MISTPENMalware
According to Mandiant, MISTPEN is a lightweight backdoor written in C whose main functionality is to download and execute Portable Executable (PE) files. The backdoor is a modification of the open-source Notepad++ binhex plugin v2.0.0.1 where the creation of a thread that executes the malicious code has been added to the DllMain function.From MISP Galaxy
Last reported 3 days ago, by Kaspersky Securelist4 reports
ATT&CK techniques
6 of 7 · each with the sentence it comes from- T1014Rootkit
“What arrived through the handshake was FudModule, Lazarus's kernel rootkit, in a build Check Point tracks as v3.1.It disables telemetry callbacks, removes minifilters, kills the NT Kernel Logger and blinds 94 Event Tracing for Windows (ETW) providers.”
- T1021.001Remote Desktop Protocol
“…unauthorised access into networks and systems, often through phishing attacks, exploitation of vulnerabilities, or compromising Remote Desktop Protocols (RDP).”
- T1195Supply Chain Compromise
“Moreover, the interconnected nature of the financial ecosystem amplifies the risks of supply chain compromises.”
- T1213.005Messaging Applications
“… that the threat actor likely approached targets through professional networking platforms such as LinkedIn, or directly through messaging applications.”
- T1505.003Web Shell
“… leveraged these credentials to authenticate to the affected Roundcube instances before exploiting CVE-2025-49113 to deploy RelayShell web shells, which subsequently serve as a C2 relay mechanism.”
- T1543.003Windows Service
“…echHub in the chain: an in‑memory version, a simple DLL side‑loading version, and a DLL side‑loading version that uses a registered Windows service.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Operation FlashHole: Lazarus breaks security, defies control“As previously noted, similar patterns have been identified in CookiePlus, MISTPEN, SIGNBT, and IMETHOD.”
-
Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day“Infection ran through MISTPEN, an in-memory downloader that communicates via attacker-controlled files on OneDrive using the Microsoft Graph API.”
-
Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack“The executed payload is MISTPEN, a lightweight in-memory downloader that uses Microsoft Graph API to access OneDrive in order to retrieve additional modules and run them in memory.”
-
Cyber Threat Actors Impacting the Financial Sector in 2024“… unveiled it switched to malicious ISO files instead of ZIP files to evade detection, and used new malicious programs or variants, like MISTPEN, LPEClient, RollMid, and CookiePlus.”
Indicators in its reports
named in the reports above- 2b4987c07a3d9a9a…c92874265ca8in 1 report
- 3a02d0d798e8d355…5d259516525ain 1 report
- 92106b0c62a0a426…c70cfe98afa1in 1 report
- 396192d92d17ace1…8e4934b3c82cin 1 report
- f7e620134ca93506…cc9b75afda4din 1 report
- 75b93a7103b0562f…4469a7f096f1in 1 report
- a45144d22cac70a4…ac863d6cc7e2in 1 report
- 1de949c71efcfb0f…8c535d7ad86cin 1 report
- 4c9b804d6155b29f…6bf2026768d9in 1 report
- 29e24c007549e513…53bd3f4533a2in 1 report
- 4ebdce2f47c23ff8…926890adc105in 1 report
- c2aa28bb5e2a749c…ee5fb4167461in 1 report
- 2db25ac41a66aa52…bd7232e141ebin 1 report
- 5278ee922838352f…97dfd088696din 1 report
- b4082d21070d9ddf…35e458d21afbin 1 report
- fb3fc5626f68677f…6a8210139a2din 1 report
- ea7056f2bf36c66a…c2504db2c619in 1 report
- 13d10bc99f7f7abe…40dacbcdef79in 1 report
- 4fd32432341dfcf5…a340cdde9a2din 1 report
- 4dd792c9f672bbdc…79a48ad6a68ain 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.