HyperStack

Malware & Tools · HyperStack

· MalwareS0537 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

HyperStack is a RPC-based backdoor used by Turla since at least 2018. HyperStack has similarities to other backdoors used by Turla including Carbon.(Citation: Accenture HyperStack October 2020)

Tactic Coverage

persistence (2)execution (2)stealth (1)privilege escalation (1)initial access (1)discovery (1)defense impairment (1)command and control (1)

Used By (1 groups)

G0010TurlaIRON HUNTER, Group 88

Techniques (6)

T1078.001Default Accounts

stealthpersistence

T1087.001Local Account

discovery

T1106Native API

execution

T1112Modify Registry

defense impairmentpersistence

T1559Inter-Process Communication

execution

T1573.001Symmetric Cryptography

command and control

References

https://attack.mitre.org/software/S0537 https://web.archive.org/web/20201101015247/https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity