HOMETHREATSRandomQuery
MALWARE FAMILY

RandomQuery

Internal ID: ps1.randomquery
1
aliases
Last seen:Mar 17, 2026

Intelligence Profile

A set of powershell scripts, using services like Google Docs and Dropbox as C2.

Threat Analysis

RandomQuery is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://s2w.inc/en/resource/detail/920
→https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/
→https://www.securonix.com/blog/securonix-threat-research-security-advisory-new-deepgosu-attack-campaign/

Quick Facts

TypeMalware Family
Aliases1

Also Known As

ps1.randomquery

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search RandomQuery
RandomQuery — Malware Family | Threat Intelligence | CTIWATCH.COM