Search/SysUpdate
● Malware

SysUpdate

SysUpdate is a backdoor written in C++ that has been used by Threat Group-3390 since at least 2020.

View graph Watch Export
Indicators tracked
0
Intelligence Reports10
10 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium
Connections
34 relationships
T1047: Windows Management Instrumentation
source
T1113: Screen Capture
source
T1027.011: Fileless Storage
source
T1033: System Owner/User Discovery
source
T1132.001: Standard Encoding
source
T1027.013: Encrypted/Encoded File
source
T1016.001: Internet Connection Discovery
source
T1071.004: DNS
source
T1573.001: Symmetric Cryptography
source
T1543.003: Windows Service
source
T1574.001: DLL
source
T1007: System Service Discovery
source
T1553.002: Code Signing
source
T1082: System Information Discovery
source
T1106: Native API
source
T1005: Data from Local System
source
T1140: Deobfuscate/Decode Files or Information
source
T1112: Modify Registry
source
T1016: System Network Configuration Discovery
source
T1083: File and Directory Discovery
source
T1036.004: Masquerade Task or Service
source
T1057: Process Discovery
source
T1041: Exfiltration Over C2 Channel
source
T1547.001: Registry Run Keys / Startup Folder
source
T1070.004: File Deletion
source
T1027.002: Software Packing
source
T1543.002: Systemd Service
source
T1105: Ingress Tool Transfer
source
T1564.001: Hidden Files and Directories
source
T1569.002: Service Execution
source
T1680: Local Storage Discovery
source