MITRE ATT&CKsoftware (malware)

S9067 TWOSTROKE

Published 2026-10-01 Modified 2026-10-01 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.0
Created
2026-10-01

Description

TWOSTROKE is malicious backdoor written in C++ that is capable of discovery actions, executing payloads and exfiltrating data. TWOSTROKE was first observed in 2025 and has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.

Related

Uses · MITRE ATT&CK (13)

  • T1027.013 Encrypted/Encoded File sub-technique
  • T1573.002 Asymmetric Cryptography sub-technique
  • T1132.001 Standard Encoding sub-technique
  • T1574.001 DLL sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1553.002 Code Signing sub-technique
  • T1070.004 File Deletion sub-technique
  • T1033 System Owner/User Discovery technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
  • T1105 Ingress Tool Transfer technique
  • T1106 Native API technique

Referenced by MITRE ATT&CK · uses (1)

  • G1059 NIMBUS MANTICORE group

References