tshMalware
- TINYSHELL
Last reported 14 months ago, by Group-IB1 report
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1014Rootkit
“Although a connection was visible, no corresponding process ID (PID) could be found, raising suspicions of a rootkit or anti-forensics technique at play.”
- T1036Masquerading
“Masquerading of Backdoor Process”
- T1564Hide Artifacts
“This method has since been officially added to the MITRE ATT&CK framework as T1564.013 – Hide Artifacts: Bind Mounts.”
- T1564.013Bind Mounts
“An unpublished anti-forensics tactic, now cataloged in MITRE ATT&CK as T1564.013 (Linux bind mount abuse), played a central role in the campaign’s stealth.”
What the reports say
1 report, newest first · the exact sentence from each-
UNC2891 Bank Heist: Physical ATM Backdoor & Linux Forensic Evasion“Using the TINYSHELL backdoor, the attacker established an outbound command-and-control (C2) channel via a Dynamic DNS domain.”
Thanks — we review every report.