"description":"OLDBAIT is a credential harvester used by APT28.[[Citation: FireEye APT28]][[Citation: FireEye APT28 January 2017]]\n\nAliases: OLDBAIT, Sasfis"
"description":"CosmicDuke is malware that was used by APT29 from 2010 to 2015.[[Citation: F-Secure The Dukes]]\n\nAliases: CosmicDuke, TinyBaron, BotgenStudios, NemesisGemina"
"description":"H1N1 is a malware variant that has been distributed via a campaign using VBA macros to infect victims. Although it initially had only loader capabilities, it has evolved to include information-stealing functionality.[[Citation: Cisco H1N1 Part 1]]"
"description":"SPACESHIP is malware developed by APT30 that allows propagation and exfiltration of data over removable devices. APT30 may use this capability to exfiltrate data across air-gaps.[[Citation: FireEye APT30]]"
"description":"Hi-Zor is a remote access tool (RAT) that has characteristics similar to Sakula. It was used in a campaign named INOCNATION.[[Citation: Fidelis Hi-Zor]]"
"description":"TEXTMATE is a second-stage PowerShell backdoor that is memory-resident. It was observed being used along with POWERSOURCE in February 2017.[[Citation: FireEye FIN7 March 2017]]\n\nAliases: TEXTMATE, DNSMessenger"
"description":"Net Crawler is an intranet worm capable of extracting credentials using credential dumpers and spreading to systems on a network over SMB by brute forcing accounts with recovered passwords and using PsExec to execute a copy of Net Crawler.[[Citation: Cylance Cleaver]]\n\nAliases: Net Crawler, NetC"
"description":"BlackEnergy is a malware toolkit that has been used by both criminal and APT actors. It dates back to at least 2007 and was originally designed to create botnets for use in conducting Distributed Denial of Service (DDoS) attacks, but its use has evolved to support various plug-ins. It is well known for being used during the confrontation between Georgia and Russia in 2008, as well as in targeting Ukrainian institutions. Variants include BlackEnergy 2 and BlackEnergy 3.[[Citation: F-Secure BlackEnergy 2014]]\n\nAliases: BlackEnergy, Black Energy"
"description":"Pisloader is a malware family that is notable due to its use of DNS as a C2 protocol as well as its use of anti-analysis tactics. It has been used by APT18 and is similar to another malware family, HTTPBrowser, that has been used by the group.[[Citation: Palo Alto DNS Requests]]"
"description":"Backdoor.Oldrea is a backdoor used by Dragonfly. It appears to be custom malware authored by the group or specifically for it.[[Citation: Symantec Dragonfly]]\n\nAliases: Backdoor.Oldrea, Havex"
"description":"ChChes is a Trojan that appears to be used exclusively by menuPass. It was used to target Japanese organizations in 2016. Its lack of persistence methods suggests it may be intended as a first-stage tool.[[Citation: Palo Alto menuPass Feb 2017]][[Citation: JPCERT ChChes Feb 2017]][[Citation: PWC Cloud Hopper Technical Annex April 2017]]\n\nAliases: ChChes, Scorpion, HAYMAKER"
"description":"Hacking Team UEFI Rootkit is a rootkit developed by the company Hacking Team as a method of persistence for remote access software.[[Citation: TrendMicro Hacking Team UEFI]]"
"description":"HALFBAKED is a malware family consisting of multiple components intended to establish persistence in victim networks.[[Citation: FireEye FIN7 April 2017]]"
"description":"httpclient is malware used by Putter Panda. It is a simple tool that provides a limited range of functionality, suggesting it is likely used as a second-stage or supplementary/backup tool.[[Citation: CrowdStrike Putter Panda]]"
"description":"Downdelph is a first-stage downloader written in Delphi that has been used by APT28 in rare instances between 2013 and 2015.[[Citation: ESET Sednit Part 3]]\n\nAliases: Downdelph, Delphacy"
"description":"StreamEx is a malware family that has been used by Deep Panda since at least 2015. In 2016, it was distributed via legitimate compromised Korean websites.[[Citation: Cylance Shell Crew Feb 2017]]"
"description":"Psylo is a shellcode-based Trojan that has been used by Scarlet Mimic. It has similar characteristics as FakeM.[[Citation: Scarlet Mimic Jan 2016]]"
"description":"HDoor is malware that has been customized and used by the Naikon group.[[Citation: Baumgartner Naikon 2015]]\n\nAliases: HDoor, Custom HDoor"
"description":"is a backdoor that has been used by APT28 on OS X and appears to be developed in a similar manner to XAgentOSX[[Citation: XAgentOSX]][[Citation: Sofacy Komplex Trojan]]."
