Hagga

Threat actor0 reports from 0 vendors

Hagga is believed to have been using Agent Tesla, 2021’s sixth most prevalent malware, to steal sensitive information from his victims since the latter part of 2021.

Vendor aliases (2)

The same group is tracked under different names by different vendors.

Vendor	Name
OSINT	Aggah
OSINT	TH-157

MITRE ATT&CK techniques (0)

No techniques mapped yet.

Indicators of compromise

No IOCs extracted yet from reports naming this actor.

Report timeline

Every report in the Global Intel Library that names Hagga, newest first. Open any report to see the full analysis with provenance.

No reports in the Lore library name this actor yet.

Threat feed IOCs (0)

Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to Hagga. Each row shows why it was linked and where it came from.

No feed indicators linked to this actor yet. Feeds are checked every hour.

Public research & publications (4)

Open-source reports about this actor collected from MISP Galaxy.

team-cymru.comhttps://www.team-cymru.com/post/an-analysis-of-infrastructure-linked-to-the-hagga-threat-actor
otx.alienvault.comhttps://otx.alienvault.com/pulse/62cfe4ef3415be5f83be81d1
team-cymru.comhttps://team-cymru.com/blog/2022/07/12/an-analysis-of-infrastructure-linked-to-the-hagga-threat-actor/
unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/aggah-campaign-bit-ly-blogspot-and-pastebin-used-for-c2-in-large-scale-campaign/