Espionage backdoors are built to stay quiet for months, so most are found through behaviour and identity misuse long after the first signature would have helped. This hub catalogues the first half, names A to L, of the MITRE ATT&CK Enterprise v20 software entries that NHI Mgmt Group groups as espionage backdoors and implants: 156 families from ADVSTORESHELL and BADNEWS to FoggyWeb, GoldMax, Industroyer, Kazuar, KEYPLUG and LightNeuron. Names M to Z are in the ATT&CK Espionage Backdoors and Implants (M to Z) Software Hub. The page shows the behaviours the family shares, computed from ATT&CK v20 technique relationships, then turns them into hunting, hardening and response priorities. It is for threat hunters, detection engineers and incident responders working long tail state threats. For a deep single-family example, see the BRICKSTORM Backdoor Guide.
Key takeaways
- A long tail, not a top ten: 156 families in this half alone, 156 of them malware, and ATT&CK v20 links most to at least one named group, with Turla, APT29, Lazarus Group and Kimsuky appearing most often.
- The shared core is web C2 plus tool transfer: T1071 Application Layer Protocol, T1059 Command and Scripting Interpreter and T1105 Ingress Tool Transfer are each mapped to roughly half of the members or more.
- Identity infrastructure is a target in itself: FoggyWeb ran inside AD FS servers to steal token-signing and token-decryption certificates, the material used to forge SAML tokens.
- Some implants reach operational technology: Industroyer and Industroyer2 carry modules for electrical substation protocols, and ESET attributes Industroyer2 to Sandworm with high confidence.
- Hunt the behaviour across families: persistence that masquerades as installed software, decoy traffic, staged archives and exfiltration over the C2 channel recur across unrelated families and are better detection targets than hashes.
What this category covers and why it matters
This hub is an NHI Mgmt Group grouping of ATT&CK v20 software whose primary role is long-term remote access and collection for espionage: modular backdoors and platforms (CozyCar, Carbon, Duqu, Flame, DUSTTRAP, KEYPLUG), single-purpose implants (GoldFinder for route tracing, Crutch for document theft), server-side backdoors (FoggyWeb on AD FS, LightNeuron on Microsoft Exchange) and a small number of commodity remote access tools that ATT&CK links to espionage groups (Agent Tesla, DarkComet, jRAT). Membership is not an official MITRE category. The split into A to L and M to Z is alphabetical only.
The category matters because these families are tailored, rotated and often seen in only a handful of victims. Microsoft described GoldMax as tailored to specific networks, with C2 domains that are often resold or compromised so they look long-established, and up to four decoy HTTP requests to legitimate sites mixed in with C2 traffic. Indicators from one victim may not appear at the next, so durable detection rests on technique coverage and on watching the systems espionage actors value: email, identity federation and administrative tooling.
| Implant style | Examples in this half | Where it lives | Best first detection |
|---|---|---|---|
| Modular backdoor platform | Carbon, CozyCar, Duqu, DUSTTRAP, Flame, KEYPLUG | Windows and Linux hosts, often servers | Plugin loads and persistence creation; periodic C2 |
| Server application backdoor | FoggyWeb (AD FS), LightNeuron (Exchange) | Identity and email servers | Unexpected DLL or transport agent loads in the server process; configuration exports |
| Second-stage C2 backdoor | ComRAT, GoldMax, HAMMERTOSS, Kazuar | Hosts already compromised by a first-stage tool | Scheduled tasks or services masquerading as installed software; decoy and web service C2 |
| Collection implant | Crutch, Dtrack, GoldFinder | Workstations and file servers | Staging archives, bulk file reads, uploads to cloud storage |
| Operational technology framework | Industroyer, Industroyer2 | Substation engineering workstations and controllers | Unexpected IEC 60870-5-104 or IEC 61850 sessions from IT hosts |
Common behaviours across the family
The table counts how many members ATT&CK v20 maps to each technique, with sub-techniques rolled up to their parent. With 156 families, these are the most reliable cross-family hunting targets.
