ADVSTORESHELLMalware
- azzy
- eviltoss
- netui
- Sedreco
ADVSTORESHELL is a spying backdoor that has been used by APT28 from at least 2012 to 2016. It is generally used for long-term espionage and is deployed on targets deemed interesting after a reconnaissance phase.From MITRE ATT&CK
Last reported 4 months ago, by Sekoia.io3 reports
ATT&CK techniques
6 of 23 · each with the sentence it comes from- T1056.001Keylogging
“T1056.001”
- T1001Data Obfuscation
“T1001”
- T1005Data from Local System
“T1005”
- T1027Obfuscated Files or Information
“T1027”
- T1056Input Capture
“Input Capture: Keylogging”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: PowerShell”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
APT28: An Evolution of Tradecraft from X-Agent to LLM Malware“The attackers then upgraded valuable targets to the X-Agent backdoor, often pairing it with the Sedreco loader and the X-Tunnel network pivot.”
-
Sednit recargado: un APT histórico reactiva su arsenal“…ute;a de un conjunto amplio de implants personalizados, que iba desde backdoors de espionaje completamente desarrolladas, como Xagent y Sedreco, hasta toolkits especializados como la herramienta de network pivoting Xtunnel y el data stealer para máquinas air‑gapped USBStea…”
-
Sednit reloaded: Back in the trenches“…profile attacks, Sednit relied on an extensive set of custom implants, ranging from full-fledged espionage backdoors such as Xagent and Sedreco, to specialized toolkits such as the network-pivoting tool Xtunnel and the data stealer for air-gapped machines USBStealer.”
Indicators in its reports
named in the reports above- d0db619a7a160949…151bf9775c32in 2 reports
- 99b454262dc26b08…82a49d334e5ein 2 reports
- 5603e99151f8803c…4d071542f01bin 2 reports
- 6d39f49aa11ce057…9bae423ce3d5in 2 reports
Copy these 4 indicators · defanged
Thanks — we review every report.