ctrlINT What the industry said about every indicator, with the quote

HATVIBEMalware

According to Sekoia, the aim of this backdoor is to receive VBS modules for execution from a remote C2 server. Once received, HATVIBE uses a simple XOR algorithm to decrypt each module, contact it between two tags before adding it to the HTML body of the HTA file, leading to the automatic execution of the received module.From MISP Galaxy

Last reported 19 days ago, by The Hacker News2 reports

ATT&CK techniques

2 techniques · each with the sentence it comes from
  1. T1053.005Scheduled Task

    “HATVIBE runs from a scheduled task via mshta.exe and pulls further modules, reportedly leading to the CHERRYSPY backdoor.”

    Sekoia.ioVendor
  2. T1684Social Engineering

    “The use of shapes is a quite common social engineering technique as it pushes the target to activate the macro in order to see the document’s content.”

    Sekoia.ioVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

2 reports, newest first · the exact sentence from each

  1. “In July 2024, multiple threat actors were observed weaponizing the flaw to deliver cryptocurrency miners, trojans, and a malware named HATVIBE.”

    The Hacker NewsNews
    Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE

  2. “Sekoia TDR documents the Double-Tap espionage campaign delivering HATVIBE, linking UAC-0063 to APT28 against Kazakhstan.”

    Sekoia.ioVendor
    Double-Tap: APT28-Linked Espionage on Kazakhstan

Indicators in its reports

named in the reports above
Copy these 18 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with HATVIBE here?
No account needed. We do not store your IP address.