Malware

BACKSPACE

Also known asLecna

BACKSPACE, also known as Lecna, is a Windows backdoor associated with targeted intrusion activity and long-running espionage operations, including activity observed in Southeast Asia. It has been used against government, telecommunications, transportation, financial, high-technology, energy, and education targets, and has been linked in reporting to advanced persistent threat operations.

BACKSPACE provides remote access and post-compromise control over infected hosts. Documented capabilities include collecting operating system information, enumerating running processes, querying and modifying the Windows Registry, searching for files and directories, executing commands through the Windows command shell, creating reverse-shell functionality, uploading files to command-and-control infrastructure, and relaying traffic through an internal proxy mechanism in at least one variant. Newer variants have used custom non-standard encoding for command-and-control traffic, and the malware has been described as using web protocols and multi-stage command channels.

For persistence, BACKSPACE has been observed creating a shortcut to itself in the Windows Startup folder and is also associated with Registry Run key or Startup-folder-based autostart execution. It can also impair defenses by modifying system firewall settings. Overall, BACKSPACE is best characterized as an espionage-oriented Windows backdoor with discovery, persistence, command execution, registry manipulation, proxying, and exfiltration capabilities.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059.003Windows Command ShellEvidence3

Numerous entries state malware can create a remote shell or reverse shell, for example 4H RAT, BLACKCOFFEE, DarkComet, PlugX, QuasarRAT, and others. | The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

Persistence

4 techniques

T1112Modify RegistryEvidence8

ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

T1547Boot or Logon Autostart ExecutionEvidence1

C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

T1547.001Registry Run Keys / Startup FolderEvidence6

The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.

T1547.009Shortcut ModificationEvidence3

Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Adversaries may abuse shortcuts in the startup folder to execute their tools and achieve persistence.

Privilege Escalation

3 techniques

T1547Boot or Logon Autostart ExecutionEvidence1

T1547.001Registry Run Keys / Startup FolderEvidence6

T1547.009Shortcut ModificationEvidence3

Stealth

1 technique

T1070Indicator RemovalEvidence1

Bisonal has deleted Registry keys to clean up its prior activity; FIN8 has deleted Registry keys during post compromise cleanup activities; SUNBURST deleted previously-created IFEO Debugger registry values and proxy-related keys to clean up traces of activity.

Defense Impairment

1 technique

T1112Modify RegistryEvidence8

Discovery

4 techniques

T1012Query RegistryEvidence3

The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."

T1057Process DiscoveryEvidence4

Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.

T1082System Information DiscoveryEvidence7

The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, BIOS, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, and WMI to gather host information.

T1083File and Directory DiscoveryEvidence4

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence5

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

T1132.002Non-Standard EncodingEvidence1

Adversaries may encode data with a non-standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a non-standard data encoding system that diverges from existing protocol specifications.

T1219Remote Access ToolsEvidence1

4H RAT has the capability to create a remote shell. AuditCred can open a reverse shell on the system to execute commands. PlugX allows actors to spawn a reverse shell on a victim. QuasarRAT can launch a remote shell to execute commands on the victim’s machine.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence3

ADVSTORESHELL exfiltrates data over the same channel used for C2.

ACTIVITY FEED

Recent activity

32 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

32 SOURCESView more in app

mitre attack websiteNews

Oct 21, 2021

Exfiltration Over C2 Channel, Technique T1041 - Enterprise | MITRE ATT&CK®

Backdoor that can upload files from a victim system to its C2 server.

mitre attack websiteNews

Oct 21, 2021

Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Sub-technique T1547.001 - Enterprise | MITRE ATT&CK®

Malware that persists by placing a shortcut to itself in the Startup directory.

mitre attack websiteNews

Oct 21, 2021

Modify Registry, Technique T1112 - Enterprise | MITRE ATT&CK®

Backdoor with capability to delete Registry keys, subkeys, and values.

mitre attack websiteNews

Oct 21, 2021

Process Discovery, Technique T1057 - Enterprise | MITRE ATT&CK®

Backdoor malware that may collect information about running processes.

+28 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

BACKSPACE

Also known asLecna