| Technique (ATT&CK v20) | Tactic | Members using it |
|---|---|---|
| T1071 Application Layer Protocol | Command and Control | 86 of 156 |
| T1059 Command and Scripting Interpreter | Execution | 83 of 156 |
| T1105 Ingress Tool Transfer | Command and Control | 77 of 156 |
| T1027 Obfuscated Files or Information | Stealth | 75 of 156 |
| T1082 System Information Discovery | Discovery | 74 of 156 |
| T1083 File and Directory Discovery | Discovery | 66 of 156 |
| T1057 Process Discovery | Discovery | 59 of 156 |
| T1070 Indicator Removal | Stealth | 57 of 156 |
| T1547 Boot or Logon Autostart Execution | Persistence, Privilege Escalation | 53 of 156 |
| T1016 System Network Configuration Discovery | Discovery | 51 of 156 |
| T1140 Deobfuscate/Decode Files or Information | Stealth | 47 of 156 |
| T1573 Encrypted Channel | Command and Control | 44 of 156 |
| T1113 Screen Capture | Collection | 41 of 156 |
| T1036 Masquerading | Stealth | 41 of 156 |
| T1056 Input Capture | Collection, Credential Access | 39 of 156 |
| T1033 System Owner/User Discovery | Discovery | 36 of 156 |
- Web protocols for C2: T1071 is the most common technique. Pair it with T1102 Web Service and T1090 Proxy hunting, since many families hide C2 inside legitimate cloud services. See the Cloud Services Abuse for C2 Guide.
- Obfuscation and indicator removal: T1027 Obfuscated Files or Information and T1070 Indicator Removal are each mapped to more than a third of members, so expect encrypted configuration files and deleted droppers.
- Persistence that blends in: T1547 Boot or Logon Autostart Execution and T1036 Masquerading are common. Microsoft reported GoldMax persisting as a scheduled task named after software already present, pointing to a similarly named folder under ProgramData.
- Collection before exfiltration: T1113 Screen Capture, T1056 Input Capture, T1074 Data Staged, T1560 Archive Collected Data and T1041 Exfiltration Over C2 Channel form the collection chain to hunt as a sequence.
Real cases
- FoggyWeb on AD FS (APT29): Microsoft described FoggyWeb as a passive, highly targeted backdoor loaded through DLL search order hijacking of version.dll in the AD FS folder, which then ran with the AD FS service's permissions. It exfiltrated the token-signing certificate, the token-decryption certificate and the AD FS configuration database, returning them disguised as WebP image files. See the Golden SAML and Federation Trust Abuse Defence Guide.
- GoldMax and GoldFinder (SolarWinds Compromise): ATT&CK links both to APT29 and the SolarWinds Compromise. Microsoft described GoldMax as a Go backdoor with an AES-256 encrypted configuration, an activation date and decoy traffic, and GoldFinder as a tracer that maps the path to the C2 server, including proxies and security devices. See the SolarWinds Supply Chain Compromise breach analysis, where stolen SAML signing certificates and hijacked application identities carried the intrusion into cloud email.
- Industroyer2 (Sandworm Team): ESET reported an attempt to deploy Industroyer2 against high-voltage substations at a Ukrainian energy provider, with destructive actions scheduled for 8 April 2022. It speaks only IEC-104 and was deployed alongside the CaddyWiper Windows wiper. See the Sandworm Threat Actor Profile and the MITRE ATT&CK for ICS Guide.
- Turla's implant set: ATT&CK links Turla to more families in this half than any other group, including Carbon, ComRAT, Crutch, Gazer, Kazuar and LightNeuron, a backdoor that has targeted Microsoft Exchange servers since at least 2014. See the Turla Threat Actor Profile.
- InvisibleFerret (Contagious Interview): a modular Python backdoor for data exfiltration and remote access that ATT&CK links to the Contagious Interview fake recruitment activity, running on Windows, Linux and macOS developer machines. See the Contagious Interview Threat Actor Profile Guide.
Hunting and detection themes
| Theme | What to collect | Families it catches |
|---|---|---|
| Masquerading persistence | Scheduled task creation (Windows Security Event ID 4698), new services (System Event ID 7045), Run key changes, task and service binaries in ProgramData or user profile paths | GoldMax, ComRAT, Carbon, most Windows backdoors |
| Server process module loads | Image loads into AD FS, Exchange and IIS worker processes from unexpected paths; new Exchange transport agents | FoggyWeb, LightNeuron |
| Rare and decoy web C2 | Proxy and DNS logs: first-seen or recently re-registered domains, regular beacon intervals, unusual cookies and referrers, requests interleaved with popular sites | GoldMax, HAMMERTOSS, Kazuar, KEYPLUG |
| Staging and exfiltration | Archive creation in unusual folders, bulk reads of document shares, large uploads to cloud storage or C2 | Crutch, Dtrack, Carbon |
| OT protocol misuse | OT network monitoring for IEC-104 and IEC 61850 sessions from hosts that are not engineering stations | Industroyer, Industroyer2 |
| Federation and token anomalies | AD FS admin and audit logs, token issuance anomalies, new certificates or secrets on cloud applications | FoggyWeb and follow-on activity |
For turning these themes into tested analytics, see the ATT&CK Detection Strategies and Analytics Guide.
