PhantomControl
No sourced public emblem in this profile.
reference profile · reported nexus: Unknown (not nationality)
PhantomControl is a sophisticated threat actor that emerged in November 2023. They utilize phishing emails as their initial infection vector and employ a ScreenConnect client to establish a connection for their malicious activities. Their arsenal includes a VBS script that hides its true intentions and reveals a complex mechanism involving PowerShell scripts and image-based data retrieval. PhantomControl has been associated with the Blind Eagle threat actors, showcasing their versatility and reach.
Source-reported aliases: . Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): No country-level metadata
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://www.esentire.com/blog/phantomcontrol-returns-with-ande-loader-and-swaetrat
https://www.esentire.com/blog/operation-phantomcontrol
https://securityonline.info/esentire-vs-phantom-unveiling-the-cyber-spooks-dance-of-darkness/