Related Threat Clusters

Airstalk Malware Exploits AirWatch MDM for Covert C2 Communication
Airstalk malware has been identified exploiting the AirWatch Mobile Device Management (MDM) platform to establish covert command and control (C2) communication. This malware leverages vulnerabilities in VMware's…

3 articles · Updated November 6, 2025
Airstalk Malware Exploits MDM Tools in Supply Chain Attacks
Palo Alto Networks’ Unit 42 has identified a new malware campaign named Airstalk, linked to a suspected nation-state actor. This malware targets mobile device management tools, specifically leveraging the AirWatch API…

2 articles · Updated November 3, 2025
Airstalk Malware Exploits AirWatch MDM for Covert C2 Communication
Airstalk malware has been identified exploiting vulnerabilities in VMware's AirWatch Mobile Device Management (MDM) platform to establish covert command and control (C2) communication. Organizations utilizing this MDM…

4 articles · Updated November 6, 2025

Recent Intelligence Reports

Airstalk Malware Leverages AirWatch API MDM Platform to Establish Covert C2 Communication — Cybersecuritynews · November 6, 2025
Airstalk Malware Turns MDM Tools into Covert Spy Channels — Esecurityplanet · November 3, 2025

DDoS Malware Supply Chain Attack Azure Ribbon Communications Business Process Outsourcing Airstalk T1053 - Scheduled Task T1059.001 - PowerShell T1059 - Command and Scripting Interpreter Entra ID Island