Loading malware…
X-Agent, also known as CHOPSTICK and SPLM, is a modular espionage backdoor used by APT28, the Russian GRU-linked threat actor also known as Sofacy, Sednit, and Fancy Bear. It is deployed selectively as a second-stage implant against targets worldwide. The family includes Windows, Linux, iOS, and macOS variants and supports remote command execution, keylogging, and screenshot collection.
Its command-and-control mechanisms include HTTP, HTTPS, and other channels selected according to module configuration. CHOPSTICK encrypts communications with RC4, can switch channels when an existing connection fails, and can generate fallback domains by concatenating words from predefined lists. It also checks for antivirus and forensic software. APT28 has executed Windows DLL variants through the legitimate Rundll32 utility.
The macOS variant provides system and process reconnaissance, remote shell execution, file manipulation and execution, Firefox password theft, screenshot capture, keylogging, and file exfiltration through HTTP and FTP. It can discover and steal iOS backups stored on compromised Macs. Its communications use RC4 encryption and Base64 encoding, and it performs anti-debugging checks. Capabilities vary by platform and module configuration.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Later implants used by APT28, such as CHOPSTICK, use a blend of HTTP, HTTPS, and other legitimate channels for C2, depending on module configuration.
Another unit mate, Capt. Nikolay Kozachek, allegedly crafted the X-Agent malware used to hack the Democratic Congressional Campaign Committee and DNC networks in April 2016.
...their involvement in the development of Unit 26165’s X-Agent malware
19 distinct techniques documented for this family, organized by ATT&CK tactic.
77 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
112 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.