APT28

Primary modular backdoor for Windows, Linux, iOS, and Android. Provides remote access, keylogging, file exfiltration, and screenshot capture. Central to APT28 operations since 2007.

Multi-language dropper/backdoor written in Delphi, AutoIT, C++, C#, Go, and VB.NET. Used as first-stage reconnaissance and downloader in spear-phishing campaigns.

Lightweight first-stage reconnaissance implant delivered via spear-phishing. Profiles the victim's system before deploying X-Agent or other second-stage payloads.

Credential stealer that harvests saved passwords and cookies from web browsers. Deployed after initial access to gather authentication material for lateral movement.

Backdoor using IMAP email protocol for C2 communication, making traffic blend with normal email activity. Used in campaigns targeting Ukrainian entities.

Commercial adversary simulation framework used for post-exploitation. APT28 deploys Cobalt Strike beacons for lateral movement, privilege escalation, and persistent C2.

Used extensively for credential dumping — extracting plaintext passwords, NTLM hashes, and Kerberos tickets from Windows memory for lateral movement.

LLMNR/NBT-NS/mDNS poisoner used to capture NTLMv2 hashes on local networks. APT28 deploys this for credential harvesting during lateral movement.

Python library for network protocol manipulation. APT28 uses wmiexec, smbexec, and secretsdump modules for remote execution and credential extraction.

Used for fileless execution of payloads, reconnaissance scripts, and downloading additional tools. Frequently used with encoded commands to evade detection.

Windows certificate utility abused to download payloads from C2 servers and decode Base64-encoded malware, bypassing application whitelisting.

Used to execute malicious DLLs and proxy execution of payloads, evading process-based detection rules.

Network scanner used for reconnaissance — mapping target networks, identifying open ports, and discovering services for exploitation.

Second-generation modular implant (also known as X-Agent variant) with plugins for keylogging, file transfer, and remote shell operations.

Golang-based downloader used as an intermediary to fetch and execute Zebrocy or X-Agent. Often delivered via weaponized documents.

Multi-stage modular malware that infected 500,000+ SOHO routers and NAS devices worldwide. Used for traffic interception, credential stealing, and destructive capabilities.

First-stage backdoor typically delivered via spearphishing

Backdoor also known as Sednit and Seduploader

UEFI rootkit used for persistence

Flash Player exploitation framework used in targeted attacks

Trojan using email-based C2 communications

JavaScript-based reconnaissance malware

Malware used in credential harvesting campaigns