Where identity fits
Espionage implants go where trust is issued. FoggyWeb stole the certificates that let AD FS sign tokens; the SolarWinds intrusion then used forged SAML tokens and credentials added to existing applications to read email as a trusted service. Microsoft's FoggyWeb guidance includes protecting signing and decryption keys with a hardware security module, limiting AD FS administrators, and running the AD FS service under a Group Managed Service Account or a long, complex password. Treat federation certificates, application credentials and service accounts as top-tier assets: inventory them, alert when certificates or secrets are added to applications, and rotate signing material after any suspected server compromise. See the AD FS Security Guide and the MITRE ATT&CK T1606 Forge Web Credentials Guide.
How to put this hub to work
- Filter by your threat model: use the groups column to pick the families linked to actors that target your sector and region, and the platforms column to drop what you do not run.
- Cover the shared core first: build or validate analytics for the top techniques in the table above before writing family-specific rules.
- Protect the crown jewel servers: AD FS, Exchange, domain controllers and management servers get module load monitoring, restricted administration and configuration baselines.
- Hunt on a schedule: run monthly hunts for masquerading persistence, rare destinations and staging, starting on a pilot set of servers and widening once false positive rates are known.
- Plan the response: espionage findings need scoping before eviction. Preserve memory and logs, identify every implant family, then contain and rotate credentials and certificates together so the actor cannot fall back to a second implant.
Measuring coverage
- Share of the top 15 hub techniques with at least one tested analytic.
- Percentage of AD FS, Exchange and domain controller servers with module load and configuration change monitoring.
- Days of proxy and DNS log retention available for retrospective hunts.
- Number of monthly hunts completed and leads closed.
- Time to rotate federation signing certificates and application credentials after a confirmed server compromise.
Framework mapping
| Framework | Reference | Relevance to this family |
|---|---|---|
| ATT&CK v20 | T1071, T1102, T1105 (Command and Control); T1547, T1036; T1027, T1070; T1560, T1041; T1606.002 SAML Tokens | The shared behaviours and the federation abuse that follows |
| NIST SP 800-53 Rev 5 | SI-4 System Monitoring; SI-3 Malicious Code Protection; SC-7 Boundary Protection; AU-6 Audit Record Review, Analysis, and Reporting; IR-4 Incident Handling | Monitoring, egress control and coordinated response |
| NIST CSF 2.0 | DE.CM-01, DE.CM-09, DE.AE-02, RS.AN-03 | Network and host monitoring, analysis and root cause |
| CIS Controls v8.1 | Control 8 Audit Log Management; Control 10 Malware Defenses; Control 13 Network Monitoring and Defense | Logging, anti-malware and network detection |
| ISO/IEC 27001:2022 Annex A | A.5.7 Threat intelligence; A.8.7 Protection against malware; A.8.16 Monitoring activities | Using threat intelligence to drive monitoring |
Common failure patterns
- Indicator-only hunting: sweeping for published hashes and domains from one report when the family is rebuilt per victim.
- Unmonitored identity servers: treating AD FS and Exchange as infrastructure rather than as high-value targets with their own detection.
- Evicting too early: removing the first implant found and alerting the actor, who returns through a second family.
- Rotating passwords but not certificates: resetting user passwords after an intrusion while token-signing certificates and application secrets stay the same.
- Short log retention: keeping proxy and DNS logs for days when espionage dwell time is measured in months.
Complete catalogue: espionage backdoors and implants A to L in ATT&CK v20
All 156 entries in this half (156 malware, 0 tools), sorted by name. Groups are those ATT&CK v20 links to the software (up to four shown); distinctive techniques are the member's mapped techniques that are least common across this hub. Each ID links to its ATT&CK page.
