auren-research/cyber-sec huggingface dataset:
type: malware
spec_version: 2.1
id: malware--f931a0b9-0361-4b1b-bacf-955062c35746
created: 2021-08-13T14:57:39.387Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0639
external_id: S0639
source_name: Trend Micro Ransomware February 2021
description: Centero, R. et al. (2021, February 5). New in Ransomware: Seth-Locker, Babuk Locker, Maoloa, TeslaCrypt, and CobraLocker. Retrieved August 11, 2021.
url: https://www.trendmicro.com/en_us/research/21/b/new-in-ransomware.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:45:07.890Z
name: Seth-Locker
description: [Seth-Locker](https://attack.mitre.org/software/S0639) is a ransomware with some remote control capabilities that has been in use since at least 2021.
(Citation: Trend Micro Ransomware February 2021)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: Seth-Locker
modified: 2024-04-11T01:36:42.906Z
name: LoudMiner
description: [LoudMiner](https://attack.mitre.org/software/S0451) is a cryptocurrency miner which uses virtualization software to siphon system resources. The miner has been bundled with pirated copies of Virtual Studio Technology (VST) for Windows and macOS.(Citation: ESET LoudMiner June 2019)
is_family: yes
x_mitre_platforms: macOS
Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.4
x_mitre_aliases: LoudMiner
type: malware
spec_version: 2.1
id: malware--f99f3dcc-683f-4936-8791-075ac5e58f10
created: 2020-05-18T21:01:51.045Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0451
external_id: S0451
source_name: ESET LoudMiner June 2019
description: Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.
url: https://www.welivesecurity.com/2019/06/20/loudminer-mining-cracked-vst-software/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: malware
spec_version: 2.1
id: malware--f9b05f33-d45d-4e4d-aafe-c208d38a0080
created: 2019-01-30T15:19:14.309Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0344
external_id: S0344
source_name: Azorult
description: (Citation: Unit42 Azorult Nov 2018)(Citation: Proofpoint Azorult July 2018)
source_name: Proofpoint Azorult July 2018
description: Proofpoint. (2018, July 30). New version of AZORult stealer improves loading features, spreads alongside ransomware in new campaign. Retrieved November 29, 2018.
url: https://www.proofpoint.com/us/threat-insight/post/new-version-azorult-stealer-improves-loading-features-spreads-alongside
source_name: Unit42 Azorult Nov 2018
description: Yan, T., et al. (2018, November 21). New Wine in Old Bottle: New Azorult Variant Found in FindMyName Campaign using Fallout Exploit Kit. Retrieved November 29, 2018.
url: https://researchcenter.paloaltonetworks.com/2018/11/unit42-new-wine-old-bottle-new-azorult-variant-found-findmyname-campaign-using-fallout-exploit-kit/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:38:44.780Z
name: Azorult
description: [Azorult](https://attack.mitre.org/software/S0344) is a commercial Trojan that is used to steal information from compromised hosts. [Azorult](https://attack.mitre.org/software/S0344) has been observed in the wild as early as 2016.
In July 2018, [Azorult](https://attack.mitre.org/software/S0344) was seen used in a spearphishing campaign against targets in North America. [Azorult](https://attack.mitre.org/software/S0344) has been seen used for cryptocurrency theft. (Citation: Unit42 Azorult Nov 2018)(Citation: Proofpoint Azorult July 2018)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.3
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: Azorult
modified: 2024-04-11T02:52:57.879Z
name: BitPaymer
description: [BitPaymer](https://attack.mitre.org/software/S0570) is a ransomware variant first observed in August 2017 targeting hospitals in the U.K. [BitPaymer](https://attack.mitre.org/software/S0570) uses a unique encryption key, ransom note, and contact information for each operation. [BitPaymer](https://attack.mitre.org/software/S0570) has several indicators suggesting overlap with the [Dridex](https://attack.mitre.org/software/S0384) malware and is often delivered via [Dridex](https://attack.mitre.org/software/S0384).(Citation: Crowdstrike Indrik November 2018)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_aliases: BitPaymer
wp_encrypt
FriedEx
type: malware
spec_version: 2.1
id: malware--fa766a65-5136-4ff3-8429-36d08eaa0100
created: 2021-02-08T22:19:19.340Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0570
external_id: S0570
source_name: BitPaymer
description: (Citation: Crowdstrike Indrik November 2018)
source_name: wp_encrypt
description: (Citation: Crowdstrike Indrik November 2018)
source_name: FriedEx
description: (Citation: Crowdstrike Indrik November 2018)
source_name: Crowdstrike Indrik November 2018
description: Frankoff, S., Hartley, B. (2018, November 14). Big Game Hunting: The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware. Retrieved January 6, 2021.
