MISTCLOAKMalware
- HIUPAN
Mandiant associates this with UNC4191, this malware decrypts and runs DARKDEW.From MISP Galaxy
Last reported 8 months ago, by JPCERT/CC Eyes1 report
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1014Rootkit
“For persistence, combinations of rootkits, backdoors, and loaders are used.”
- T1053.005Scheduled Task
“Persistence was achieved by registering the malware in the Startup folder and creating scheduled tasks.”
- T1553.002Code Signing
“…onitoring persistence mechanisms with Autoruns and EDR solutions, and restricting AutoIt execution through AppLocker or WDAC based on code-signing information.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
JSAC2026 -Day 1-“The “Stately Taurus” cluster involved tools including HIUPAN, USBFect, PUBLOAD (spread via USB), and CoolClient variants.”
Thanks — we review every report.