Loading malware…
BADHATCH is a Windows backdoor used by the financially motivated threat group FIN8 and first publicly documented in 2019. It supports post-compromise operations including command execution, reconnaissance, privilege escalation, lateral movement, file transfer, screenshot capture, and data exfiltration. It has been deployed in intrusions affecting insurance, retail, technology, chemical, and financial organizations across multiple countries.
BADHATCH is deployed through downloaded PowerShell scripts and a multistage loading chain involving a .NET loader, architecture-specific shellcode, and an embedded compressed DLL. Its components can execute in memory and inject into legitimate Windows processes using asynchronous procedure calls or remote-thread creation. Persistence mechanisms include WMI event subscriptions and scheduled tasks. Privilege-elevation functionality includes privileged-token impersonation and UAC bypass through the CMSTPLUA COM interface and SilentCleanup scheduled task. Version 2.14 additionally supports operator-supplied NTLM pass-the-hash functionality in 64-bit builds.
The backdoor provides command-shell and PowerShell execution modes, in-memory DLL loading, system and user discovery, domain administrator enumeration, remote WMI queries, connectivity checks, and TCP port discovery. It can upload and download files, capture screenshots, and exfiltrate information over its command-and-control channel. Communications use TLS and support SOCKS4, SOCKS5, HTTP, and reverse proxying. Evasion features include encoded PowerShell commands, encrypted loader components, impersonation of legitimate Microsoft update traffic, and suspension of the Windows Event Log service's main thread. Observed deployment occurs after compromise; the initial access mechanism in investigated FIN8 intrusions was not established.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
“The FIN8 group uses, among other tools, a fully featured backdoor called BADHATCH, first documented by GIGAMON in 2019.”
46 distinct techniques documented for this family, organized by ATT&CK tactic.
wmic.exe /node:<local ip of DC> process call create ... The deployment of the BADHATCH on Domain Controller.
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
BADHATCH can utilize the CMSTPLUA COM interface and the SilentCleanup task to bypass UAC. CHIMNEYSWEEP can make use of the Windows SilentCleanup scheduled task to execute its payload with elevated privileges. CSPY Downloader can bypass UAC using the SilentCleanup task to execute the binary with elevated privileges.
The content repeatedly describes threat actors and malware using PowerShell scripts/commands for execution, download, staging, reconnaissance, persistence, credential access, lateral movement, and defense evasion; e.g., "Sandworm Team used PowerShell scripts to run a credential harvesting tool in memory to evade defenses."
During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.
Avaddon bypasses UAC using the CMSTPLUA COM interface... LockBit 3.0 can bypass UAC to execute code with elevated privileges through an elevated Component Object Model (COM) interface. Medusa Group has attempted to bypass UAC using Component Object Model (COM) interface.
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
BADHATCH can utilize the CMSTPLUA COM interface and the SilentCleanup task to bypass UAC. CHIMNEYSWEEP can make use of the Windows SilentCleanup scheduled task to execute its payload with elevated privileges. CSPY Downloader can bypass UAC using the SilentCleanup task to execute the binary with elevated privileges.
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
BADHATCH can utilize the CMSTPLUA COM interface and the SilentCleanup task to bypass UAC. CHIMNEYSWEEP can make use of the Windows SilentCleanup scheduled task to execute its payload with elevated privileges. CSPY Downloader can bypass UAC using the SilentCleanup task to execute the binary with elevated privileges.
inject <PID> — Injects the BADHATCH into the process with the given PID.
ROKRAT can use VirtualAlloc, WriteProcessMemory, and then CreateRemoteThread to execute shellcode within the address space of Notepad.exe. Ryuk has injected itself into remote processes to encrypt files using a combination of VirtualAlloc, WriteProcessMemory, and CreateRemoteThread. Woody RAT can inject code into a targeted process by writing to the remote memory of an infected system and then create a remote thread.
sv — Injects itself into a new “svchost.exe –k netsvcs” process using APC.
sys — Impersonates lsass.exe/vmtoolsd.exe token, then follows the same steps as in the case of sv option.
If a token is obtained – it is used to call CreateProcessAsUserW.
The content repeatedly describes malware and threat actors that 'bypass UAC,' 'perform UAC bypass,' or use specific Windows components such as fodhelper.exe, eventvwr.exe, sdclt.exe, CMSTPLUA COM interface, SilentCleanup, and registry hijacks to gain elevated privileges.
inject <PID> — Injects the BADHATCH into the process with the given PID.
