Search/BADHATCH
● Malware

BADHATCH

BADHATCH is a backdoor that has been utilized by FIN8 since at least 2019. BADHATCH has been used to target the insurance, retail, technology, and chemical industries in the United States, Canada, South Africa, Panama, and Italy.

View graph Watch Export
Indicators tracked
0
Intelligence Reports20
20 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium
Connections
36 relationships
T1053.005: Scheduled Task
source
T1047: Windows Management Instrumentation
source
T1113: Screen Capture
source
T1033: System Owner/User Discovery
source
T1027.009: Embedded Payloads
source
T1548.002: Bypass User Account Control
source
T1069.002: Domain Groups
source
T1135: Network Share Discovery
source
T1082: System Information Discovery
source
T1106: Native API
source
T1055: Process Injection
source
T1620: Reflective Code Loading
source
T1090: Proxy
source
T1482: Domain Trust Discovery
source
T1055.004: Asynchronous Procedure Call
source
T1049: System Network Connections Discovery
source
T1102: Web Service
source
T1134.001: Token Impersonation/Theft
source
T1057: Process Discovery
source
T1546.003: Windows Management Instrumentation Event Subscription
source
T1041: Exfiltration Over C2 Channel
source
T1059.001: PowerShell
source
T1071.002: File Transfer Protocols
source
T1573.002: Asymmetric Cryptography
source
T1059.003: Windows Command Shell
source
T1027.010: Command Obfuscation
source
T1070.004: File Deletion
source
T1071.001: Web Protocols
source
T1018: Remote System Discovery
source
T1046: Network Service Discovery
source
T1550.002: Pass the Hash
source
T1105: Ingress Tool Transfer
source
T1124: System Time Discovery
source
T1055.001: Dynamic-link Library Injection
source
T1027.015: Compression
source