Loading malware…
DoubleT is a backdoor associated with the CactusPete APT threat actor, also known as Karma Panda and Tonto Team. Kaspersky reported DoubleT activity in campaigns spanning September to October 2019 and a modified DoubleT backdoor campaign from December 2019 to April 2020. In one documented campaign beginning in December 2019, CactusPete used a malicious dropper placed in the Microsoft Word Startup directory to install an updated version of the DoubleT backdoor. Reported victims included military-related and other unknown targets, and broader CactusPete activity in the same reporting period targeted financial and military organizations in Eastern Europe. The group is historically known for targeting military, diplomatic, and infrastructure entities in Asia and Eastern Europe. The provided content does not include detailed DoubleT command capabilities or protocol specifics, but it does directly identify DoubleT as a backdoor used by CactusPete and notes the existence of updated and modified variants over time.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
“September and October 2019: a DoubleT backdoor campaign, targeting military-related and unknown victims; … December 2019 to April 2020: a modified DoubleT backdoor campaign…”
1 distinct technique documented for this family, organized by ATT&CK tactic.
"...implanted a new dropper module in the Microsoft Word Startup directory, most likely through a malicious document."
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.