● Malware

POSHSPY

POSHSPY is a backdoor that has been used by APT29 since at least 2015. It appears to be used as a secondary backdoor used if the actors lost access to their primary backdoors.

View graph Watch Export

Indicators tracked

Intelligence Reports10

10 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium

Connections

9 relationships

T1568.002: Domain Generation Algorithms

source

T1070.006: Timestomp

source

T1546.003: Windows Management Instrumentation Event Subscription

source

T1059.001: PowerShell

source

T1027: Obfuscated Files or Information

source

T1573.002: Asymmetric Cryptography

source

T1030: Data Transfer Size Limits

source

T1105: Ingress Tool Transfer

source