● Malware

Kessel

Kessel is an advanced version of OpenSSH which acts as a custom backdoor, mainly acting to steal credentials and function as a bot. Kessel has been active since its C2 domain began resolving in August 2018.

View graph Watch Export

Indicators tracked

Intelligence Reports10

10 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium

Connections

14 relationships

T1132.001: Standard Encoding

source

T1027.013: Encrypted/Encoded File

source

T1082: System Information Discovery

source

T1140: Deobfuscate/Decode Files or Information

source

T1560: Archive Collected Data

source

T1016: System Network Configuration Discovery

source

T1090: Proxy

source

T1059: Command and Scripting Interpreter

source

T1041: Exfiltration Over C2 Channel

source

T1554: Compromise Host Software Binary

source

T1030: Data Transfer Size Limits

source

T1105: Ingress Tool Transfer

source

T1556: Modify Authentication Process

source

T1048.003: Exfiltration Over Unencrypted Non-C2 Protocol

source