auren-research/cyber-sec huggingface dataset:
modified: 2024-09-21T07:18:26.370Z
name: DUSTPAN
description: [DUSTPAN](https://attack.mitre.org/software/S1158) is an in-memory dropper written in C/C++ used by [APT41](https://attack.mitre.org/groups/G0096) since 2021 that decrypts and executes an embedded payload.(Citation: Google Cloud APT41 2024)(Citation: Google Cloud APT41 2022)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_aliases: DUSTPAN
type: malware
spec_version: 2.1
id: malware--37487ff6-de2a-4c14-9e8b-ba3b97f78aaf
created: 2024-09-16T08:29:07.124Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1158
external_id: S1158
source_name: Google Cloud APT41 2024
description: Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.
url: https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust
source_name: Google Cloud APT41 2022
description: Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman & John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved September 16, 2024.
url: https://cloud.google.com/blog/topics/threat-intelligence/apt41-us-state-governments
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-04-11T00:25:44.638Z
name: Prikormka
description: [Prikormka](https://attack.mitre.org/software/S0113) is a malware family used in a campaign known as Operation Groundbait. It has predominantly been observed in Ukraine and was used as early as 2008. (Citation: ESET Operation Groundbait)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.4
x_mitre_aliases: Prikormka
type: malware
spec_version: 2.1
id: malware--37cc7eb6-12e3-467b-82e8-f20f2cc73c69
created: 2017-05-31T21:33:07.943Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0113
external_id: S0113
source_name: ESET Operation Groundbait
description: Cherepanov, A.. (2016, May 17). Operation Groundbait: Analysis of a surveillance toolkit. Retrieved May 18, 2016.
url: http://www.welivesecurity.com/wp-content/uploads/2016/05/Operation-Groundbait.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: malware
spec_version: 2.1
id: malware--3824852d-1957-4712-9da0-38143723c060
created: 2025-08-04T16:35:44.800Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1228
external_id: S1228
source_name: 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA
description: Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.
url: https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan
source_name: 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload
description: Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.
url: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T02:46:58.268Z
name: PUBLOAD
description: [PUBLOAD](https://attack.mitre.org/software/S1228) is a stager malware that has been observed installing itself in existing directories such as `C:\Users\Public` or creating new directories to stage the malware and its components.(Citation: 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload) [PUBLOAD](https://attack.mitre.org/software/S1228) malware collects details of the victim host, establishes persistence, encrypts victim details using RC4 and communicates victim details back to C2. [PUBLOAD](https://attack.mitre.org/software/S1228) malware has previously been leveraged by China-affiliated actors identified as [Mustang Panda](https://attack.mitre.org/groups/G0129). [PUBLOAD](https://attack.mitre.org/software/S1228) is also known as “NoFive” and some public reporting identifies the loader component as [CLAIMLOADER](https://attack.mitre.org/software/S1236).(Citation: 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_aliases: PUBLOAD
modified: 2024-06-19T20:03:19.442Z
name: Gootloader
description: [Gootloader](https://attack.mitre.org/software/S1138) is a Javascript-based infection framework that has been used since at least 2020 as a delivery method for the Gootkit banking trojan, [Cobalt Strike](https://attack.mitre.org/software/S0154), [REvil](https://attack.mitre.org/software/S0496), and others. [Gootloader](https://attack.mitre.org/software/S1138) operates on an "Initial Access as a Service" model and has leveraged [SEO Poisoning](https://attack.mitre.org/techniques/T1608/006) to provide access to entities in multiple sectors worldwide including financial, military, automotive, pharmaceutical, and energy.(Citation: Sophos Gootloader)(Citation: SentinelOne Gootloader June 2021)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_contributors: Pooja Natarajan, NEC Corporation India
x_mitre_aliases: Gootloader
type: malware
spec_version: 2.1
id: malware--396c18b9-26fb-4435-8589-fb856502e4c4
created: 2024-05-28T20:39:16.453Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1138
external_id: S1138
source_name: SentinelOne Gootloader June 2021
description: Pirozzi, A. (2021, June 16). Gootloader: ‘Initial Access as a Service’ Platform Expands Its Search for High Value Targets. Retrieved May 28, 2024.
url: https://www.sentinelone.com/labs/gootloader-initial-access-as-a-service-platform-expands-its-search-for-high-value-targets/
source_name: Sophos Gootloader
description: Szappanos, G. & Brandt, A. (2021, March 1). “Gootloader” expands its payload delivery options. Retrieved September 30, 2022.
url: https://news.sophos.com/en-us/2021/03/01/gootloader-expands-its-payload-delivery-options/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: malware
spec_version: 2.1
id: malware--3a0f6128-0a01-421d-8eca-e57d8671b1f1
created: 2022-08-09T18:21:24.739Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1031
external_id: S1031
source_name: Unit 42 PingPull Jun 2022
description: Unit 42. (2022, June 13). GALLIUM Expands Targeting Across Telecommunications, Government and Finance Sectors With New PingPull Tool. Retrieved August 7, 2022.
url: https://unit42.paloaltonetworks.com/pingpull-gallium/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:38:02.753Z
name: PingPull
description: [PingPull](https://attack.mitre.org/software/S1031) is a remote access Trojan (RAT) written in Visual C++ that has been used by [GALLIUM](https://attack.mitre.org/groups/G0093) since at least June 2022. [PingPull](https://attack.mitre.org/software/S1031) has been used to target telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam.(Citation: Unit 42 PingPull Jun 2022)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Yoshihiro Kori, NEC Corporation
Pooja Natarajan, NEC Corporation India
Manikantan Srinivasan, NEC Corporation India
x_mitre_aliases: PingPull
type: malware
spec_version: 2.1
id: malware--3a4197ae-ec63-4162-907b-9a073d1157e4
created: 2020-09-24T19:39:44.392Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0514
external_id: S0514
source_name: CISA WellMess July 2020
description: CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.
url: https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198b
source_name: PWC WellMess July 2020
description: PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.
url: https://www.pwc.co.uk/issues/cyber-security-services/insights/cleaning-up-after-wellmess.html
source_name: NCSC APT29 July 2020
description: National Cyber Security Centre. (2020, July 16). Advisory: APT29 targets COVID-19 vaccine development. Retrieved September 29, 2020.
url: https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development-V1-1.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:43:03.067Z
name: WellMess
description: [WellMess](https://attack.mitre.org/software/S0514) is lightweight malware family with variants written in .NET and Golang that has been in use since at least 2018 by [APT29](https://attack.mitre.org/groups/G0016).(Citation: CISA WellMess July 2020)(Citation: PWC WellMess July 2020)(Citation: NCSC APT29 July 2020)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Daniyal Naeem, BT Security
x_mitre_aliases: WellMess
modified: 2024-04-11T02:43:00.252Z
name: Dacls
description: [Dacls](https://attack.mitre.org/software/S0497) is a multi-platform remote access tool used by [Lazarus Group](https://attack.mitre.org/groups/G0032) since at least December 2019.(Citation: TrendMicro macOS Dacls May 2020)(Citation: SentinelOne Lazarus macOS July 2020)
is_family: yes
x_mitre_platforms: macOS
Linux
Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_aliases: Dacls
type: malware
spec_version: 2.1
id: malware--3aa169f8-bbf6-44bb-b57d-7f6ada5c2128
created: 2020-08-07T14:53:56.534Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0497
external_id: S0497
source_name: TrendMicro macOS Dacls May 2020
description: Mabutas, G. (2020, May 11). New MacOS Dacls RAT Backdoor Shows Lazarus’ Multi-Platform Attack Capability. Retrieved August 10, 2020.
url: https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability/
source_name: SentinelOne Lazarus macOS July 2020
description: Stokes, P. (2020, July 27). Four Distinct Families of Lazarus Malware Target Apple’s macOS Platform. Retrieved August 7, 2020.