url: https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-11-17T15:05:25.109Z
name: BACKSPACE
description: [BACKSPACE](https://attack.mitre.org/software/S0031) is a backdoor used by [APT30](https://attack.mitre.org/groups/G0013) that dates back to at least 2005. (Citation: FireEye APT30)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_aliases: BACKSPACE
Lecna
type: malware
spec_version: 2.1
id: malware--fb261c56-b80e-43a9-8351-c84081e7213d
created: 2017-05-31T21:32:24.428Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0031
external_id: S0031
source_name: FireEye APT30
description: FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved November 17, 2024.
url: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-04-10T20:30:02.520Z
name: Zox
description: [Zox](https://attack.mitre.org/software/S0672) is a remote access tool that has been used by [Axiom](https://attack.mitre.org/groups/G0001) since at least 2008.(Citation: Novetta-Axiom)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_aliases: Zox
Gresim
ZoxRPC
ZoxPNG
type: malware
spec_version: 2.1
id: malware--fb28627c-d6ea-4c35-b138-ab5e96ae5445
created: 2022-01-09T22:02:05.615Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0672
external_id: S0672
source_name: Gresim
description: (Citation: Novetta-Axiom)
source_name: ZoxRPC
description: (Citation: Novetta-Axiom)
source_name: ZoxPNG
description: (Citation: Novetta-Axiom)
source_name: Novetta-Axiom
description: Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
url: https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: malware
spec_version: 2.1
id: malware--fb4e3792-e915-4fdd-a9cd-92dfa2ace7aa
created: 2018-10-17T00:14:20.652Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0275
external_id: S0275
source_name: UPPERCUT
description: (Citation: FireEye APT10 Sept 2018)
source_name: ANEL
description: (Citation: FireEye APT10 Sept 2018)
source_name: FireEye APT10 Sept 2018
description: Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.
url: https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:45:09.125Z
name: UPPERCUT
description: [UPPERCUT](https://attack.mitre.org/software/S0275) is a backdoor that has been used by [menuPass](https://attack.mitre.org/groups/G0045). (Citation: FireEye APT10 Sept 2018)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: UPPERCUT
ANEL
type: malware
spec_version: 2.1
id: malware--fb575479-14ef-41e9-bfab-0b7cf10bec73
created: 2017-05-31T21:32:34.648Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0045
external_id: S0045
source_name: Kaspersky Sofacy
description: Kaspersky Lab's Global Research and Analysis Team. (2015, December 4). Sofacy APT hits high profile targets with updated toolset. Retrieved December 10, 2015.
url: https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/
source_name: ESET Sednit Part 2
description: ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.
url: http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:45:09.488Z
name: ADVSTORESHELL
description: [ADVSTORESHELL](https://attack.mitre.org/software/S0045) is a spying backdoor that has been used by [APT28](https://attack.mitre.org/groups/G0007) from at least 2012 to 2016. It is generally used for long-term espionage and is deployed on targets deemed interesting after a reconnaissance phase. (Citation: Kaspersky Sofacy) (Citation: ESET Sednit Part 2)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: ADVSTORESHELL
AZZY
EVILTOSS
NETUI
Sedreco
type: malware
spec_version: 2.1
id: malware--fb78294a-7d7a-4d38-8ad0-92e67fddc9f0
created: 2022-08-15T16:31:56.856Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1034
external_id: S1034
source_name: Cybereason StrifeWater Feb 2022
description: Cybereason Nocturnus. (2022, February 1). StrifeWater RAT: Iranian APT Moses Staff Adds New Trojan to Ransomware Operations. Retrieved August 15, 2022.
