Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 17:22:25 UTC
Home > List all groups > List all tools > List all groups using tool Vminst
 Tool: Vminst
Names Vminst
Category Malware
Type Remote command
Description
(ClearSky) Vminst is a lateral movement tool used to infect hosts in the network using
previously stolen credentials. It injects Cobalt Strike into memory of infected hosts.
Information <https://www.clearskysec.com/wp-content/uploads/2017/07/Operation_Wilted_Tulip.pdf>
Last change to this tool card: 20 April 2020
Download this tool card in JSON format
All groups using tool Vminst
Changed Name Country Observed
APT groups
  CopyKittens, Slayer Kitten 2013-Jan 2017  
1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=90c89f1e-742a-4d81-97d5-17e4b84c22d0
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=90c89f1e-742a-4d81-97d5-17e4b84c22d0
Page 1 of 1