Security Resilience

Threat actor · all actors

NOTROBINMISP-21d08f2c unknown

aka NOTROBIN

Last updated: 2026-10-16

29attributed CVEs
0ATT&CK techniques
66.4IDF score (tooling uniqueness)
0exclusive CVEs
2017–2022years active

About this actor

Researchers at FireEye report finding a hacking group (dubbed NOTROBIN) that has been bundling mitigation code for NetScaler servers with its exploits. In effect, the hackers exploit the flaw to get access to the server, kill any existing malware, set up their own backdoor, then block off the vulnerable code from future exploit attempts by mitigation.

How we know this

Data origin
MISP threat-actor galaxy Imported from the open-source MISP threat-actor galaxy.
Techniques
No ATT&CK techniques mapped.
Named victims
None on file.

Thin data: No ATT&CK techniques are mapped yet — the behavioural profile is empty.

See how actor data is built for the full pipeline.

Activity timeline

2017: 1 CVE published120172018: 1 CVE published120182019: 7 CVE published720192020: 7 CVE published720202021: 13 CVE published2021: 28 KEV added4120212022: 1 KEV added12022
CVE publishedKEV added

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2019-11510 KEV10.010.01.00002019-05-08see CVE
CVE-2021-22893 KEV10.010.00.97002021-04-23see CVE
CVE-2018-7600 KEV9.99.81.00002018-03-29see CVE
CVE-2019-0604 KEV9.99.80.99912019-03-05see CVE
CVE-2019-11580 KEV9.99.80.97502019-06-03see CVE
CVE-2019-18935 KEV9.99.80.99742019-12-11see CVE
CVE-2019-19781 KEV9.99.81.00002019-12-27see CVE
CVE-2019-3396 KEV9.99.80.99912019-03-25see CVE
CVE-2020-12812 KEV9.99.80.49342020-07-24see CVE
CVE-2020-15505 KEV9.99.80.99742020-07-07see CVE
CVE-2020-5902 KEV9.99.81.00002020-07-01see CVE
CVE-2021-21985 KEV9.99.81.00002021-05-26see CVE
CVE-2021-27101 KEV9.99.80.06002021-02-16see CVE
CVE-2021-27103 KEV9.99.80.11412021-02-16see CVE
CVE-2021-27104 KEV9.99.80.56692021-02-16see CVE
CVE-2018-13379 KEV9.59.11.00002019-06-04see CVE
CVE-2021-26855 KEV9.59.11.00002021-03-03see CVE
CVE-2020-0688 KEV9.28.80.99972020-02-11see CVE
CVE-2021-22894 KEV9.28.80.50622021-05-27see CVE
CVE-2021-22899 KEV9.28.80.38002021-05-27see CVE
CVE-2017-11882 KEV8.57.80.99942017-11-15see CVE
CVE-2020-0787 KEV8.57.80.91412020-03-12see CVE
CVE-2021-26857 KEV8.57.80.95762021-03-03see CVE
CVE-2021-26858 KEV8.57.80.93652021-03-03see CVE
CVE-2021-27065 KEV8.57.80.99952021-03-03see CVE
CVE-2021-27102 KEV8.57.80.03652021-02-16see CVE
CVE-2021-22900 KEV8.17.20.14152021-05-27see CVE
CVE-2019-5591 KEV7.76.50.56822020-08-14see CVE
CVE-2020-1472 KEV7.55.50.99512020-08-17see CVE

No techniques attributed.

Co-occurring actors

Similar actors

Overlapping CVEs

Active in same years