GINC-APT-0839 · Tracked, unattributed

Massgrave

Category
Tracked, unattributed · A vendor’s working cluster, not yet attributed.
Origin
Unknown
Sources
3 sources carry it
Identifier
GINC-APT-0839 · massgrave

What it is

Massgrave is a hacking group that has developed a method to bypass Microsoft's software licensing for Windows and Office, enabling permanent activation of versions from Windows Vista to Windows 11. They are known for creating effective scripts for software activation, which are distributed through an unofficial repository at massgrave.dev. The group claims their exploit supports volume activation via the Key Management Services model and has gained traction within the piracy scene. Reports indicate that their tools may be used by unauthorized individuals, including Microsoft support agents, raising legal and security concerns.

Tools

The tools and malware families the sources tie to it.

  • Agent.btz
  • Hacking Team UEFI Rootkit
  • Windows Remote Desktop
  • Xploit

Sources

  • Malpedia malpedia.caad.fkie.fraunhofer.de