Sakaen736jih
Sakaen736jih is a cybercrime syndicate with a financial motive, tracked by Brandefense. It uses 8 MITRE ATT&CK techniques.
- Techniques
- 8
- Exploited CVEs
- No CVE data
- Record updated
How They Operate · MITRE ATT&CK.
8 techniques across 6 of 14 tacticsReconnaissance1
T1071.001
Application Layer Protocol: Web Protocols
Application Layer Protocol: Web Protocols
Resource Development1
T1195.002
Supply Chain Compromise: Compromise Software Supply Chain
Supply Chain Compromise: Compromise Software Supply Chain
Execution·
Persistence1
T1539
Steal Web Session Cookie
Steal Web Session Cookie
Privilege Escalation·
Defense Evasion1
T1552.001
Unsecured Credentials: Credentials In Files
Unsecured Credentials: Credentials In Files
Discovery·
Lateral Movement·
Collection·
Command and Control·
Exfiltration·
Impact·
Arsenal · Malware And Tools.
- Atomic macOS Stealermalware
About Sakaen736jih.
Prolific actor linked to the distribution of 199 distinct malicious scripts within the OpenClaw AI ecosystem, capable of exfiltrating private wallet keys and deploying AMOS Stealer.
Last updated Jul 26, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.