S0043 BUBBLEWRAP

malwareEnterprise

platformsWindows

also known asBUBBLEWRAP · Backdoor.APT.FakeWinHTTPHelper

BUBBLEWRAP is a full-featured, second-stage backdoor used by the admin@338 group. It is set to run when the system boots and includes functionality to check, upload, and register plug-ins that can further enhance its capabilities.

techniques used (3)

ATT&CK techniques this enables or maps to.

T1071.001Web Protocols
T1082System Information Discovery
T1095Non-Application Layer Protocol

used by groups (1)

Threat groups associated with this.

G0018admin@338

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan