MITRE ATT&CKsoftware (malware)

S0564 BlackMould

Published 2021-01-14 Modified 2025-04-25 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.0
Created
2021-01-14

Description

BlackMould is a web shell based on China Chopper for servers running Microsoft IIS. First reported in December 2019, it has been used in malicious campaigns by GALLIUM against telecommunication providers.

Related

Uses · MITRE ATT&CK (6)

  • T1680 Local Storage Discovery technique
  • T1071.001 Web Protocols sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1005 Data from Local System technique
  • T1083 File and Directory Discovery technique
  • T1105 Ingress Tool Transfer technique

Referenced by MITRE ATT&CK · uses (1)

References