MITRE ATT&CKsoftware (malware)

S1081 BADHATCH

Published 2023-08-01 Modified 2024-04-11 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.1
Created
2023-08-01

Description

BADHATCH is a backdoor that has been utilized by FIN8 since at least 2019. BADHATCH has been used to target the insurance, retail, technology, and chemical industries in the United States, Canada, South Africa, Panama, and Italy.

Related

Uses · MITRE ATT&CK (35)

  • T1027.015 Compression sub-technique
  • T1027.010 Command Obfuscation sub-technique
  • T1027.009 Embedded Payloads sub-technique
  • T1620 Reflective Code Loading technique
  • T1573.002 Asymmetric Cryptography sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1071.002 File Transfer Protocols sub-technique
  • T1059.001 PowerShell sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1069.002 Domain Groups sub-technique
  • T1134.001 Token Impersonation/Theft sub-technique
  • T1070.004 File Deletion sub-technique
  • T1548.002 Bypass User Account Control sub-technique
  • T1550.002 Pass the Hash sub-technique
  • T1546.003 Windows Management Instrumentation Event Subscription sub-technique
  • T1055.001 Dynamic-link Library Injection sub-technique
  • T1055.004 Asynchronous Procedure Call sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1482 Domain Trust Discovery technique
  • T1135 Network Share Discovery technique
  • T1018 Remote System Discovery technique
  • T1033 System Owner/User Discovery technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1046 Network Service Discovery technique
  • T1047 Windows Management Instrumentation technique
  • T1049 System Network Connections Discovery technique
  • T1055 Process Injection technique
  • T1057 Process Discovery technique
  • T1082 System Information Discovery technique
  • T1090 Proxy technique
Show all 35 ›

Referenced by MITRE ATT&CK · uses (1)

References