"description":"CloudDuke is malware that was used by APT29 in 2015.[[Citation: F-Secure The Dukes]][[Citation: Securelist Minidionis July 2015]]\n\nAliases: CloudDuke, MiniDionis, CloudLook"
"description":"MobileOrder is a Trojan intended to compromise Android mobile devices. It has been used by Scarlet Mimic.[[Citation: Scarlet Mimic Jan 2016]]"
"description":"Duqu is a malware platform that uses a modular approach to extend functionality after deployment within a target network.[[Citation: Symantec W32.Duqu]]"
"description":"SHIPSHAPE is malware developed by APT30 that allows propagation and exfiltration of data over removable devices. APT30 may use this capability to exfiltrate data across air-gaps.[[Citation: FireEye APT30]]"
"description":"T9000 is a backdoor that is a newer variant of the T5000 malware family, also known as Plat1. Its primary function is to gather information about the victim. It has been used in multiple targeted attacks against U.S.-based organizations.[[Citation: FireEye admin@338 March 2014]][[Citation: Palo Alto T9000 Feb 2016]]"
"description":"PlugX is a remote access tool (RAT) that uses modular plugins.[[Citation: Lastline PlugX Analysis]] It has been used by multiple threat groups.[[Citation: FireEye Clandestine Fox Part 2]][[Citation: New DragonOK]][[Citation: Dell TG-3390]]\n\nAliases: PlugX, Sogu, Kaba"
"description":"POSHSPY is a backdoor that has been used by APT29 since at least 2015. It appears to be used as a secondary backdoor used if the actors lost access to their primary backdoors.[[Citation: FireEye POSHSPY April 2017]]"
"description":"Taidoor is malware that has been used since at least 2010, primarily to target Taiwanese government organizations.[[Citation: TrendMicro Taidoor]]"
"description":"MoonWind is a remote access tool (RAT) that was used in 2016 to target organizations in Thailand.[[Citation: Palo Alto MoonWind March 2017]]"
"description":"Crimson is malware used as part of a campaign known as Operation Transparent Tribe that targeted Indian diplomatic and military victims.[[Citation: Proofpoint Operation Transparent Tribe March 2016]]\n\nAliases: Crimson, MSIL/Crimson"
"description":"Rover is malware suspected of being used for espionage purposes. It was used in 2015 in a targeted email sent to an Indian Ambassador to Afghanistan.[[Citation: Palo Alto Rover]]"
"description":"ZLib is a full-featured backdoor that was used as a second-stage implant by Dust Storm from 2014 to 2015. It is malware and should not be confused with the compression library from which its name is derived.[[Citation: Cylance Dust Storm]]"
"description":"PowerDuke is a backdoor that was used by APT29 in 2016. It has primarily been delivered through Microsoft Word or Excel attachments containing malicious macros.[[Citation: Volexity PowerDuke November 2016]]"
"description":"HTTPBrowser is malware that has been used by several threat groups.[[Citation: ThreatStream Evasion Analysis]][[Citation: Dell TG-3390]] It is believed to be of Chinese origin.[[Citation: ThreatConnect Anthem]]\n\nAliases: HTTPBrowser, Token Control, HttpDump"
"description":"HAMMERTOSS is a backdoor that was used by APT29 in 2015.[[Citation: FireEye APT29]][[Citation: F-Secure The Dukes]]\n\nAliases: HAMMERTOSS, HammerDuke, NetDuke"
"description":"PoisonIvy is a popular remote access tool (RAT) that has been used by many groups.[[Citation: FireEye Poison Ivy]]\n\nAliases: PoisonIvy, Poison Ivy"
"description":"Carbanak is a remote backdoor used by a group of the same name (Carbanak). It is intended for espionage, data exfiltration, and providing remote access to infected machines.[[Citation: Kaspersky Carbanak]]\n\nAliases: Carbanak, Anunak"
"description":"BADNEWS is malware that has been used by the actors responsible for the MONSOON campaign. Its name was given due to its use of RSS feeds, forums, and blogs for command and control.[[Citation: Forcepoint Monsoon]]"
"description":"Flame is a sophisticated toolkit that has been used to collect information since at least 2010, largely targeting Middle East countries.[[Citation: Kaspersky Flame]]\n\nAliases: Flame, Flamer, sKyWIper"
"description":"CozyCar is malware that was used by APT29 from 2010 to 2015. It is a modular malware platform, and its backdoor component can be instructed to download and execute a variety of modules with different functionality.[[Citation: F-Secure The Dukes]]\n\nAliases: CozyCar, CozyDuke, CozyBear, Cozer, EuroAPT"
