MITRE ATT&CKsoftware (malware)
S1035 Small Sieve
- Domain
- enterprise
- Platforms
- Windows
- Aliases
- GRAMDOOR
- Version
- 1.0
- Created
- 2022-08-16
Description
Small Sieve is a Telegram Bot API-based Python backdoor that has been distributed using a Nullsoft Scriptable Install System (NSIS) Installer; it has been used by MuddyWater since at least January 2022.
Security researchers have also noted Small Sieve's use by UNC3313, which may be associated with MuddyWater.
Related
Uses · MITRE ATT&CK (13)
- T1573.002 Asymmetric Cryptography sub-technique
- T1071.001 Web Protocols sub-technique
- T1102.002 Bidirectional Communication sub-technique
- T1132.002 Non-Standard Encoding sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1059.006 Python sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1480 Execution Guardrails technique
- T1016 System Network Configuration Discovery technique
- T1027 Obfuscated Files or Information technique
- T1033 System Owner/User Discovery technique
- T1105 Ingress Tool Transfer technique
Referenced by MITRE ATT&CK · uses (1)
- G0069 MuddyWater group
References
- https://www.cisa.gov/uscert/ncas/alerts/aa22-055a DHS CISA AA22-055A MuddyWater February 2022
- https://www.ncsc.gov.uk/files/NCSC-Malware-Analysis-Report-Small-Sieve.pdf NCSC GCHQ Small Sieve Jan 2022
- https://www.mandiant.com/resources/telegram-malware-iranian-espionage Mandiant UNC3313 Feb 2022