Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · ModifiedElephant · Unknown · misp-galaxy · refreshed 2026-10-06

ModifiedElephant

sigil · no ATT&CK coverage stated

What changed

ledger · newest first
  1. —todaynew CVE4 new CVEs: CVE-2012-0158, CVE-2013-3906, CVE-2014-1761, CVE-2015-1641

Analyst brief

misp-galaxy

Our research into these intrusions revealed a decade of persistent malicious activity targeting specific groups and individuals that we now attribute to a previously unknown threat actor named ModifiedElephant. This actor has operated for years, evading research attention and detection due to their limited scope of operations, the mundane nature of their tools, and their regionally-specific targeting. ModifiedElephant is still active at the time of writing.

Observed targets (as stated by the sources)

0 countries · 1 sectors

assessed originnot stated by sourcesobserved targets · 0

sectors · 1

  • Civil Society

as stated by MISP galaxy / ransomware.live — not inferred

CVEs ModifiedElephant is cited as exploiting

none on KEV
  1. CVE-2013-39062026-10-17
    1. “Observed lure documents repeatedly made use of CVE-2012-0158 , CVE-2014-1761 , CVE-2013-3906 , CVE-2015-1641 exploits to drop and execute their malware of choice.”

      cited as exploiting · named nearby · source: sentinelone.com ↗ · 2026-10-17

  2. CVE-2015-16412026-10-17
    1. “Observed lure documents repeatedly made use of CVE-2012-0158 , CVE-2014-1761 , CVE-2013-3906 , CVE-2015-1641 exploits to drop and execute their malware of choice.”

      cited as exploiting · named nearby · source: sentinelone.com ↗ · 2026-10-17

  3. CVE-2014-17612026-10-17
    1. “Observed lure documents repeatedly made use of CVE-2012-0158 , CVE-2014-1761 , CVE-2013-3906 , CVE-2015-1641 exploits to drop and execute their malware of choice.”

      cited as exploiting · named nearby · source: sentinelone.com ↗ · 2026-10-17

  4. CVE-2012-01582026-10-17
    1. “Observed lure documents repeatedly made use of CVE-2012-0158 , CVE-2014-1761 , CVE-2013-3906 , CVE-2015-1641 exploits to drop and execute their malware of choice.”

      cited as exploiting · named nearby · source: sentinelone.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

1 source
  1. 1.sentinelone.com/labs/modifiedelephant-apt-and-a-decade-of-fabricating-…

Track ModifiedElephant on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.