| ID | Name | Type | Platforms | Associated groups (v20) | Distinctive techniques |
|---|---|---|---|---|---|
| S0202 | adbupd | Malware | Windows | PLATINUM | T1546 Event Triggered Execution, T1573 Encrypted Channel |
| S0045 | ADVSTORESHELL | Malware | Windows | APT28 | T1029 Scheduled Transfer, T1120 Peripheral Device Discovery |
| S0331 | Agent Tesla | Malware | Windows | SilverTerrier, TA2541 | T1185 Browser Session Hijacking, T1203 Exploitation for Client Execution |
| S1025 | Amadey | Malware | Windows | Kimsuky, TA505 | T1614 System Location Discovery, T1568 Dynamic Resolution |
| S0504 | Anchor | Malware | Linux, Windows | Wizard Spider | T1569 System Services, T1021 Remote Services |
| S1074 | ANDROMEDA | Malware | Windows | Campaign: C0026 | T1091 Replication Through Removable Media, T1055 Process Injection |
| S0622 | AppleSeed | Malware | Windows, Android | Kimsuky | T1030 Data Transfer Size Limits, T1025 Data from Removable Media |
| S0456 | Aria-body | Malware | Windows | Naikon | T1568 Dynamic Resolution, T1025 Data from Removable Media |
| S9031 | AshTag | Malware | Windows | WIRTE | T1678 Delay Execution, T1614 System Location Discovery |
| S0438 | Attor | Malware | Windows | No group linked in v20 | T1129 Shared Modules, T1020 Automated Exfiltration |
| S0347 | AuditCred | Malware | Windows | Lazarus Group | T1090 Proxy, T1543 Create or Modify System Process |
| S0129 | AutoIt backdoor | Malware | Windows | APT33, Patchwork | T1548 Abuse Elevation Control Mechanism, T1132 Data Encoding |
| S0344 | Azorult | Malware | Windows | TA505 | T1552 Unsecured Credentials, T1134 Access Token Manipulation |
| S0414 | BabyShark | Malware | Windows | Kimsuky | T1132 Data Encoding, T1218 System Binary Proxy Execution |
| S0475 | BackConfig | Malware | Windows | Patchwork | T1137 Office Application Startup, T1553 Subvert Trust Controls |
| S0093 | Backdoor.Oldrea | Malware | Windows | Dragonfly | T1046 Network Service Discovery, T1018 Remote System Discovery |
| S0031 | BACKSPACE | Malware | Windows | APT30 | T1104 Multi-Stage Channels, T1686 Disable or Modify System Firewall |
| S9045 | BACKUPOSINT v9.0 APEX PREDATOR | Malware | Linux, Windows, IaaS, Containers | Campaign: AI-Assisted Breach of Mexico's Government Infrastructure | T1609 Container Administration Command, T1528 Steal Application Access Token |
| S0245 | BADCALL | Malware | Windows | Lazarus Group | T1686 Disable or Modify System Firewall, T1571 Non-Standard Port |
| S0642 | BADFLICK | Malware | Windows | Leviathan | T1566 Phishing, T1204 User Execution |
| S1081 | BADHATCH | Malware | Windows | FIN8 | T1482 Domain Trust Discovery, T1620 Reflective Code Loading |
| S0128 | BADNEWS | Malware | Windows | Patchwork | T1039 Data from Network Shared Drive, T1025 Data from Removable Media |
| S0337 | BadPatch | Malware | Windows | No group linked in v20 | T1497 Virtualization/Sandbox Evasion, T1518 Software Discovery |
| S0574 | BendyBear | Malware | Windows | No group linked in v20 | T1571 Non-Standard Port, T1001 Data Obfuscation |
| S0017 | BISCUIT | Malware | Windows | APT1 | T1008 Fallback Channels, T1124 System Time Discovery |
| S0069 | BLACKCOFFEE | Malware | Windows | APT17, APT41, Leviathan | T1104 Multi-Stage Channels, T1102 Web Service |
| S0360 | BONDUPDATER | Malware | Windows | OilRig | T1568 Dynamic Resolution, T1564 Hide Artifacts |
| S1226 | BOOKWORM | Malware | Windows | Mustang Panda | T1553 Subvert Trust Controls, T1115 Clipboard Data |
| S0651 | BoxCaon | Malware | Windows | IndigoZebra | T1567 Exfiltration Over Web Service, T1102 Web Service |
| S0252 | Brave Prince | Malware | Windows | Kimsuky | T1048 Exfiltration Over Alternative Protocol, T1685 Disable or Modify Tools |
| S0204 | Briba | Malware | Windows | Elderwood | T1218 System Binary Proxy Execution, T1543 Create or Modify System Process |
| S0014 | BS2005 | Malware | Windows | No group linked in v20 | T1132 Data Encoding |
| S0043 | BUBBLEWRAP | Malware | Windows | admin@338 | T1095 Non-Application Layer Protocol, T1082 System Information Discovery |