url: https://www.cybereason.com/blog/research/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-06-06T14:56:56.321Z
name: StrifeWater
description: [StrifeWater](https://attack.mitre.org/software/S1034) is a remote-access tool that has been used by [Moses Staff](https://attack.mitre.org/groups/G1009) in the initial stages of their attacks since at least November 2021.(Citation: Cybereason StrifeWater Feb 2022)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: StrifeWater
type: malware
spec_version: 2.1
id: malware--fbb470da-1d44-4f29-bbb3-9efbe20f94a3
created: 2017-05-31T21:32:54.044Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0080
external_id: S0080
source_name: Mivast
description: (Citation: Symantec Black Vine) (Citation: Symantec Backdoor.Mivast)
source_name: Symantec Black Vine
description: DiMaggio, J.. (2015, August 6). The Black Vine cyberespionage group. Retrieved January 26, 2016.
url: https://web.archive.org/web/20170823094836/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-black-vine-cyberespionage-group.pdf
source_name: Symantec Backdoor.Mivast
description: Stama, D.. (2015, February 6). Backdoor.Mivast. Retrieved February 15, 2016.
url: http://www.symantec.com/security_response/writeup.jsp?docid=2015-020623-0740-99&tabid=2
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:38:45.394Z
name: Mivast
description: [Mivast](https://attack.mitre.org/software/S0080) is a backdoor that has been used by [Deep Panda](https://attack.mitre.org/groups/G0009). It was reportedly used in the Anthem breach. (Citation: Symantec Black Vine)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: Mivast
modified: 2024-04-11T02:19:50.306Z
name: HiddenWasp
description: [HiddenWasp](https://attack.mitre.org/software/S0394) is a Linux-based Trojan used to target systems for remote control. It comes in the form of a statically linked ELF binary with stdlibc++.(Citation: Intezer HiddenWasp Map 2019)
is_family: yes
x_mitre_platforms: Linux
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.3
x_mitre_aliases: HiddenWasp
type: malware
spec_version: 2.1
id: malware--fc774af4-533b-4724-96d2-ac1026316794
created: 2019-06-24T12:04:32.323Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0394
external_id: S0394
source_name: HiddenWasp
description: (Citation: Intezer HiddenWasp Map 2019)
source_name: Intezer HiddenWasp Map 2019
description: Sanmillan, I. (2019, May 29). HiddenWasp Malware Stings Targeted Linux Systems. Retrieved June 24, 2019.
url: https://www.intezer.com/blog-hiddenwasp-malware-targeting-linux-systems/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2023-10-03T19:33:26.976Z
name: WarzoneRAT
description: [WarzoneRAT](https://attack.mitre.org/software/S0670) is a malware-as-a-service remote access tool (RAT) written in C++ that has been publicly available for purchase since at least late 2018.(Citation: Check Point Warzone Feb 2020)(Citation: Uptycs Warzone UAC Bypass November 2020)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_contributors: Abhijit Mohanta, @abhijit_mohanta, Uptycs
Shilpesh Trivedi, Uptycs
x_mitre_aliases: WarzoneRAT
Warzone
Ave Maria
type: malware
spec_version: 2.1
id: malware--fde19a18-e502-467f-be14-58c71b4e7f4b
created: 2021-12-27T17:21:18.652Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0670
external_id: S0670
source_name: Ave Maria
description: (Citation: Check Point Warzone Feb 2020)(Citation: Uptycs Warzone UAC Bypass November 2020)
source_name: Check Point Warzone Feb 2020
description: Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.
url: https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/
source_name: Uptycs Warzone UAC Bypass November 2020
description: Mohanta, A. (2020, November 25). Warzone RAT comes with UAC bypass technique. Retrieved April 7, 2022.
url: https://www.uptycs.com/blog/warzone-rat-comes-with-uac-bypass-technique
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: malware
spec_version: 2.1
id: malware--fde50aaa-f5de-4cb8-989a-babb57d6a704
created: 2017-05-31T21:32:38.851Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0056
external_id: S0056
source_name: Cylance Cleaver
description: Cylance. (2014, December). Operation Cleaver. Retrieved September 14, 2017.
url: https://web.archive.org/web/20200302085133/https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:38:45.551Z
name: Net Crawler
description: [Net Crawler](https://attack.mitre.org/software/S0056) is an intranet worm capable of extracting credentials using credential dumpers and spreading to systems on a network over SMB by brute forcing accounts with recovered passwords and using [PsExec](https://attack.mitre.org/software/S0029) to execute a copy of [Net Crawler](https://attack.mitre.org/software/S0056). (Citation: Cylance Cleaver)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: Net Crawler
NetC
type: malware
spec_version: 2.1
id: malware--fece06b7-d4b1-42cf-b81a-5323c917546e
created: 2018-01-16T16:13:52.465Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0181
external_id: S0181
source_name: FALLCHILL
description: (Citation: US-CERT FALLCHILL Nov 2017)
source_name: US-CERT FALLCHILL Nov 2017
description: US-CERT. (2017, November 22). Alert (TA17-318A): HIDDEN COBRA – North Korean Remote Administration Tool: FALLCHILL. Retrieved December 7, 2017.
