CHOPSTICK

MITRE
Tipo Malware:
Other
Prima attivita:
Unknown
Ultima attivita:
Unknown
Dettagli:

[CHOPSTICK](https://attack.mitre.org/software/S0023) is a malware family of modular backdoors used by [APT28](https://attack.mitre.org/groups/G0007). It has been used since at least 2012 and is usually dropped on victims as second-stage malware, though it has been used as first-stage malware in several cases. It has both Windows and Linux variants. (Citation: FireEye APT28) (Citation: ESET Sednit Part 2) (Citation: FireEye APT28 January 2017) (Citation: DOJ GRU Indictment Jul 2018) It is tracked separately from the [X-Agent for Android](https://attack.mitre.org/software/S0314).

Tecniche Associate (19)
ID ATT&CK Tattiche
T1008 Fallback Channels -
T1012 Query Registry -
T1027.011 Fileless Storage -
T1056.001 Keylogging -
T1059 Command and Scripting Interpreter -
T1071.001 Web Protocols -
T1071.003 Mail Protocols -
T1083 File and Directory Discovery -
T1090.001 Internal Proxy -
T1091 Replication Through Removable Media -
T1092 Communication Through Removable Media -
T1105 Ingress Tool Transfer -
T1112 Modify Registry -
T1113 Screen Capture -
T1497 Virtualization/Sandbox Evasion -
Alias (525)
Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp Backdoor.SofacyX SPLM Xagent X-Agent webhp
Usato da Attori (1)
APT28
Nation-state
Metadata
ID: 568
Created: 13/01/2026 17:48
Updated: 06/03/2026 16:00