| S0454 | Cadelspy | Malware | Windows | APT39 | T1010 Application Window Discovery, T1123 Audio Capture |
| S0025 | CALENDAR | Malware | Windows | APT1 | T1102 Web Service, T1059 Command and Scripting Interpreter |
| S0351 | Cannon | Malware | Windows | APT28 | T1680 Local Storage Discovery, T1124 System Time Discovery |
| S0030 | Carbanak | Malware | Windows | Carbanak, FIN7 | T1219 Remote Access Tools, T1136 Create Account |
| S0484 | Carberp | Malware | Windows | No group linked in v20 | T1014 Rootkit, T1542 Pre-OS Boot |
| S0335 | Carbon | Malware | Windows | Turla | T1018 Remote System Discovery, T1048 Exfiltration Over Alternative Protocol |
| S0261 | Catchamas | Malware | Windows | Thrip | T1010 Application Window Discovery, T1115 Clipboard Data |
| S0222 | CCBkdr | Malware | Windows | No group linked in v20 | T1195 Supply Chain Compromise, T1568 Dynamic Resolution |
| S1043 | ccf32 | Malware | Windows | Campaign: FunnyDream | T1048 Exfiltration Over Alternative Protocol, T1119 Automated Collection |
| S0674 | CharmPower | Malware | Windows | Magic Hound | T1048 Exfiltration Over Alternative Protocol, T1008 Fallback Channels |
| S0144 | ChChes | Malware | Windows | menuPass | T1553 Subvert Trust Controls, T1685 Disable or Modify Tools |
| S0107 | Cherry Picker | Malware | Windows | No group linked in v20 | T1048 Exfiltration Over Alternative Protocol, T1546 Event Triggered Execution |
| S1041 | Chinoxy | Malware | Windows | Campaign: FunnyDream | T1574 Hijack Execution Flow, T1036 Masquerading |
| S0023 | CHOPSTICK | Malware | Windows, Linux | APT28 | T1092 Communication Through Removable Media, T1091 Replication Through Removable Media |
| S0667 | Chrommme | Malware | Windows | No group linked in v20 | T1029 Scheduled Transfer, T1680 Local Storage Discovery |
| S1236 | CLAIMLOADER | Malware | Windows | Mustang Panda | T1559 Inter-Process Communication, T1480 Execution Guardrails |
| S0660 | Clambling | Malware | Windows | Threat Group-3390 | T1548 Abuse Elevation Control Mechanism, T1569 System Services |
| S0054 | CloudDuke | Malware | Windows | APT29 | T1102 Web Service, T1105 Ingress Tool Transfer |
| S0244 | Comnie | Malware | Windows | No group linked in v20 | T1018 Remote System Discovery, T1049 System Network Connections Discovery |
| S0126 | ComRAT | Malware | Windows | Turla | T1029 Scheduled Transfer, T1546 Event Triggered Execution |
| S0212 | CORALDECK | Malware | Windows | APT37 | T1048 Exfiltration Over Alternative Protocol, T1560 Archive Collected Data |
| S1235 | CorKLOG | Malware | Windows | Mustang Panda | T1553 Subvert Trust Controls, T1574 Hijack Execution Flow |
| S0050 | CosmicDuke | Malware | Windows | APT29 | T1039 Data from Network Shared Drive, T1068 Exploitation for Privilege Escalation |
| S0046 | CozyCar | Malware | Windows | APT29 | T1003 OS Credential Dumping, T1497 Virtualization/Sandbox Evasion |
| S9057 | CRASHPAD | Malware | Windows | NIMBUS MANTICORE | T1134 Access Token Manipulation, T1555 Credentials from Password Stores |
| S1023 | CreepyDrive | Malware | Windows, Office Suite | POLONIUM | T1550 Use Alternate Authentication Material, T1567 Exfiltration Over Web Service |
| S1024 | CreepySnail | Malware | Windows | POLONIUM | T1078 Valid Accounts, T1132 Data Encoding |
| S0538 | Crutch | Malware | Windows | Turla | T1020 Automated Exfiltration, T1025 Data from Removable Media |
| S0334 | DarkComet | Malware | Windows | APT38, SilverTerrier, Transparent Tribe | T1021 Remote Services, T1125 Video Capture |
| S0187 | Daserf | Malware | Windows | BRONZE BUTLER | T1003 OS Credential Dumping, T1553 Subvert Trust Controls |
| S9065 | DCSYNCER.SLICK | Malware | Windows | NIMBUS MANTICORE | T1003 OS Credential Dumping, T1574 Hijack Execution Flow |
| S0255 | DDKONG | Malware | Not stated | Rancor | T1218 System Binary Proxy Execution, T1140 Deobfuscate/Decode Files or Information |
| S1052 | DEADEYE | Malware | Windows | Campaign: C0017 | T1480 Execution Guardrails, T1564 Hide Artifacts |