url: https://www.us-cert.gov/ncas/alerts/TA17-318A
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-22T02:30:54.011Z
name: FALLCHILL
description: [FALLCHILL](https://attack.mitre.org/software/S0181) is a RAT that has been used by [Lazarus Group](https://attack.mitre.org/groups/G0032) since at least 2016 to target the aerospace, telecommunications, and finance industries. It is usually dropped by other [Lazarus Group](https://attack.mitre.org/groups/G0032) malware or delivered when a victim unknowingly visits a compromised website. (Citation: US-CERT FALLCHILL Nov 2017)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.3
x_mitre_attack_spec_version: 3.3.0
x_mitre_aliases: FALLCHILL
type: malware
spec_version: 2.1
id: malware--fedd9fcd-1f9c-4be0-9d84-f31e88eb6664
created: 2025-10-22T17:23:53.186Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1248
external_id: S1248
source_name: Socket BeaverTail XORIndex HexEval Contagious Interview July 2025
description: Kirill Boychenko. (2025, July 14). Contagious Interview Campaign Escalates With 67 Malicious npm Packages and New Malware Loader. Retrieved October 19, 2025.
url: https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T02:59:41.127Z
name: XORIndex Loader
description: [XORIndex Loader](https://attack.mitre.org/software/S1248) is a XOR-encoded loader that collects host data, decodes follow-on scripts and acts as a downloader for the [BeaverTail](https://attack.mitre.org/software/S1246) malware. [XORIndex Loader](https://attack.mitre.org/software/S1248) was first reported in June 2025. [XORIndex Loader](https://attack.mitre.org/software/S1248) has been leveraged by North Korea-affiliated threat actors identified as [Contagious Interview](https://attack.mitre.org/groups/G1052). [XORIndex Loader](https://attack.mitre.org/software/S1248) has been delivered to victims through code repository sites utilizing typo squatting naming conventions of various npm packages.(Citation: Socket BeaverTail XORIndex HexEval Contagious Interview July 2025)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_aliases: XORIndex Loader
type: malware
spec_version: 2.1
id: malware--ff41b9b6-4c1d-407b-a7e2-835109c8dbc5
created: 2022-08-16T19:16:48.398Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1035
external_id: S1035
source_name: GRAMDOOR
description: (Citation: Mandiant UNC3313 Feb 2022)
source_name: DHS CISA AA22-055A MuddyWater February 2022
description: FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.
url: https://www.cisa.gov/uscert/ncas/alerts/aa22-055a
source_name: NCSC GCHQ Small Sieve Jan 2022
description: NCSC GCHQ. (2022, January 27). Small Sieve Malware Analysis Report. Retrieved August 22, 2022.
url: https://www.ncsc.gov.uk/files/NCSC-Malware-Analysis-Report-Small-Sieve.pdf
source_name: Mandiant UNC3313 Feb 2022
description: Tomcik, R. et al. (2022, February 24). Left On Read: Telegram Malware Spotted in Latest Iranian Cyber Espionage Activity. Retrieved August 18, 2022.
url: https://www.mandiant.com/resources/telegram-malware-iranian-espionage
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:38:45.865Z
name: Small Sieve
description: [Small Sieve](https://attack.mitre.org/software/S1035) is a Telegram Bot API-based Python backdoor that has been distributed using a Nullsoft Scriptable Install System (NSIS) Installer; it has been used by [MuddyWater](https://attack.mitre.org/groups/G0069) since at least January 2022.(Citation: DHS CISA AA22-055A MuddyWater February 2022)(Citation: NCSC GCHQ Small Sieve Jan 2022)

Security researchers have also noted [Small Sieve](https://attack.mitre.org/software/S1035)'s use by UNC3313, which may be associated with [MuddyWater](https://attack.mitre.org/groups/G0069).(Citation: Mandiant UNC3313 Feb 2022)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: Small Sieve
GRAMDOOR