PAS

Internal ID: php.pas

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Malware family identifying php.pas. Origin and technical characteristics tracked via Malpedia.

Threat Analysis

PAS is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.erratasec.com/2016/12/some-notes-on-iocs.html

→https://securelist.com/apt-trends-report-q1-2021/101967/

→https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf

→https://www.domaintools.com/resources/blog/centreon-to-exim-and-back-on-the-trail-of-sandworm

→https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE-Russian-Malicious-Cyber-Activity

Quick Facts

TypeAPT / Threat Group

Aliases1

Also Known As

php.pas

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search PAS