Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · EvilPost · Unknown · misp-galaxy · refreshed 2026-10-06

EvilPost

sigil · no ATT&CK coverage stated

What changed

ledger · newest first
  1. —todaynew CVE1 new CVE: CVE-2015-2545

CVEs EvilPost is cited as exploiting

none on KEV
  1. CVE-2015-25452026-10-17
    1. “We are currently aware of at least four different APT actors actively using exploits of the CVE-2015-2545 vulnerability: TwoForOne (also known as Platinum), EvilPost, APT16 and Danti.”

      cited as exploiting · source: securelist.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

1 source
  1. 1.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.…

Track EvilPost on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.