Skip to content
Product
Threat intelligence API
Free key, 70+ endpoints, OpenAPI. The product.
Get started
Pick your stack, make your first call.
Live feed
The console: incidents, filters, entities, search.
Public IOC feed
Free blocklists: domains, IPs, hashes, wallets. No key.
Dark web
First-party leak-site collection: victims and groups.
CLI & agents
tc from a terminal; agent keys with scoped budgets.
Docs
Pricing
No results found
Sign in
Get a free key
No results found
Product
Threat intelligence API
Get started
Live feed
Public IOC feed
Dark web
CLI & agents
Docs
Pricing
Contact
Get a free key
Sign in
Back
BlueKeep
Vulnerability
Threat entity extracted from intelligence sources
Entities
›
vulnerability
›
BlueKeep
Frequency
4
occurrences
First Seen
September 16, 2026
Last Seen
September 17, 2026
API
Overview
Recent Events
Profile
Profile
MITRE ATT&CK
1 / 2
Exploited By
NightEagle
Apt-q-95
Hacking Cat
Toy Ghouls
ClearWater
Monkey
Babuk
Lockbit
Associated Malware
GhostContainer
Neo-reGeorg
Bird Agent
GenieLocker
Gorilla RAT
Nemo Wiper
Tools Used
Rdp2tcp
Ysoserial
HiveMQ
Evil-WinRM
GhostWebShell
Impacket
PowerCloud
PowerShell
Related CVEs
CVE-2026-42897
MITRE Techniques
T1003 - OS Credential Dumping
T1071 - Application Layer Protocol
T1053 - Scheduled Task/Job
T1021.001 - Remote Desktop Protocol
T1021 - Remote Services
T1059.001 - PowerShell
T1078 - Valid Accounts
T1505.003 - Web Shell
Campaigns
Cloud Atlas APT
Affected Platforms
Windows
VMware ESXi
Active Directory
Asp.net
Element
Linux
Regions
Russia
Belarus
Sectors Affected
Government
-
REC
Recon
No techniques detected
-
RD
Resource Dev
No techniques detected
2
IA
Initial Access
T1078 - Valid Accounts
T1190 - Exploit Public-Facing Application
2
EX
Execution
T1053 - Scheduled Task/Job
T1059.001 - PowerShell
3
PE
Persistence
T1505.003 - Web Shell
T1543.003 - Windows Service
T1547 - Boot Or Logon Autostart Execution
2
PE
Priv Esc
T1055 - Process Injection
T1068 - Exploitation for Privilege Escalation
1
DE
Defense Evasion
T1562.001 - Disable Or Modify Tools
1
CA
Cred Access
T1003 - OS Credential Dumping
-
DI
Discovery
No techniques detected
1
LM
Lateral Mov
T1021.001 - Remote Desktop Protocol
-
CO
Collection
No techniques detected
2
C2
C2
T1071 - Application Layer Protocol
T1572 - Protocol Tunneling
-
EX
Exfil
No techniques detected
-
IM
Impact
No techniques detected
16
techniques detected across
8
tactics
Related Clusters (1)
NightEagle APT Targets Russian Enterprises with Advanced Malware
Sep 16
·
5 sources
78
Related Articles (4)
Three Threat Groups Target Russian Enterprises With Backdoors Ransomware And Wipers
cybernoz.com
·
Sep 17
NightEagle APT Targets Russia With GhostContainer Backdoor
Technadu
·
Sep 17
Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers
Thehackernews
·
Sep 16
NightEagle APT targets Russian organizations
Securelist
·
Sep 16
Related Entities
NightEagle
Apt-q-95
Hacking Cat
Toy Ghouls
Malware
Ransomware
Trojan
Windows Remote Management
Cloud Atlas APT
Russia
Belarus
CVE-2026-42897
