Skip to content
skopnix
Adversaries · Dossier
← Adversaries

File · Mr_Rot13 · Unknown · misp-galaxy · refreshed 2026-10-06

Mr_Rot13

sigil · no ATT&CK coverage stated

What changed

ledger · newest first
  1. 2026-10-18todaynew CVE1 new CVE: CVE-2026-41940

Analyst brief

misp-galaxy

Mr_Rot13 is a stable hacking group identified through a PHP backdoor and a Downloader domain linked to a C2 infrastructure active since 2020. They utilize the Rot13 algorithm for obfuscation and have demonstrated a low detection rate across security products, indicating advanced operational security. Their activities include exploiting CVE-2026-41940 to deliver malicious payloads and maintaining covert communication via Telegram. The group has shown a particular focus on WordPress as a target, with ongoing operations that suggest a sophisticated threat actor rather than opportunistic attackers.

CVEs cited sources tie to Mr_Rot13

1 on CISA KEV
  1. CVE-2026-41940KEV2026-10-17
    1. “The malicious script delivered by Mr_rot13 via CVE-2026-41940 is shown below.”

      cited as used in a campaign · source: blog.xlab.qianxin.com ↗ · 2026-10-17

    2. “Threat Actor Mr_Rot13 Actively Exploits CVE-2026-41940 for Backdoor Deployment”

      attributed by a report · named nearby · source: blog.xlab.qianxin.com ↗

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Detections

7 rules · Sigma · QRadar · Cortex

  1. Actor indicator sweep

    Mr_Rot13 file hash indicators

    Mr_Rot13

    T1204.002conf 72SIGAQLXQL

  2. Indicator

    Known-malicious file hash observed

    APT41 · blackbyte · Caliente Bandits · CeranaKeeper · DragonSpark · FIN7 · 19 more

    T1204.002conf 72AQL

  3. Indicator

    Malicious Hashes

    APT41 · blackbyte · Caliente Bandits · CeranaKeeper · DragonSpark · FIN7 · 19 more

    T1204.002conf 72AQL

  4. Indicator

    Execution of known malicious file 2286f126ab4740cc…

    Mr_Rot13

    T1204.002conf 72SIGXQL

Generated by skopnix from this finding, each with false-positive notes. Open the list →

Take it with you

keyless · no signup

References

1 source
  1. 1.blog.xlab.qianxin.com/mr_rot13-the-elusive-6-year-hacker-group-weaponizing-c…

Track Mr_Rot13 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.