MITRE ATT&CKsoftware (malware)

S0664 Pandora

Published 2021-11-29 Modified 2025-04-16 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.0
Created
2021-11-29

Description

Pandora is a multistage kernel rootkit with backdoor functionality that has been in use by Threat Group-3390 since at least 2020.

Related

Uses · MITRE ATT&CK (13)

  • T1027.015 Compression sub-technique
  • T1553.006 Code Signing Policy Modification sub-technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1574.001 DLL sub-technique
  • T1569.002 Service Execution sub-technique
  • T1543.003 Windows Service sub-technique
  • T1205 Traffic Signaling technique
  • T1055 Process Injection technique
  • T1057 Process Discovery technique
  • T1068 Exploitation for Privilege Escalation technique
  • T1105 Ingress Tool Transfer technique
  • T1112 Modify Registry technique

Referenced by MITRE ATT&CK · uses (2)

  • G1021 Cinnamon Tempest group
  • G0027 Threat Group-3390 group

References