MASEPIEMalware
Last reported 4 months ago, by Sekoia.io2 reports
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1056.001Keylogging
“Alongside it, the group deploys SlimAgent, a dedicated spyware module focused on keylogging and information theft.”
- T1059.009Cloud API
“On the highest-priority targets, APT28 escalates to BeardShell, a custom C++ backdoor that uses the icedrive cloud API for C2.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
APT28: An Evolution of Tradecraft from X-Agent to LLM Malware“MASEPIE: Python downloader, abuses the Windows URI handler with WebDAV staging.”
-
From APT28 to RePythonNET: automating .NET malware analysis“Malwares like MASEPIE, STEELHOOK, and OCEANMAP are designed for specific, short-term tasks such as establishing basic persistence, executing reconnaissance commands, or stealing browser data like credentials and session cookies.”
Indicators in its reports
named in the reports above- hxxps://github[.]com/SEKOIA-IO/RePythonNET-MCPin 1 report
- x.opcode[.]namein 1 report
- instr.opcode[.]namein 1 report
- instr.operand[.]namein 1 report
- 69609e89b04d8d27…cf3303be8906in 1 report
Copy these 5 indicators · defanged
Thanks — we review every report.