threat actor
Larva-208
LARVA-208 is a financially motivated threat actor employing sophisticated phishing campaigns to harvest credentials and deploy ransomware. The actor uses multiple tactics, including Open URL Redirection, fake login pages, and social engineering, to bypass MFA and gain access to corporate networks. LARVA-208 has compromised over 618 organizations since June 2024, often deploying ransomware payloads. The threat actor is linked to LARVA-148, a threat actor managing domain acquisitions and attacks.
Curated · btcintel
claims we make, each with its source and citation · sources may contradict; we show the set, never a score
Facts
- id
- larva-208
- kind
- threat actor
- status
- unknown
- aliases
- encrypthub · EncryptHub
- jurisdictions
- —
- claims naming it
- 0 · 0 attributions · 0 relations · 0 events
Identifiers
- misp-galaxy 22bdf6e8-49c8-42a9-994e-9b6e90868543via misp-galaxy-threat-actor
- misp-galaxy 5d268413-4eee-5d8c-b8b3-63eee4ce4531via misp-galaxy-ransomware
Relations
computedno relations recorded for this entity
Events
computedno dated events recorded for this entity
Claims naming this entity
computedno current claim names this entity
Subjects0 subjects carry a claim naming this entity · a sample
computedno subject carries a claim naming this entity
Community
notes from Nostr labelers · never merged with the bands above · not endorsed
Community content is indexed from Nostr and not endorsed by btcintel.
not computed yetNot indexed yet: the community index has not looked at this subject.