S1037 STARWHALE

malwareEnterprise

platformsWindows

also known asSTARWHALE · CANOPY

STARWHALE is Windows Script File (WSF) backdoor that has been used by MuddyWater, possibly since at least November 2021; there is also a STARWHALE variant written in Golang with similar capabilities. Security researchers have also noted the use of STARWHALE by UNC3313, which may be associated with MuddyWater.

techniques used (14)

ATT&CK techniques this enables or maps to.

T1005Data from Local System
T1016System Network Configuration Discovery
T1027.013Encrypted/Encoded File
T1033System Owner/User Discovery
T1041Exfiltration Over C2 Channel
T1059.003Windows Command Shell
T1059.005Visual Basic
T1071.001Web Protocols
T1074.001Local Data Staging
T1082System Information Discovery
T1132.001Standard Encoding
T1204.002Malicious File
T1543.003Windows Service
T1547.001Registry Run Keys / Startup Folder

used by groups (1)

Threat groups associated with this.

G0069MuddyWater

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan