MITRE ATT&CKsoftware (malware)

S0150 POSHSPY

Published 2017-12-14 Modified 2025-04-25 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.2
Created
2017-12-14

Description

POSHSPY is a backdoor that has been used by APT29 since at least 2015. It appears to be used as a secondary backdoor used if the actors lost access to their primary backdoors.

Related

Uses · MITRE ATT&CK (8)

  • T1573.002 Asymmetric Cryptography sub-technique
  • T1568.002 Domain Generation Algorithms sub-technique
  • T1059.001 PowerShell sub-technique
  • T1070.006 Timestomp sub-technique
  • T1546.003 Windows Management Instrumentation Event Subscription sub-technique
  • T1027 Obfuscated Files or Information technique
  • T1030 Data Transfer Size Limits technique
  • T1105 Ingress Tool Transfer technique

Referenced by MITRE ATT&CK · uses (1)

References