Threadlinqs IntelligenceStart free

Threat actorRussiaTracked since 2026-03

PureCoder

As of 2026-10-19, PureCoder is a Russia-nexus threat actor tracked by Threadlinqs Intelligence across 2 threats spanning malware. ATT&CK coverage spans 35 techniques across 10 tactics in 2 of 2 tracked threats. Most-observed techniques: T1005 (Data from Local System), T1027 (Obfuscated Files or Information), T1055 (Process Injection).

Tracked threats
21 high · 1 medium
First seen
2026-03-20
Last seen
2026-10-19
ATT&CK techniques
35across 2 of 2 threats
Related CVEs
0None referenced
Attribution
RussiaNation or origin
Nation: Russia · 2 tracked threat(s) · Categories: MALWARE

Activity timeline

PureCoder appears in 2 tracked threats between and ; the busiest month was 2026-03 with 1 report.

ATT&CK techniques observed

35 techniques observed across 2 of 2 tracked threats · Discovery (8), Stealth (formerly Defense Evasion) (7), Execution (6), Command and Control (4), Credential Access (3), Collection (2)
  • T1005 Data from Local System — Collectionobserved in 2 of 2 tracked threats
  • T1027 Obfuscated Files or Information — Stealth (formerly Defense Evasion)observed in 2 of 2 tracked threats
  • T1055 Process Injection — Stealth (formerly Defense Evasion)observed in 2 of 2 tracked threats
  • T1082 System Information Discovery — Discoveryobserved in 2 of 2 tracked threats
  • T1113 Screen Capture — Collectionobserved in 2 of 2 tracked threats
  • T1140 Deobfuscate/Decode Files or Information — Stealth (formerly Defense Evasion)observed in 2 of 2 tracked threats
  • T1566 Phishing — Initial Accessobserved in 2 of 2 tracked threats
  • T1620 Reflective Code Loading — Stealth (formerly Defense Evasion)observed in 2 of 2 tracked threats
  • T1685 Disable or Modify Tools — Defense Impairmentobserved in 2 of 2 tracked threats
  • T1010 Application Window Discovery — Discoveryobserved in 1 of 2 tracked threats
  • T1012 Query Registry — Discoveryobserved in 1 of 2 tracked threats
  • T1036 Masquerading — Stealth (formerly Defense Evasion)observed in 1 of 2 tracked threats
  • T1036.003 Rename Legitimate Utilities — Stealth (formerly Defense Evasion)observed in 1 of 2 tracked threats
  • T1041 Exfiltration Over C2 Channel — Exfiltrationobserved in 1 of 2 tracked threats
  • T1047 Windows Management Instrumentation — Executionobserved in 1 of 2 tracked threats

Tracked threats