"description":"XTunnel a VPN-like network proxy tool that can relay traffic between a C2 server and a victim. It was first seen in May 2013 and reportedly used by APT28 during the compromise of the Democratic National Committee.[[Citation: Crowdstrike DNC June 2016]][[Citation: Invincea XTunnel]][[Citation: ESET Sednit Part 2]]\n\nAliases: XTunnel, X-Tunnel, XAPS"
"description":"Sakula is a remote access tool (RAT) that first surfaced in 2012 and was used in intrusions throughout 2015.[[Citation: Dell Sakula]]\n\nAliases: Sakula, Sakurel, VIPER"
"description":"Agent.btz is a worm that primarily spreads itself via removable devices such as USB drives. It reportedly infected U.S. military networks in 2008.[[Citation: Securelist Agent.btz]]"
"description":"Prikormka is a malware family used in a campaign known as Operation Groundbait. It has predominantly been observed in Ukraine and was used as early as 2008.[[Citation: ESET Operation Groundbait]]"
"description":"NETEAGLE is a backdoor developed by APT30 with compile dates as early as 2008. It has two main variants known as “Scout” and “Norton.”[[Citation: FireEye APT30]]"
"description":"USBStealer is malware that has used by APT28 since at least 2005 to extract information from air-gapped networks. It does not have the capability to communicate over the Internet and has been used in conjunction with ADVSTORESHELL.[[Citation: ESET Sednit USBStealer 2014]][[Citation: Kaspersky Sofacy]]\n\nAliases: USBStealer, USB Stealer, Win32/USBStealer"
"description":"is a trojan that has been used by APT28 on OS X and appears to be a port of their standard CHOPSTICK or XAgent trojan.[[Citation: XAgentOSX]]"
"description":"Regin is a malware platform that has targeted victims in a range of industries, including telecom, government, and financial institutions. Some Regin timestamps date back to 2003.[[Citation: Kaspersky Regin]]"
"description":"AutoIt is a backdoor that has been used by the actors responsible for the MONSOON campaign. The actors frequently used it in weaponized .pps files exploiting CVE-2014-6352.[[Citation: Forcepoint Monsoon]]"
"description":"Trojan.Karagany is a backdoor primarily used for recon. The source code for it was leaked in 2010 and it is sold on underground forums.[[Citation: Symantec Dragonfly]]"
"description":"CHOPSTICK is malware family of modular backdoors used by APT28. It has been used from at least November 2012 to August 2016 and is usually dropped on victims as second-stage malware, though it has been used as first-stage malware in several cases.[[Citation: FireEye APT28]][[Citation: ESET Sednit Part 2]][[Citation: FireEye APT28 January 2017]]\n\nAliases: CHOPSTICK, SPLM, Xagent, X-Agent, webhp"
"description":"MiniDuke is malware that was used by APT29 from 2010 to 2015. The MiniDuke toolset consists of multiple downloader and backdoor components. The loader has been used with other MiniDuke components as well as in conjunction with CosmicDuke and PinchDuke.[[Citation: F-Secure The Dukes]]"
"description":"BBSRAT is malware with remote access tool functionality that has been used in targeted compromises.[[Citation: Palo Alto Networks BBSRAT]]"
"description":"Elise is a custom backdoor Trojan that appears to be used exclusively by Lotus Blossom. It is part of a larger group of\ntools referred to as LStudio, ST Group, and APT0LSTU.[[Citation: Lotus Blossom Jun 2015]]\n\nAliases: Elise, BKDR_ESILE, Page"
"description":"POWERSOURCE is a PowerShell backdoor that is a heavily obfuscated and modified version of the publicly available tool DNS_TXT_Pwnage. It was observed in February 2017 in spearphishing campaigns against personnel involved with United States Securities and Exchange Commission (SEC) filings at various organizations. The malware was delivered when macros were enabled by the victim and a VBS script was dropped.[[Citation: FireEye FIN7 March 2017]][[Citation: Cisco DNSMessenger March 2017]]\n\nAliases: POWERSOURCE, DNSMessenger"
"description":"Zeroaccess is a kernel-mode Rootkit that attempts to add victims to the ZeroAccess botnet, often for monetary gain.[[Citation: Sophos ZeroAccess]]\n\nAliases: Zeroaccess, Trojan.Zeroaccess"
"description":"Skeleton Key is malware used to inject false credentials into domain controllers with the intent of creating a backdoor password.Skeleton Key is included as a module in Mimikatz."
