Loading malware…
MURKYTOP is a command-line reconnaissance tool, also referenced as mt.exe, associated with the China-linked espionage group APT40. Reported capabilities include identifying remote hosts on connected networks, scanning for open ports on hosts in a connected network, retrieving information about users on remote hosts, retrieving information about shares on remote hosts, and deleting local files. Although primarily described as a command-line reconnaissance utility, it can also be used for lateral movement. APT40 has used MURKYTOP as part of broader post-compromise activity to establish persistence, escalate privileges, map victim environments, and move laterally. In the provided reporting, MURKYTOP appears among toolsets associated with APT40/BRONZE MOHAWK/Leviathan activity targeting government, industry, academic, maritime, defense, and related sectors. The content does not provide specific indicators of compromise for MURKYTOP beyond the filename mt.exe.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Tools Nanhaishu, Orz, SeDll, Cobalt Strike, GreenCrash, AIRBREAK, BlackCoffee, China Chopper, FUSIONBLAZE, HOMEFRY, MURKYTOP, Metasploit / Meterpreter, ScanBox, Derusbi Trojan, Derusbi, Metasploit
10 distinct techniques documented for this family, organized by ATT&CK tactic.
During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.
During the 2015 Ukraine Electric Power Attack, Sandworm Team remotely discovered systems over LAN connections. OT systems were visible from the IT network as well, giving adversaries the ability to discover operational assets.
The content repeatedly describes threat actors and malware performing network scanning, port scanning, service enumeration, OS fingerprinting, and identifying open ports/services across victim environments.
The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.
“actors used the following commands… to enumerate user accounts: net user >> %temp%\download; net user /domain >> %temp%\download … APT1 used the commands net localgroup, net user, and net group to find accounts… APT32 enumerated administrative users using the commands net localgroup administrators … OilRig has run net user, net user /domain, net group "domain admins" /domain …”
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Command-line reconnaissance tool that can also support lateral movement activities.
A backdoor capable of identifying remote hosts on connected networks.
Backdoor malware capable of scanning connected networks for hosts with open ports.
Malware capable of identifying remote hosts on connected networks.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.