Threat Actor

Suckfly

Also known as: Suckfly

Suckfly is a China-based threat group that has been active since at least 2014.

5
Techniques
1
Software
0
indicators on this record

Properties

Last source
MITRE ATT&CK
STIX ID
intrusion-set--5cbe0d3b-6fb1-471f-b591-4b192915116d
In Signal since
initial import (Sep 2026)
Retrieved at
2026-11-02T16:56:29+00:00
Origin source
attack_description
Type
intrusion-set
Origin country
CN

MITRE ATT&CK Techniques (5)

▸
Code Signing (T1553.002)

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a bi

▸
Network Service Discovery (T1046)

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vul

▸
OS Credential Dumping (T1003)

Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password.

▸
Valid Accounts (T1078)

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense

▸
Windows Command Shell (T1059.003)

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the prima

Software & Tools (1)

▸
Nidiran [malware]

Nidiran is a custom backdoor developed and used by Suckfly. It has

Explore this actor's full graph with Ninja Signal

Suckfly — Threat Actor Profile — Ninja Signal | Ninja Signal