"description":"Shamoon is malware that was first used by an Iranian group known as the \"Cutting Sword of Justice\" in 2012. The 2.0 version was seen in 2016 targeting Middle Eastern states.[[Citation: FireEye Shamoon Nov 2016]][[Citation: Palo Alto Shamoon Nov 2016]]\n\nAliases: Shamoon, Disttrack"
"description":"BOOTRASH is a Bootkit that targets Windows operating systems. It has been used by threat actors that target the financial sector.[[Citation: MTrends 2016]]"
"description":"Wiper is a family of destructive malware used in March 2013 during breaches of South Korean banks and media companies.[[Citation: Dell Wiper]]"
"description":"Unknown Logger is a publicly released, free backdoor. Version 1.5 of the backdoor has been used by the actors responsible for the MONSOON campaign.[[Citation: Forcepoint Monsoon]]"
"description":"CORESHELL is a downloader used by APT28. The older versions of this malware are known as SOURFACE and newer versions as CORESHELL. It has also been referred to as Sofacy, though that term has been used widely to refer to both the group APT28 and malware families associated with the group.[[Citation: FireEye APT28]][[Citation: FireEye APT28 January 2017]]\n\nAliases: CORESHELL, SOURFACE"
"description":"Remsec is a modular backdoor that has been used by Strider and appears to have been designed primarily for espionage purposes. Many of its modules are written in Lua.[[Citation: Symantec Strider Blog]]\n\nAliases: Remsec, Backdoor.Remsec, ProjectSauron"
"description":"FLASHFLOOD is malware developed by APT30 that allows propagation and exfiltration of data over removable devices. APT30 may use this capability to exfiltrate data across air-gaps.[[Citation: FireEye APT30]]"
"description":"TINYTYPHON is a backdoor that has been used by the actors responsible for the MONSOON campaign. The majority of its code was reportedly taken from the MyDoom worm.[[Citation: Forcepoint Monsoon]]"
"description":"SeaDuke is malware that was used by APT29 from 2014 to 2015. It was used primarily as a secondary backdoor for victims that were already compromised with CozyCar.[[Citation: F-Secure The Dukes]]\n\nAliases: SeaDuke, SeaDaddy, SeaDesk"
"description":"ADVSTORESHELL is a spying backdoor that has been used by APT28 from at least 2012 to 2016. It is generally used for long-term espionage and is deployed on targets deemed interesting after a reconnaissance phase.[[Citation: Kaspersky Sofacy]][[Citation: ESET Sednit Part 2]]\n\nAliases: ADVSTORESHELL, NETUI, EVILTOSS, AZZY, Sedreco"
"description":"NetTraveler is malware that has been used in multiple cyber espionage campaigns for basic surveillance of victims. The earliest known samples have timestamps back to 2005, and the largest number of observed samples were created between 2010 and 2013.[[Citation: Kaspersky NetTraveler]]"
"description":"P2P ZeuS is a closed-source fork of the leaked version of the ZeuS botnet. It presents improvements over the leaked version, including a peer-to-peer architecture.[[Citation: Dell P2P ZeuS]]\n\nAliases: P2P ZeuS, Peer-to-Peer ZeuS, Gameover ZeuS"
"description":"ComRAT is a remote access tool suspected of being a decedent of Agent.btz and used by Turla.[[Citation: Symantec Waterbug]][[Citation: NorthSec 2015 GData Uroburos Tools]]"
"description":"Winnti is a Trojan that has been used by multiple groups to carry out intrusions in varied regions from at least 2010 to 2016. One of the groups using this malware is referred to by the same name, Winnti Group; however, reporting indicates a second distinct group, Axiom, also uses the malware.[[Citation: Kaspersky Winnti April 2013]][[Citation: Microsoft Winnti Jan 2017]][[Citation: Novetta Winnti April 2015]]"
"description":"RedLeaves is a malware family used by menuPass. The code overlaps with PlugX and may be based upon the open source tool Trochilus.[[Citation: PWC Cloud Hopper Technical Annex April 2017]][[Citation: FireEye APT10 April 2017]]\n\nAliases: RedLeaves, BUGJUICE"
"description":"CallMe is a Trojan designed to run on Apple OSX. It is based on a publicly available tool called Tiny SHell.[[Citation: Scarlet Mimic Jan 2016]]"
