quick Facts

TypeAPT / Threat Group

Aliases3

Also Known As

win.snifulaUrsnifSnifula

External Intelligence

Malpedia: win.snifula

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Snifula