| S0243 | DealersChoice | Malware | Windows | APT28 | T1203 Exploitation for Client Execution, T1059 Command and Scripting Interpreter |
| S0354 | Denis | Malware | Windows | APT32 | T1574 Hijack Execution Flow, T1497 Virtualization/Sandbox Evasion |
| S0021 | Derusbi | Malware | Windows, Linux | APT41, Axiom, Deep Panda, Leviathan | T1125 Video Capture, T1123 Audio Capture |
| S0200 | Dipsind | Malware | Windows | PLATINUM | T1029 Scheduled Transfer, T1132 Data Encoding |
| S1088 | Disco | Malware | Windows | MoustachedBouncer | T1659 Content Injection, T1204 User Execution |
| S1021 | DnsSystem | Malware | Windows | HEXANE | T1204 User Execution, T1132 Data Encoding |
| S0213 | DOGCALL | Malware | Windows | APT37 | T1123 Audio Capture, T1102 Web Service |
| S0186 | DownPaper | Malware | Windows | Magic Hound | T1012 Query Registry, T1033 System Owner/User Discovery |
| S0547 | DropBook | Malware | Windows | Molerats | T1614 System Location Discovery, T1567 Exfiltration Over Web Service |
| S0567 | Dtrack | Malware | Windows | Lazarus Group | T1217 Browser Information Discovery, T1129 Shared Modules |
| S0038 | Duqu | Malware | Windows | No group linked in v20 | T1078 Valid Accounts, T1021 Remote Services |
| S1159 | DUSTTRAP | Malware | Windows | APT41 | T1654 Log Enumeration, T1482 Domain Trust Discovery |
| S0062 | DustySky | Malware | Windows | Molerats | T1570 Lateral Tool Transfer, T1091 Replication Through Removable Media |
| S0081 | Elise | Malware | Windows | Lotus Blossom | T1007 System Service Discovery, T1087 Account Discovery |
| S0064 | ELMER | Malware | Windows | APT16 | T1057 Process Discovery, T1083 File and Directory Discovery |
| S0082 | Emissary | Malware | Windows | Lotus Blossom | T1615 Group Policy Discovery, T1069 Permission Groups Discovery |
| S0091 | Epic | Malware | Windows | Turla | T1018 Remote System Discovery, T1049 System Network Connections Discovery |
| S0396 | EvilBunny | Malware | Windows | No group linked in v20 | T1203 Exploitation for Client Execution, T1047 Windows Management Instrumentation |
| S0152 | EvilGrab | Malware | Windows | menuPass | T1125 Video Capture, T1123 Audio Capture |
| S0568 | EVILNUM | Malware | Windows | Evilnum | T1539 Steal Web Session Cookie, T1047 Windows Management Instrumentation |
| S0343 | Exaramel for Windows | Malware | Windows | Sandworm Team | T1112 Modify Registry, T1543 Create or Modify System Process |
| S1179 | Exbyte | Malware | Windows | BlackByte | T1480 Execution Guardrails, T1567 Exfiltration Over Web Service |
| S0076 | FakeM | Malware | Windows | Scarlet Mimic | T1095 Non-Application Layer Protocol, T1001 Data Obfuscation |
| S0512 | FatDuke | Malware | Windows | APT29 | T1008 Fallback Channels, T1497 Virtualization/Sandbox Evasion |
| S0171 | Felismus | Malware | Windows | Sowbug | T1132 Data Encoding, T1518 Software Discovery |
| S0267 | FELIXROOT | Malware | Windows | No group linked in v20 | T1680 Local Storage Discovery, T1047 Windows Management Instrumentation |
| S0679 | Ferocious | Malware | Windows | WIRTE | T1120 Peripheral Device Discovery, T1546 Event Triggered Execution |
| S0182 | FinFisher | Malware | Windows, Android | Dark Caracal | T1542 Pre-OS Boot, T1548 Abuse Elevation Control Mechanism |
| S0143 | Flame | Malware | Windows | No group linked in v20 | T1011 Exfiltration Over Other Network Medium, T1210 Exploitation of Remote Services |
| S0036 | FLASHFLOOD | Malware | Windows | APT30 | T1025 Data from Removable Media, T1560 Archive Collected Data |
| S0173 | FLIPSIDE | Malware | Windows | FIN5 | T1572 Protocol Tunneling |
| S0661 | FoggyWeb | Malware | Windows | APT29 | T1040 Network Sniffing, T1620 Reflective Code Loading |
| S0503 | FrameworkPOS | Malware | Not stated | FIN6 | T1048 Exfiltration Over Alternative Protocol, T1560 Archive Collected Data |
| S1044 | FunnyDream | Malware | Windows | Campaign: FunnyDream | T1559 Inter-Process Communication, T1025 Data from Removable Media |
