modified: 2024-11-17T14:43:38.592Z
name: CHOPSTICK
description: [CHOPSTICK](https://attack.mitre.org/software/S0023) is a malware family of modular backdoors used by [APT28](https://attack.mitre.org/groups/G0007). It has been used since at least 2012 and is usually dropped on victims as second-stage malware, though it has been used as first-stage malware in several cases. It has both Windows and Linux variants. (Citation: FireEye APT28) (Citation: ESET Sednit Part 2) (Citation: FireEye APT28 January 2017) (Citation: DOJ GRU Indictment Jul 2018) It is tracked separately from the [X-Agent for Android](https://attack.mitre.org/software/S0314).
is_family: yes
x_mitre_platforms: Windows
Linux
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.3
x_mitre_contributors: Richard Gold, Digital Shadows
x_mitre_aliases: CHOPSTICK
Backdoor.SofacyX
SPLM
Xagent
X-Agent
webhp
type: malware
spec_version: 2.1
id: malware--ccd61dfc-b03f-4689-8c18-7c97eab08472
created: 2017-05-31T21:32:19.389Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0023
external_id: S0023
source_name: SPLM
description: (Citation: ESET Sednit Part 2) (Citation: FireEye APT28 January 2017)
source_name: Xagent
description: (Citation: ESET Sednit Part 2) (Citation: FireEye APT28 January 2017)
source_name: X-Agent
description: (Citation: ESET Sednit Part 2) (Citation: FireEye APT28 January 2017)
source_name: webhp
description: (Citation: FireEye APT28 January 2017)
source_name: CHOPSTICK
description: (Citation: FireEye APT28) (Citation: ESET Sednit Part 2) (Citation: FireEye APT28 January 2017)
source_name: Backdoor.SofacyX
description: (Citation: Symantec APT28 Oct 2018)
source_name: ESET Sednit Part 2
description: ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.
url: http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf
source_name: FireEye APT28 January 2017
description: FireEye iSIGHT Intelligence. (2017, January 11). APT28: At the Center of the Storm. Retrieved November 17, 2024.
url: https://www.mandiant.com/sites/default/files/2021-09/APT28-Center-of-Storm-2017.pdf
source_name: FireEye APT28
description: FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.
url: https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf
source_name: DOJ GRU Indictment Jul 2018
description: Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved November 17, 2024.
url: https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf
source_name: Symantec APT28 Oct 2018
description: Symantec Security Response. (2018, October 04). APT28: New Espionage Operations Target Military and Government Organizations. Retrieved November 14, 2018.
url: https://www.symantec.com/blogs/election-security/apt28-espionage-military-government
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5