url: https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: malware
spec_version: 2.1
id: malware--3ae6097d-d700-46c6-8b21-42fc0bcb48fa
created: 2020-12-22T18:36:12.214Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0547
external_id: S0547
source_name: DropBook
description: (Citation: Cybereason Molerats Dec 2020)(Citation: BleepingComputer Molerats Dec 2020)
source_name: Cybereason Molerats Dec 2020
description: Cybereason Nocturnus Team. (2020, December 9). MOLERATS IN THE CLOUD: New Malware Arsenal Abuses Cloud Platforms in Middle East Espionage Campaign. Retrieved December 22, 2020.
url: https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf
source_name: BleepingComputer Molerats Dec 2020
description: Ilascu, I. (2020, December 14). Hacking group’s new malware abuses Google and Facebook services. Retrieved December 28, 2020.
url: https://www.bleepingcomputer.com/news/security/hacking-group-s-new-malware-abuses-google-and-facebook-services/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:43:03.619Z
name: DropBook
description: [DropBook](https://attack.mitre.org/software/S0547) is a Python-based backdoor compiled with PyInstaller.(Citation: Cybereason Molerats Dec 2020)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: DropBook
type: malware
spec_version: 2.1
id: malware--3bc7e862-5610-4c02-9c48-15b2e2dc1ddb
created: 2023-02-14T16:52:39.925Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1065
external_id: S1065
source_name: MalwareBytes WoodyRAT Aug 2022
description: MalwareBytes Threat Intelligence Team. (2022, August 3). Woody RAT: A new feature-rich malware spotted in the wild. Retrieved December 6, 2022.
url: https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T03:29:54.769Z
name: Woody RAT
description:  [Woody RAT](https://attack.mitre.org/software/S1065) is a remote access trojan (RAT) that has been used since at least August 2021 against Russian organizations.(Citation: MalwareBytes WoodyRAT Aug 2022)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.2
x_mitre_attack_spec_version: 3.3.0
x_mitre_contributors: Yoshihiro Kori, NEC Corporation
Pooja Natarajan, NEC Corporation India
Manikantan Srinivasan, NEC Corporation India
Adam Lichters
x_mitre_aliases: Woody RAT
type: malware
spec_version: 2.1
id: malware--3be1fb7a-0f7e-415e-8e3a-74a80d596e68
created: 2023-01-26T01:21:43.409Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1060
external_id: S1060
source_name: SentinelLabs Metador Sept 2022
description: Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.
url: https://assets.sentinelone.com/sentinellabs22/metador#page=1
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T22:47:45.475Z
name: Mafalda
description: [Mafalda](https://attack.mitre.org/software/S1060) is a flexible interactive implant that has been used by [Metador](https://attack.mitre.org/groups/G1013). Security researchers assess the [Mafalda](https://attack.mitre.org/software/S1060) name may be inspired by an Argentinian cartoon character that has been popular as a means of political commentary since the 1960s. (Citation: SentinelLabs Metador Sept 2022)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.2
x_mitre_attack_spec_version: 3.3.0
x_mitre_contributors: Massimiliano Romano, BT Security
x_mitre_aliases: Mafalda
modified: 2024-11-17T15:01:33.386Z
name: KARAE
description: [KARAE](https://attack.mitre.org/software/S0215) is a backdoor typically used by [APT37](https://attack.mitre.org/groups/G0067) as first-stage malware. (Citation: FireEye APT37 Feb 2018)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_aliases: KARAE
type: malware
spec_version: 2.1
id: malware--3c02fb1f-cbdb-48f5-abaf-8c81d6e0c322
created: 2018-04-18T17:59:24.739Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0215
external_id: S0215
source_name: KARAE
description: (Citation: FireEye APT37 Feb 2018)
source_name: FireEye APT37 Feb 2018
description: FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.
