Skip to content
skopnix
← adversaries
Unknown

SPIKEDWINE

misp-galaxyrefreshed 2026-09-15

sigil

Analyst brief

SPIKEDWINE is a threat actor targeting European officials with a new backdoor called WINELOADER. They use a bait PDF document posing as an invitation letter from the Ambassador of India to lure diplomats. The attack is characterized by advanced tactics, techniques, and procedures in the malware and command and control infrastructure. The motivation behind the attacks seems to be exploiting the geopolitical relations between India and European nations.

Take it with you
References
Early access

Track SPIKEDWINE on the wire.

Early access opens the actor API and MCP server first — and an alert every time this adversary lands on the wire. One email when it's ready.

bot-protected