S1146 MgBot

malwareEnterprise

platformsWindows

also known asMgBot

MgBot is a modular malware framework exclusively associated with Daggerfly operations since at least 2012. MgBot was developed in C++ and features a module design with multiple available plugins that have been under active development through 2024.

techniques used (17)

ATT&CK techniques this enables or maps to.

T1003OS Credential Dumping
T1005Data from Local System
T1018Remote System Discovery
T1025Data from Removable Media
T1033System Owner/User Discovery
T1046Network Service Discovery
T1056.001Keylogging
T1057Process Discovery
T1087.001Local Account
T1087.002Domain Account
T1115Clipboard Data
T1123Audio Capture
T1213.006Databases
T1482Domain Trust Discovery
T1539Steal Web Session Cookie
T1555Credentials from Password Stores
T1555.003Credentials from Web Browsers

used by groups (1)

Threat groups associated with this.

G1034Daggerfly

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan