modified: 2024-11-17T14:43:38.591Z
name: JHUHUGIT
description: [JHUHUGIT](https://attack.mitre.org/software/S0044) is malware used by [APT28](https://attack.mitre.org/groups/G0007). It is based on Carberp source code and serves as reconnaissance malware. (Citation: Kaspersky Sofacy) (Citation: F-Secure Sofacy 2015) (Citation: ESET Sednit Part 1) (Citation: FireEye APT28 January 2017)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.2
x_mitre_aliases: JHUHUGIT
Trojan.Sofacy
Seduploader
JKEYSKW
Sednit
GAMEFISH
SofacyCarberp
type: malware
spec_version: 2.1
id: malware--8ae43c46-57ef-47d5-a77a-eebb35628db2
created: 2017-05-31T21:32:34.199Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0044
external_id: S0044
source_name: JHUHUGIT
description: (Citation: FireEye APT28 January 2017)
source_name: JKEYSKW
description: (Citation: FireEye APT28 January 2017)
source_name: GAMEFISH
description: (Citation: FireEye APT28 January 2017)
source_name: Seduploader
description: (Citation: FireEye APT28 January 2017)(Citation: Talos Seduploader Oct 2017)
source_name: SofacyCarberp
description: (Citation: Unit 42 Sofacy Feb 2018)
source_name: ESET Sednit Part 1
description: ESET. (2016, October). En Route with Sednit - Part 1: Approaching the Target. Retrieved November 8, 2016.
url: http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part1.pdf
source_name: F-Secure Sofacy 2015
description: F-Secure. (2015, September 8). Sofacy Recycles Carberp and Metasploit Code. Retrieved August 3, 2016.
url: https://labsblog.f-secure.com/2015/09/08/sofacy-recycles-carberp-and-metasploit-code/
source_name: FireEye APT28 January 2017
description: FireEye iSIGHT Intelligence. (2017, January 11). APT28: At the Center of the Storm. Retrieved November 17, 2024.
url: https://www.mandiant.com/sites/default/files/2021-09/APT28-Center-of-Storm-2017.pdf
source_name: Kaspersky Sofacy
description: Kaspersky Lab's Global Research and Analysis Team. (2015, December 4). Sofacy APT hits high profile targets with updated toolset. Retrieved December 10, 2015.
url: https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/
source_name: Unit 42 Sofacy Feb 2018
description: Lee, B, et al. (2018, February 28). Sofacy Attacks Multiple Government Entities. Retrieved March 15, 2018.
url: https://researchcenter.paloaltonetworks.com/2018/02/unit42-sofacy-attacks-multiple-government-entities/
source_name: Talos Seduploader Oct 2017
description: Mercer, W., et al. (2017, October 22). "Cyber Conflict" Decoy Document Used in Real Cyber Conflict. Retrieved November 2, 2018.
url: https://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html
source_name: Symantec APT28 Oct 2018
description: Symantec Security Response. (2018, October 04). APT28: New Espionage Operations Target Military and Government Organizations. Retrieved November 14, 2018.
url: https://www.symantec.com/blogs/election-security/apt28-espionage-military-government
source_name: Sednit
description: This designation has been used in reporting both to refer to the threat group ([APT28](https://attack.mitre.org/groups/G0007)) and its associated malware.(Citation: FireEye APT28 January 2017)
source_name: Trojan.Sofacy
description: This designation has been used in reporting both to refer to the threat group ([Skeleton Key](https://attack.mitre.org/software/S0007)) and its associated malware.(Citation: Symantec APT28 Oct 2018)
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5