ROKRAT can use VirtualAlloc, WriteProcessMemory, and then CreateRemoteThread to execute shellcode within the address space of Notepad.exe. Ryuk has injected itself into remote processes to encrypt files using a combination of VirtualAlloc, WriteProcessMemory, and CreateRemoteThread. Woody RAT can inject code into a targeted process by writing to the remote memory of an infected system and then create a remote thread.
sv — Injects itself into a new “svchost.exe –k netsvcs” process using APC.
The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.
sys — Impersonates lsass.exe/vmtoolsd.exe token, then follows the same steps as in the case of sv option.
If a token is obtained – it is used to call CreateProcessAsUserW.
APT19 used Base64 to obfuscate executed commands; APT32 used Invoke-Obfuscation to obfuscate PowerShell; Aquatic Panda encoded PowerShell commands in Base64; numerous groups and malware used Base64, XOR, RC4, compression, encryption, variable substitution, and other methods to obfuscate scripts and commands.
ipconfig.exe /all
During the 2015 Ukraine Electric Power Attack, Sandworm Team remotely discovered systems over LAN connections. OT systems were visible from the IT network as well, giving adversaries the ability to discover operational assets.
whoami.exe
The content repeatedly describes threat actors and malware performing network scanning, port scanning, service enumeration, OS fingerprinting, and identifying open ports/services across victim environments.
netstat.exe –f
tasklist.exe /v| findstr.exe explorer
Examples include 'TrickBot can identify the user and groups the user belongs to on a compromised host' and multiple entries checking whether the current user is an administrator or has elevated privileges.
Multiple tools/actors are described using Active Directory/domain group enumeration, e.g., “AdFind can enumerate domain groups”, “net group "domain admins" /domain to enumerate domain groups”, “BloodHound can collect information about domain groups and members”, and “AD Explorer tool to enumerate groups on a victim's network.”
systeminfo.exe ... These commands reflect the system fingerprinting.
Multiple malware and threat groups are described as collecting/deriving local system time, date, timestamp, tick count, or time zone (e.g., "used time /t and net time \ip/hostname for system time discovery"; "collects the timestamp from the victim’s machine"; "can collect the time zone information from the system").
nltest.exe /domain_trusts
“The APT1 group is known to have used pass the hash.” / “APT28 has used pass the hash for lateral movement.” / “CrackMapExec can pass the hash to authenticate via SMB.” / “Mimikatz's SEKURLSA::Pth module can impersonate a user, with only a password hash…”
"Agent Tesla can capture screenshots of the victim’s desktop"; "AppleSeed can take screenshots on a compromised host"; "APT28 has used tools to take screenshots from victims"; "Cobalt Strike's Beacon payload is capable of capturing screenshots"; "PowerSploit's Get-TimedScreenshot Exfiltration module can take screenshots at regular intervals"; "Hydraq includes a component based on the code of VNC that can stream a live feed of the desktop"
The content repeatedly describes threat actors and malware using HTTP and HTTPS for command and control, such as: "Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests."
"Aria-body has the ability to use a reverse SOCKS proxy module." / "BADHATCH can use SOCKS4 and SOCKS5 proxies..." / "Neo-reGeorg... establish a SOCKS5 proxy" / "Remcos uses the infected hosts as SOCKS5 proxies"
"APT41 used a tool called CLASSFON to covertly proxy network communications." / "BADCALL functions as a proxy server between the victim and C2 server." / "Sandworm Team's BCS-server tool can create an internal proxy server to redirect traffic..."
Aria-body has the ability to use a reverse SOCKS proxy module... BADHATCH can use SOCKS4 and SOCKS5 proxies... GoBear implements SOCKS5 proxy functionality... Neo-reGeorg has the ability to establish a SOCKS5 proxy... Remcos uses the infected hosts as SOCKS5 proxies...
The content repeatedly describes malware and threat actors using SSL, TLS, HTTPS, RSA, AES, Blowfish, RC4, ECIES, Diffie-Hellman, OpenSSL, WolfSSL, and mutual TLS to protect command and control traffic.
Multiple malware families and intrusion sets are described as encrypting C2 traffic using SSL/TLS/HTTPS (e.g., "used HTTPS for command and control", "encrypts C2 communications with TLS", "uses SSL for encrypting C2 communications", "TLS-encrypted WebSocket Protocol (WSS) for C2").
ADVSTORESHELL exfiltrates data over the same channel used for C2... Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers... numerous malware and groups sent victim data, files, credentials, or host information over existing C2 channels.
35 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
47 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.