| S0168 | Gazer | Malware | Windows | Turla | T1480 Execution Guardrails, T1546 Event Triggered Execution |
| S0049 | GeminiDuke | Malware | Windows | APT29 | T1007 System Service Discovery, T1087 Account Discovery |
| S0026 | GLOOXMAIL | Malware | Windows | APT1 | T1102 Web Service, T1071 Application Layer Protocol |
| S0249 | Gold Dragon | Malware | Windows | Kimsuky | T1685 Disable or Modify Tools, T1518 Software Discovery |
| S0493 | GoldenSpy | Malware | Windows | No group linked in v20 | T1195 Supply Chain Compromise, T1136 Create Account |
| S0597 | GoldFinder | Malware | Windows | APT29 | T1119 Automated Collection, T1016 System Network Configuration Discovery |
| S0588 | GoldMax | Malware | Windows, Linux | APT29 | T1001 Data Obfuscation, T1564 Hide Artifacts |
| S0477 | Goopy | Malware | Windows | APT32 | T1685 Disable or Modify Tools, T1574 Hijack Execution Flow |
| S0690 | Green Lambert | Malware | Windows, iOS, macOS, Linux | No group linked in v20 | T1037 Boot or Logon Initialization Scripts, T1546 Event Triggered Execution |
| S0342 | GreyEnergy | Malware | Windows | Sandworm Team | T1003 OS Credential Dumping, T1553 Subvert Trust Controls |
| S0417 | GRIFFON | Malware | Windows | FIN7 | T1069 Permission Groups Discovery, T1124 System Time Discovery |
| S0151 | HALFBAKED | Malware | Not stated | FIN7 | T1047 Windows Management Instrumentation, T1113 Screen Capture |
| S0037 | HAMMERTOSS | Malware | Windows | APT29 | T1567 Exfiltration Over Web Service, T1001 Data Obfuscation |
| S1211 | Hannotog | Malware | Windows | Lotus Blossom | T1489 Service Stop, T1020 Automated Exfiltration |
| S0246 | HARDRAIN | Malware | Windows | Lazarus Group | T1686 Disable or Modify System Firewall, T1571 Non-Standard Port |
| S0391 | HAWKBALL | Malware | Windows | No group linked in v20 | T1203 Exploitation for Client Execution, T1559 Inter-Process Communication |
| S0061 | HDoor | Malware | Windows | Naikon | T1046 Network Service Discovery, T1685 Disable or Modify Tools |
| S0170 | Helminth | Malware | Windows | OilRig | T1030 Data Transfer Size Limits, T1069 Permission Groups Discovery |
| S1027 | Heyoka Backdoor | Malware | Windows | Aoqin Dragon | T1572 Protocol Tunneling, T1120 Peripheral Device Discovery |
| S9023 | HiddenFace | Malware | Windows | MirrorFace | T1568 Dynamic Resolution, T1480 Execution Guardrails |
| S0232 | HOMEFRY | Malware | Windows | Leviathan | T1003 OS Credential Dumping, T1027 Obfuscated Files or Information |
| S0376 | HOPLIGHT | Malware | Windows | APT38, Lazarus Group | T1652 Device Driver Discovery, T1550 Use Alternate Authentication Material |
| S0070 | HTTPBrowser | Malware | Windows | APT18, Threat Group-3390 | T1574 Hijack Execution Flow, T1056 Input Capture |
| S0068 | httpclient | Malware | Windows | Putter Panda | T1573 Encrypted Channel, T1059 Command and Scripting Interpreter |
| S0203 | Hydraq | Malware | Windows | Axiom, Elderwood | T1129 Shared Modules, T1569 System Services |
| S0398 | HyperBro | Malware | Windows | Threat Group-3390 | T1569 System Services, T1007 System Service Discovery |
| S0537 | HyperStack | Malware | Windows | Turla | T1078 Valid Accounts, T1559 Inter-Process Communication |
| S0604 | Industroyer | Malware | Windows | Sandworm Team | T1499 Endpoint Denial of Service, T1554 Compromise Host Software Binary |
| S1072 | Industroyer2 | Malware | Field Controller/RTU/PLC/IED, Engineering Workstation | Sandworm Team | T1057 Process Discovery |
| S1245 | InvisibleFerret | Malware | Linux, macOS, Windows | Contagious Interview | T1657 Financial Theft, T1679 Selective Exclusion |
| S0189 | ISMInjector | Malware | Windows | OilRig | T1053 Scheduled Task/Job, T1055 Process Injection |
| S0015 | Ixeshe | Malware | Windows | APT12 | T1007 System Service Discovery, T1564 Hide Artifacts |
| S0044 | JHUHUGIT | Malware | Windows | APT28 | T1068 Exploitation for Privilege Escalation, T1037 Boot or Logon Initialization Scripts |
| S0201 | JPIN | Malware | Windows | PLATINUM | T1197 BITS Jobs, T1222 File and Directory Permissions Modification |
