#ParsedReport #CompletenessHigh
09-09-2026

DENOmination Group: Deno in attack chains targeting Russian organizations

https://ptsecurity.com/research/pt-esc-threat-intelligence/denomination-group-deno-in-attack-chains-targeting-russian-organizations/

Report completeness: High

Actors/Campaigns:
Denomination (motivation: information_theft)
Graybravo

Threats:
Deno_tool
Dindoor
Denorat
Clickfix_technique
Nightshade
Deno_loader
Spear-phishing_technique

Victims:
Defense industrial sector, Military organizations, Financial sector, Consulting sector

Industry:
Financial, Military

Geo:
Russian federation, Russian

TTPs:
Tactics: 5
Technics: 31

IOCs:
File: 25
Path: 8
Url: 4
Command: 4
Registry: 3
IP: 9
Domain: 1
Hash: 8

Soft:
itwarden, 1, Password, L, astPass, K, eePassXC, D, ashlane, N, ordPass, K, elegram De, iscord to, eePass da, oogle Chrome, M, have more...

Wallets:
metamask, electrum, atomicwallet, coinbase

Algorithms:
sha256, zip, base64

Functions:
Set-ItemProperty, GetManifestResourceStream

Win API:
OpenKeyExW / Re, QueryValueExW → HK, RegOpenKeyExW, RegQueryValueExW, RegCloseKey

Languages:
jscript, typescript, javascript, powershell