S0117 XTunnel

malwareEnterprise

platformsWindows

also known asXTunnel · Trojan.Shunnael · X-Tunnel · XAPS

XTunnel a VPN-like network proxy tool that can relay traffic between a C2 server and a victim. It was first seen in May 2013 and reportedly used by APT28 during the compromise of the Democratic National Committee.

techniques used (8)

ATT&CK techniques this enables or maps to.

T1008Fallback Channels
T1027Obfuscated Files or Information
T1027.016Junk Code Insertion
T1046Network Service Discovery
T1059.003Windows Command Shell
T1090Proxy
T1552.001Credentials In Files
T1573.002Asymmetric Cryptography

used by groups (1)

Threat groups associated with this.

G0007APT28

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan