MITRE ATT&CKsoftware (malware)

S9066 POLLBLEND

Published 2026-10-01 Modified 2026-10-01 Official page ↗

Domain: enterprise
Platforms: Windows
Version: 1.0
Created: 2026-10-01

Description

POLLBLEND is a Windows tunneler written C++ that has utilized hardcoded C2 servers and leveraged hardcoded URI parameters for follow-on actions. POLLBLEND was first observed in 2025 and has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.

Uses · MITRE ATT&CK (5)

T1071.001 Web Protocols sub-technique
T1574.001 DLL sub-technique
T1553.002 Code Signing sub-technique
T1041 Exfiltration Over C2 Channel technique
T1105 Ingress Tool Transfer technique

Referenced by MITRE ATT&CK · uses (1)

G1059 NIMBUS MANTICORE group

References

https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense Mandiant_UNC1549_Nov2025

S9066 POLLBLEND

Description

Related

Uses · MITRE ATT&CK (5)

Referenced by MITRE ATT&CK · uses (1)

References