Threadlinqs IntelligenceStart free

Threat actorTracked since 2026-11

CRAFTY FALCON

As of 2026-11-11, CRAFTY FALCON is a threat actor tracked by Threadlinqs Intelligence across 2 threats spanning threat intel, apt. ATT&CK coverage spans 21 techniques across 11 tactics in 2 of 2 tracked threats. Most-observed techniques: T1059 (Command and Scripting Interpreter), T1190 (Exploit Public-Facing Application), T1588.002 (Tool).

Tracked threats
22 high
First seen
2026-11-06
Last seen
2026-11-11
ATT&CK techniques
21across 2 of 2 threats
Related CVEs
0None referenced
2 tracked threat(s) · Categories: THREAT_INTEL, APT

Activity timeline

CRAFTY FALCON appears in 2 tracked threats between and .

ATT&CK techniques observed

21 techniques observed across 2 of 2 tracked threats · Resource Development (4), Credential Access (3), Execution (3), Initial Access (3), Impact (2), Command and Control (1)
  • T1059 Command and Scripting Interpreter — Executionobserved in 2 of 2 tracked threats
  • T1190 Exploit Public-Facing Application — Initial Accessobserved in 2 of 2 tracked threats
  • T1588.002 Tool — Resource Developmentobserved in 2 of 2 tracked threats
  • T1657 Financial Theft — Impactobserved in 2 of 2 tracked threats
  • T1036 Masquerading — Stealth (formerly Defense Evasion)observed in 1 of 2 tracked threats
  • T1078 Valid Accounts — Initial Accessobserved in 1 of 2 tracked threats
  • T1090 Proxy — Command and Controlobserved in 1 of 2 tracked threats
  • T1195.002 Supply Chain Compromise — Initial Accessobserved in 1 of 2 tracked threats
  • T1505.003 Server Software Component: Web Shell — Persistenceobserved in 1 of 2 tracked threats
  • T1528 Steal Application Access Token — Credential Accessobserved in 1 of 2 tracked threats
  • T1550.001 Application Access Token — Lateral Movementobserved in 1 of 2 tracked threats
  • T1552 Unsecured Credentials — Credential Accessobserved in 1 of 2 tracked threats
  • T1552.001 Unsecured Credentials — Credential Accessobserved in 1 of 2 tracked threats
  • T1565 Data Manipulation — Impactobserved in 1 of 2 tracked threats
  • T1583.003 Virtual Private Server — Resource Developmentobserved in 1 of 2 tracked threats

Tracked threats