MITRE ATT&CKsoftware (malware)

S0164 TDTESS

Published 2018-01-16 Modified 2025-04-25 Official page ↗

Domain: enterprise
Platforms: Windows
Version: 1.1
Created: 2018-01-16

Description

TDTESS is a 64-bit .NET binary backdoor used by CopyKittens.

Related

Uses · MITRE ATT&CK (5)

T1059.003 Windows Command Shell sub-technique
T1070.004 File Deletion sub-technique
T1070.006 Timestomp sub-technique
T1543.003 Windows Service sub-technique
T1105 Ingress Tool Transfer technique

Referenced by MITRE ATT&CK · uses (1)

G0052 CopyKittens group

References

http://www.clearskysec.com/wp-content/uploads/2017/07/Operation_Wilted_Tulip.pdf ClearSky Wilted Tulip July 2017