BADHATCH
MITRE
Malware Type:
Other
Other
First seen:
Unknown
Unknown
Last seen:
Unknown
Unknown
Details:
[BADHATCH](https://attack.mitre.org/software/S1081) is a backdoor that has been utilized by [FIN8](https://attack.mitre.org/groups/G0061) since at least 2019. [BADHATCH](https://attack.mitre.org/software/S1081) has been used to target the insurance, retail, technology, and chemical industries in the United States, Canada, South Africa, Panama, and Italy.(Citation: Gigamon BADHATCH Jul 2019)(Citation: BitDefender BADHATCH Mar 2021)
Associated Techniques (35)
| ID | ATT&CK | Tactics |
|---|---|---|
| T1018 | Remote System Discovery | - |
| T1027.009 | Embedded Payloads | - |
| T1027.010 | Command Obfuscation | - |
| T1027.015 | Compression | - |
| T1033 | System Owner/User Discovery | - |
| T1041 | Exfiltration Over C2 Channel | - |
| T1046 | Network Service Discovery | - |
| T1047 | Windows Management Instrumentation | - |
| T1049 | System Network Connections Discovery | - |
| T1053.005 | Scheduled Task | - |
| T1055 | Process Injection | - |
| T1055.001 | Dynamic-link Library Injection | - |
| T1055.004 | Asynchronous Procedure Call | - |
| T1057 | Process Discovery | - |
| T1059.001 | PowerShell | - |
Used by Actors (1)
Metadata
| ID: | 139 |
| Created: | 13/01/2026 17:48 |
| Updated: | 06/03/2026 16:00 |