Malware

SUGARUSH

SUGARUSH is malware used by UNC3890 in campaign C0010. The provided content identifies it as unique/custom malware used alongside SUGARDUMP. Observed behavior includes creating a Windows service named "Service1" for persistence, checking for internet connectivity from an infected host before attempting to establish a new TCP connection, and using TCP for command-and-control communications, including over TCP port 4585. The content also references versions v1.0 to v1.1. Campaign context in the source material states UNC3890 likely operated a watering-hole on the login page of a legitimate Israeli shipping company, used lookalike domains impersonating services such as LinkedIn, Facebook, Office 365, and Pfizer, and downloaded or staged malware and tools for direct delivery onto compromised systems. High-confidence indicators and artifacts directly mentioned in the content include the service name "Service1" and C2 port 4585/TCP.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059.003Windows Command ShellEvidence3

During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.

Persistence

1 technique

T1543.003Windows ServiceEvidence3

During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.

Privilege Escalation

1 technique

T1543.003Windows ServiceEvidence3

Discovery

3 techniques

T1016.001Internet Connection DiscoveryEvidence1

T1049System Network Connections DiscoveryEvidence1

Multiple actors and malware check for internet/network connectivity using ping, tracert, HTTP GET requests, or contacting well-known domains (e.g., google[.]com, bing[.]com, 8.8.8.8) prior to tool transfer or C2 establishment.

T1680Local Storage DiscoveryEvidence1

Command and Control

2 techniques

T1095Non-Application Layer ProtocolEvidence1

T1571Non-Standard PortEvidence1

ACTIVITY FEED

Recent activity

11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

11 SOURCESView more in app

mitre attack websiteNews

Oct 28, 2025

Updates | MITRE ATT&CK®

... SUGARUSH ... (v1.0→v1.1) ...

mitre attack websiteNews

Oct 28, 2025

Updates - Updates - October 2025 | MITRE ATT&CK®

SUGARUSH (v1.0→v1.1)

mitre attack websiteNews

May 1, 2020

System Network Configuration Discovery: Internet Connection Discovery, Sub-technique T1016.001 - Enterprise | MITRE ATT&CK®

Malware that verifies internet connectivity before creating a new TCP connection.

mitre attack websiteNews

Mar 8, 2018

Create or Modify System Process: Windows Service, Sub-technique T1543.003 - Enterprise | MITRE ATT&CK®

Malware that creates a Windows service named Service1 for persistence.

+7 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

SUGARUSH