DoubleT
DoubleT is a backdoor associated with the CactusPete APT threat actor, also known as Karma Panda and Tonto Team. Kaspersky reported DoubleT activity in campaigns spanning September to October 2019 and a modified DoubleT backdoor campaign from December 2019 to April 2020. In one documented campaign beginning in December 2019, CactusPete used a malicious dropper placed in the Microsoft Word Startup directory to install an updated version of the DoubleT backdoor. Reported victims included military-related and other unknown targets, and broader CactusPete activity in the same reporting period targeted financial and military organizations in Eastern Europe. The group is historically known for targeting military, diplomatic, and infrastructure entities in Asia and Eastern Europe. The provided content does not include detailed DoubleT command capabilities or protocol specifics, but it does directly identify DoubleT as a backdoor used by CactusPete and notes the existence of updated and modified variants over time.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“September and October 2019: a DoubleT backdoor campaign, targeting military-related and unknown victims; … December 2019 to April 2020: a modified DoubleT backdoor campaign…”
Techniques & procedures
1 distinct technique documented for this family, organized by ATT&CK tactic.
Persistence
1 technique"...implanted a new dropper module in the Microsoft Word Startup directory, most likely through a malicious document."
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor payload used in multiple CactusPete campaigns (2019–2020) against military-related, telecom, and government targets in Asia and Eastern Europe.
Backdoor updated with a new method for encrypting the C2 server address; delivered via a dropper placed in the Microsoft Word Startup directory.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.