ctrlINT What the industry said about every indicator, with the quote

backspaceMalware

  • lecna
  • zrlnk

BACKSPACE is a backdoor used by APT30 that dates back to at least 2005.From MITRE ATT&CK

Last reported 2 days ago, by Zscaler ThreatLabz4 reports

ATT&CK techniques

6 of 19 · each with the sentence it comes from
  1. T1053.005Scheduled Task

    “…hive contains a Python 3.11 runtime, Pyarmor runtime files, and Armorsteal Python-based scripts.The installer creates the following scheduled tasks for persistence:Scheduled taskTriggerDescriptionSysCheck2User logonLaunches the remote access module with the highest privileges ava…”

    Zscaler ThreatLabzVendor
  2. T1003OS Credential Dumping

    “Credential Dump | T1003.006 (OS Credential Dumping) | Potential Remote Credential Access via Registry | Abnormal access to the Security Account Manager (SAM) registry hive.”

    Elastic Security LabsVendor
  3. T1003.001LSASS Memory

    “You run Impacket's secretsdump to pull hashes from the SAM database and LSASS memory.”

    Elastic Security LabsVendor
  4. T1003.002Security Account Manager

    “Credential Dump | T1003.006 (OS Credential Dumping) | Potential Remote Credential Access via Registry | Abnormal access to the Security Account Manager (SAM) registry hive.”

    Elastic Security LabsVendor
  5. T1003.006DCSync

    “Credential Dump | T1003.006 (OS Credential Dumping) | Potential Remote Credential Access via Registry | Abnormal access to the Security Account Manager (SAM) registry hive.”

    Elastic Security LabsVendor
  6. T1036Masquerading

    “Process Path and Hash: The full file path helps identify masquerading (e.g., svchost.exe running from C\:Temp instead of C:\Windows\System32).”

    Elastic Security LabsVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

4 reports, newest first · the exact sentence from each

  1. “…dule performs the following activities:Logs keystrokes (with specialized handling for English, French, Spanish, and German), including backspace, space, decimal separators, and modifier keys.Records the title of the active window along with captured keystrokes.Monitors clipboard…”

    Zscaler ThreatLabzVendor
    SEO Poisoning Campaign Delivers New Armorsteal Malware

  2. “: [BKSP] for backspace).”

    Sekoia.ioVendor
    APT28 Operation Phantom Net Voxel: BeardShell & Covenant

  3. “It enables the server to communicate with the client and inform it that certain special features - whizz-bang new technology like ‘backspace’, for example - should be represented by specific control codes.”

    watchTowr LabsVendor
    A 32-Year-Old Bug Walks Into A Telnet Server (GNU inetutils Telnetd CVE-2026-32746 Pre-Auth RCE)

  4. “This can reveal backspaces, typos, and corrections (e.g., typing sdo [backspace] sudo), which are strong behavioral indicators of a human adversary rather than an automated script.”

    Elastic Security LabsVendor
    Automating GOAD and Live Malware Labs

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with backspace here?
No account needed. We do not store your IP address.