url: https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-04-11T00:02:15.805Z
name: Squirrelwaffle
description: [Squirrelwaffle](https://attack.mitre.org/software/S1030) is a loader that was first seen in September 2021. It has been used in spam email campaigns to deliver additional malware such as [Cobalt Strike](https://attack.mitre.org/software/S0154) and the [QakBot](https://attack.mitre.org/software/S0650) banking trojan.(Citation: ZScaler Squirrelwaffle Sep 2021)(Citation: Netskope Squirrelwaffle Oct 2021)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_contributors: Sebastian Showell-Westrip, BT Security
Harry Hill, BT Security
Catherine Williams, BT Security
x_mitre_aliases: Squirrelwaffle
type: malware
spec_version: 2.1
id: malware--3c18ad16-9eaf-4649-984e-68551bff0d47
created: 2022-08-09T16:45:36.234Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1030
external_id: S1030
source_name: ZScaler Squirrelwaffle Sep 2021
description: Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.
url: https://www.zscaler.com/blogs/security-research/squirrelwaffle-new-loader-delivering-cobalt-strike
source_name: Netskope Squirrelwaffle Oct 2021
description: Palazolo, G. (2021, October 7). SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot. Retrieved August 9, 2022.
url: https://www.netskope.com/blog/squirrelwaffle-new-malware-loader-delivering-cobalt-strike-and-qakbot
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: malware
spec_version: 2.1
id: malware--3cab1b76-2f40-4cd0-8d2c-7ed16eeb909c
created: 2017-05-31T21:32:43.237Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0064
external_id: S0064
source_name: FireEye EPS Awakens Part 2
description: Winters, R. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016.
url: https://web.archive.org/web/20151226205946/https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:38:03.197Z
name: ELMER
description: [ELMER](https://attack.mitre.org/software/S0064) is a non-persistent, proxy-aware HTTP backdoor written in Delphi that has been used by [APT16](https://attack.mitre.org/groups/G0023). (Citation: FireEye EPS Awakens Part 2)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: ELMER
type: malware
spec_version: 2.1
id: malware--3d1f234e-6c60-43c1-b1f1-6bbc9e5b8e44
created: 2025-09-12T17:20:43.806Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1237
external_id: S1237
source_name: Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025
description: Patrick Whitsell. (2025, August 25). Deception in Depth: PRC-Nexus Espionage Campaign Hijacks Web Traffic to Target Diplomats. Retrieved September 9, 2025.
url: https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-22T19:06:49.198Z
name: CANONSTAGER
description: [CANONSTAGER](https://attack.mitre.org/software/S1237) is a loader known to be leveraged by [Mustang Panda](https://attack.mitre.org/groups/G0129) and was first observed utilized in 2025. [Mustang Panda](https://attack.mitre.org/groups/G0129) utilizes DLL side-loading to execute within the victim environment prior to delivering a follow-on malicious encrypted payload. [CANONSTAGER](https://attack.mitre.org/software/S1237) leverages Thread Local Storage (TLS) and Native Windows APIs within the victim environment to elude detections. [CANONSTAGER](https://attack.mitre.org/software/S1237) also hides its code utilizing window procedures and message queues.(Citation: Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_aliases: CANONSTAGER
type: malware
spec_version: 2.1
id: malware--3d57dcc4-be99-4613-9482-d5218f5ec13e
created: 2020-09-23T15:42:59.822Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0518
external_id: S0518
source_name: ESET Dukes October 2019
description: Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.
url: https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:38:03.362Z
name: PolyglotDuke
description: [PolyglotDuke](https://attack.mitre.org/software/S0518) is a downloader that has been used by [APT29](https://attack.mitre.org/groups/G0016) since at least 2013. [PolyglotDuke](https://attack.mitre.org/software/S0518) has been used to drop [MiniDuke](https://attack.mitre.org/software/S0051).(Citation: ESET Dukes October 2019)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: PolyglotDuke