S0176 Wingbird

malwareEnterprise

platformsWindows

also known asWingbird

Wingbird is a backdoor that appears to be a version of commercial software FinFisher. It is reportedly used to attack individual computers instead of networks. It was used by NEODYMIUM in a May 2016 campaign.

techniques used (9)

ATT&CK techniques this enables or maps to.

T1055Process Injection
T1068Exploitation for Privilege Escalation
T1070.004File Deletion
T1082System Information Discovery
T1518.001Security Software Discovery
T1543.003Windows Service
T1547.008LSASS Driver
T1569.002Service Execution
T1574.001DLL

used by groups (1)

Threat groups associated with this.

G0055NEODYMIUM

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan