S1035 Small Sieve

malwareEnterprise

platformsWindows

also known asSmall Sieve · GRAMDOOR

Small Sieve is a Telegram Bot API-based Python backdoor that has been distributed using a Nullsoft Scriptable Install System (NSIS) Installer; it has been used by MuddyWater since at least January 2022. Security researchers have also noted Small Sieve's use by UNC3313, which may be associated with MuddyWater.

techniques used (13)

ATT&CK techniques this enables or maps to.

T1016System Network Configuration Discovery
T1027Obfuscated Files or Information
T1033System Owner/User Discovery
T1036.005Match Legitimate Resource Name or Location
T1059.003Windows Command Shell
T1059.006Python
T1071.001Web Protocols
T1102.002Bidirectional Communication
T1105Ingress Tool Transfer
T1132.002Non-Standard Encoding
T1480Execution Guardrails
T1547.001Registry Run Keys / Startup Folder
T1573.002Asymmetric Cryptography

used by groups (1)

Threat groups associated with this.

G0069MuddyWater

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan