THINCRUST

MITRE

Malware Type:
Other

First seen:
Unknown

Last seen:
Unknown

Details:

[THINCRUST](https://attack.mitre.org/software/S1223) is a Python-based backdoor tool that has been used by [UNC3886](https://attack.mitre.org/groups/G1048) since at least 2023.(Citation: Mandiant Fortinet Zero Day)

Associated Techniques (5)

ID	ATT&CK	Tactics
T1059.006	Python	-
T1071.001	Web Protocols	-
T1140	Deobfuscate/Decode Files or Information	-
T1562.004	Disable or Modify System Firewall	-
T1573.001	Symmetric Cryptography	-

Used by Actors (1)

UNC3886
Unknown

Metadata

ID:	138
Created:	13/01/2026 17:48
Updated:	06/03/2026 16:00