"description":"HIDEDRV is a rootkit used by APT28. It has been deployed along with Downdelph to execute and hide that malware.[[Citation: ESET Sednit Part 3]][[Citation: Sekoia HideDRV Oct 2016]]"
"description":"Hikit is malware that has been used by Axiom for late-stage [[persistence]] and [[exfiltration]] after the initial compromise.[[Citation: Axiom]]"
"description":"EvilGrab is a malware family with common reconnaissance capabilities. It has been deployed by menuPass via malicious Microsoft Office documents as part of spearphishing campaigns.[[Citation: PWC Cloud Hopper Technical Annex April 2017]]"
"description":"ASPXSpy is a Web shell. It has been modified by Threat Group-3390 actors to create the ASPXTool version.[[Citation: Dell TG-3390]]\n\nAliases: ASPXSpy, ASPXTool"
"description":"Sykipot is malware that has been used in spearphishing campaigns since approximately 2007 against victims primarily in the US. One variant of Sykipot hijacks smart cards on victims.[[Citation: Alienvault Sykipot DOD Smart Cards]] The group using this malware has also been referred to as Sykipot.[[Citation: Blasco 2013]]"
"description":"GLOOXMAIL is malware used by APT1 that mimics legitimate Jabber/XMPP traffic.[[Citation: Mandiant APT1]]\n\nAliases: GLOOXMAIL, Trojan.GTALK"
"description":"Emissary is a Trojan that has been used by Lotus Blossom. It shares code with Elise, with both Trojans being part of a malware group referred to as LStudio.[[Citation: Lotus Blossom Dec 2015]]"
"description":"Miner-C is malware that mines victims for the Monero cryptocurrency. It has targeted FTP servers and Network Attached Storage (NAS) devices to spread.[[Citation: Softpedia MinerC]]\n\nAliases: Miner-C, Mal/Miner-C, PhotoMiner"
"description":"KOMPROGO is a signature backdoor used by APT32 that is capable of process, file, and registry management.[[Citation: FireEye APT32 May 2017]]"
"description":"DustySky is multi-stage malware written in .NET that has been used by Molerats since May 2015.[[Citation: DustySky]][[Citation: DustySky2]]\n\nAliases: DustySky, NeD Worm"
"description":"BUBBLEWRAP is a full-featured, second-stage backdoor used by the admin@338 group. It is set to run when the system boots and includes functionality to check, upload, and register plug-ins that can further enhance its capabilities.[[Citation: FireEye admin@338]]\n\nAliases: BUBBLEWRAP, Backdoor.APT.FakeWinHTTPHelper"
"description":"pngdowner is malware used by Putter Panda. It is a simple tool with limited functionality and no persistence mechanism, suggesting it is used only as a simple \"download-and-\nexecute\" utility.[[Citation: CrowdStrike Putter Panda]]"
"description":"Nidiran is a custom backdoor developed and used by Suckfly. It has been delivered via strategic web compromise.[[Citation: Symantec Suckfly March 2016]]\n\nAliases: Nidiran, Backdoor.Nidiran"
"description":"OwaAuth is a Web shell and credential stealer deployed to Microsoft Exchange servers that appears to be exclusively used by Threat Group-3390.[[Citation: Dell TG-3390]]"
"description":"LOWBALL is malware used by admin@338. It was used in August 2015 in email messages targeting Hong Kong-based media organizations.[[Citation: FireEye admin@338]]"
"description":"Derusbi is malware used by multiple Chinese APT groups.[[Citation: Axiom]][[Citation: ThreatConnect Anthem]] Both Windows and Linux variants have been observed.[[Citation: Fidelis Turbo]]"
"description":"Lurid is a malware family that has been used by several groups, including PittyTiger, in targeted attacks as far back as 2006.[[Citation: Villeneuve 2014]][[Citation: Villeneuve 2011]]\n\nAliases: Lurid, Enfal"
"description":"JHUHUGIT is malware used by APT28. It is based on Carberp source code and serves as reconnaissance malware.[[Citation: Kaspersky Sofacy]][[Citation: F-Secure Sofacy 2015]][[Citation: ESET Sednit Part 1]][[Citation: FireEye APT28 January 2017]]\n\nAliases: JHUHUGIT, Seduploader, JKEYSKW, Sednit, GAMEFISH"
"description":"ELMER is a non-persistent, proxy-aware HTTP backdoor written in Delphi that has been used by APT16.[[Citation: FireEye EPS Awakens Part 2]]"