| S0283 | jRAT | Malware | Linux, Windows, macOS, Android | TA2541 | T1037 Boot or Logon Initialization Scripts, T1552 Unsecured Credentials |
| S9044 | Kali365 | Malware | IaaS, macOS, Windows | No group linked in v20 | T1557 Adversary-in-the-Middle, T1528 Steal Application Access Token |
| S1190 | Kapeka | Malware | Windows | Sandworm Team | T1090 Proxy, T1112 Modify Registry |
| S0215 | KARAE | Malware | Windows | APT37 | T1189 Drive-by Compromise, T1102 Web Service |
| S0088 | Kasidet | Malware | Windows | No group linked in v20 | T1686 Disable or Modify System Firewall, T1518 Software Discovery |
| S0265 | Kazuar | Malware | Windows, macOS | Turla | T1485 Data Destruction, T1029 Scheduled Transfer |
| S1020 | Kevin | Malware | Windows | HEXANE | T1030 Data Transfer Size Limits, T1572 Protocol Tunneling |
| S0387 | KeyBoy | Malware | Windows | Tropic Trooper | T1559 Inter-Process Communication, T1555 Credentials from Password Stores |
| S0271 | KEYMARBLE | Malware | Windows | Lazarus Group | T1680 Local Storage Discovery, T1112 Modify Registry |
| S1051 | KEYPLUG | Malware | Linux, Windows | APT41 | T1095 Non-Application Layer Protocol, T1124 System Time Discovery |
| S0526 | KGH_SPY | Malware | Windows | Kimsuky | T1037 Boot or Logon Initialization Scripts, T1114 Email Collection |
| S0156 | KOMPROGO | Malware | Windows | APT32 | T1047 Windows Management Instrumentation, T1082 System Information Discovery |
| S1075 | KOPILUWAK | Malware | Windows | Turla | T1135 Network Share Discovery, T1566 Phishing |
| S0236 | Kwampirs | Malware | Windows | Orangeworm | T1201 Password Policy Discovery, T1021 Remote Services |
| S0395 | LightNeuron | Malware | Windows, Linux | Turla | T1505 Server Software Component, T1565 Data Manipulation |
| S9061 | LIGHTRAIL | Malware | Windows | NIMBUS MANTICORE | T1572 Protocol Tunneling, T1001 Data Obfuscation |
| S9020 | LODEINFO | Malware | Windows | MirrorFace | T1486 Data Encrypted for Impact, T1539 Steal Web Session Cookie |
| S1101 | LoFiSe | Malware | Windows | ToddyCat | T1119 Automated Collection, T1574 Hijack Execution Flow |
| S0042 | LOWBALL | Malware | Windows | admin@338 | T1102 Web Service, T1105 Ingress Tool Transfer |
| S1142 | LunarMail | Malware | Windows | Turla | T1137 Office Application Startup, T1114 Email Collection |
| S1141 | LunarWeb | Malware | Windows | Turla | T1104 Multi-Stage Channels, T1615 Group Policy Discovery |
| S0010 | Lurid | Malware | Windows | PittyTiger | T1560 Archive Collected Data, T1573 Encrypted Channel |
Continue with the ATT&CK Espionage Backdoors and Implants (M to Z) Software Hub. Related software hubs: ATT&CK C2 and Post-Exploitation Frameworks Software Hub and ATT&CK Rootkits and Bootkits Software Hub.
Practitioner checklist
- Shortlist the families linked to actors in your threat model and the platforms you run.
- Validate analytics for the top shared techniques before writing family-specific rules.
- Monitor module loads and configuration changes on AD FS, Exchange and domain controllers.
- Store federation signing keys in an HSM and alert on new application certificates or secrets.
- Hunt monthly for masquerading persistence, rare web destinations and data staging.
- Keep proxy, DNS and identity logs long enough for retrospective hunts.
- Scope fully before eviction and rotate credentials and certificates in one coordinated step.
- Monitor OT networks for substation protocol traffic from unexpected hosts.
Standards and references
- MITRE ATT&CK: Software
- MITRE ATT&CK: FoggyWeb (S0661)
- Microsoft: FoggyWeb, targeted NOBELIUM malware leads to persistent backdoor
- Microsoft: GoldMax, GoldFinder, and Sibot, analyzing NOBELIUM's layered persistence
- ESET: Industroyer2, Industroyer reloaded
- MITRE ATT&CK: Turla (G0010)
- NIST: SP 800-53 Rev 5 Security and Privacy Controls
Related NHI Mgmt Group resources: BRICKSTORM Backdoor Guide · Golden SAML and Federation Trust Abuse Defence Guide · Turla Threat Actor Profile · Command and Control (C2) Guide