REF8801
REF8801 is a cybercrime syndicate with a financial motive, tracked by Brandefense. It targets the Technology and Finance sectors in Singapore. It uses 13 MITRE ATT&CK techniques.
- Techniques
- 13
- Exploited CVEs
- No CVE data
- Record updated
Who They Target.
Sectors · 2
Countries · 1
How They Operate · MITRE ATT&CK.
13 techniques across 8 of 14 tacticsReconnaissance1
T1071.001
Application Layer Protocol: Web Protocols
Application Layer Protocol: Web Protocols
Resource Development·
Initial Access2
T1195.001
Supply Chain Compromise: Compromise Software Dependencies and Development Tools
Supply Chain Compromise: Compromise Software Dependencies and Development Tools
T1566.003
Phishing: Spearphishing via Service
Phishing: Spearphishing via Service
Execution4
T1055
Process Injection
Process Injection
T1059.001
Command and Scripting Interpreter: PowerShell
Command and Scripting Interpreter: PowerShell
T1059.004
Command and Scripting Interpreter: Unix Shell
Command and Scripting Interpreter: Unix Shell
T1140
Deobfuscate/Decode Files or Information
Deobfuscate/Decode Files or Information
Persistence·
Privilege Escalation1
T1548.002
Abuse Elevation Control Mechanism: Bypass User Account Control
Abuse Elevation Control Mechanism: Bypass User Account Control
Defense Evasion1
T1562.001
Impair Defenses: Disable or Modify Tools
Impair Defenses: Disable or Modify Tools
Credential Access2
T1056.002
Input Capture: GUI Input Capture
Input Capture: GUI Input Capture
T1555.003
Credentials from Password Stores: Credentials from Web Browsers
Credentials from Password Stores: Credentials from Web Browsers
Discovery·
Lateral Movement·
Collection1
T1114
Email Collection
Email Collection
Command and Control·
Exfiltration1
T1567
Exfiltration Over Web Service
Exfiltration Over Web Service
Impact·
Arsenal · Malware And Tools.
- Atomic Stealermalware
- CloudSyncDmalware
- PyInstallertool
- UACMetool
Campaigns.
- REF8801 Web3 Supply Chain Campaign
Indicators Of Compromise.
TLP:AMBER- Domain
apexfdn[.]xyz
6 more indicators on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout REF8801.
A sophisticated threat actor posing as a Web3 accelerator to conduct cross-platform supply chain attacks against cryptocurrency developers and manipulate AI agent integrations.
Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.