MalwareUsed by 1 actor

HyperStack

HyperStack is a custom Windows backdoor used by the Russian state-sponsored Turla espionage group. It has been observed in intrusions against government organizations and is part of a broader Turla toolset that has included Carbon and Kazuar. HyperStack is an RPC-based backdoor designed for stealthy remote command execution, persistence, and movement within Windows networks.

HyperStack uses named pipes to receive and execute remote procedure call commands from an operator-controlled system. It has been documented modifying system configuration to make its communication pipe anonymously accessible and to permit anonymous enumeration of remote resources, enabling operation over SMB/RPC mechanisms. It can connect to remote IPC$ shares, enumerate account names on remote shares, detect incoming named-pipe connections, and use remote-share connectivity to forward commands to other systems. These behaviors support lateral movement inside compromised environments.

The malware has also been associated with service-based persistence and long-term access on infected hosts. Reporting has described it installing itself as a Windows service with elevated privileges and storing configuration data locally. HyperStack has used RSA encryption to protect command-and-control communications. In Turla operations, RPC-based backdoors including HyperStack were used alongside remote administration trojans to execute commands, transmit results, and exfiltrate data from victim networks.

HyperStack is most strongly associated with espionage activity targeting government entities, fitting Turla’s long-running pattern of maintaining covert, redundant access in high-value diplomatic and governmental networks.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Turla

Turla uses HyperStack, Carbon, and Kazuar to compromise government entity.

via mitre attack websiteattack.mitre.org

MITRE ATT&CK

Techniques & procedures

20 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1078.001Default AccountsEvidence1

Execution

4 techniques

T1059Command and Scripting InterpreterEvidence1

MITRE ATT&CK techniques Tactic Technique ID Technique name Execution T1059 ... Command-line Interface

T1106Native APIEvidence2

The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.

T1559Inter-Process CommunicationEvidence1

T1569System ServicesEvidence1

MITRE ATT&CK techniques Tactic Technique ID Technique name Execution T1059 T1569 Command-line Interface Service Execution

Persistence

3 techniques

T1078.001Default AccountsEvidence1

T1112Modify RegistryEvidence7

ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

T1543Create or Modify System ProcessEvidence1

The HyperStack backdoor first copies itself to C:\ADSchemeIntegrity.exe and then installs itself with system-level privileges as the service Active Directory Scheme Integrity Service.

Privilege Escalation

2 techniques

T1078.001Default AccountsEvidence1

T1543Create or Modify System ProcessEvidence1

The HyperStack backdoor first copies itself to C:\ADSchemeIntegrity.exe and then installs itself with system-level privileges as the service Active Directory Scheme Integrity Service.

Stealth

1 technique

T1078.001Default AccountsEvidence1

Defense Impairment

1 technique

T1112Modify RegistryEvidence7

Discovery

4 techniques

T1012Query RegistryEvidence1

MITRE ATT&CK techniques ... Discovery ... T1012 Query Registry ... Upon execution, HyperStack undergoes a similar registry key check ... and updates the same registry key to determine which named pipes can be accessed anonymously.

T1087Account DiscoveryEvidence1

“actors used the following commands… to enumerate user accounts: net user >> %temp%\download; net user /domain >> %temp%\download … APT1 used the commands net localgroup, net user, and net group to find accounts… APT32 enumerated administrative users using the commands net localgroup administrators … OilRig has run net user, net user /domain, net group "domain admins" /domain …”

T1087.001Local AccountEvidence1

T1135Network Share DiscoveryEvidence1

MITRE ATT&CK techniques ... Discovery T1135 ... Network Share Discovery ... HyperStack sets the registry key ... Restrict Anonymous value to 0 so anonymous logon users can list all account names and enumerate all shared resources on a remote share.

Lateral Movement

2 techniques

T1021Remote ServicesEvidence1

MITRE ATT&CK techniques ... Lateral Movement T1021 Windows Admin Shares ... To move laterally, the implant tries to connect to another remote device’s IPC$ share, either using a null session or default credentials.

T1021.002SMB/Windows Admin SharesEvidence1

"HermeticWizard can connect to remote shares using WNetAddConnection2W"; "HyperStack ... WNetAddConnection2 to ... connect to remote shares"

Command and Control

7 techniques

T1001Data ObfuscationEvidence1

MITRE ATT&CK techniques ... Command and Control ... T1001 Data Obfuscation ... When accessing the Pastebin URL, an encrypted blob is downloaded that requires a corresponding RSA private key from the configuration file.

T1071Application Layer ProtocolEvidence1

Accenture researchers recently identified novel command and control (C&C) configurations for Turla’s Carbon and Kazuar backdoors on the same victim network.

T1095Non-Application Layer ProtocolEvidence1

attackers used a combination of recently updated remote administration trojans (RATs) and remote procedure call (RPC)-based backdoors including HyperStack

T1105Ingress Tool TransferEvidence1

To compromise the organization's network, the attackers used a combination of recently updated remote administration trojans (RATs) and remote procedure call (RPC)-based backdoors including HyperStack

T1219Remote Access ToolsEvidence1

the attackers used a combination of recently updated remote administration trojans (RATs) and remote procedure call (RPC)-based backdoors

T1573Encrypted ChannelEvidence1

The content is a catalog of malware and threat groups that encrypt command-and-control communications using algorithms such as DES, AES, RC4, XOR, Blowfish, RSA, Camellia, RC2, RC6, and custom ciphers.

T1573.001Symmetric CryptographyEvidence1

ACTIVITY FEED

Recent activity

14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

14 SOURCESView more in app

mitre attack websiteNews

Jan 1, 2024

Inter-Process Communication, Technique T1559 - Enterprise | MITRE ATT&CK®

Backdoor that can connect to remote IPC$ shares.

mitre attack websiteNews

Oct 21, 2021

Native API, Technique T1106 - Enterprise | MITRE ATT&CK®

Malware that uses Windows APIs to detect incoming connections and access remote shares.

mitre attack websiteNews

Oct 21, 2021

Encrypted Channel: Symmetric Cryptography, Sub-technique T1573.001 - Enterprise | MITRE ATT&CK®

Backdoor that uses RSA encryption for C2 communications.

mitre attack websiteNews

Oct 21, 2021

Compromise Infrastructure: Server, Sub-technique T1584.004 - Enterprise | MITRE ATT&CK®

HyperStack is named in a reference title as malware/tooling used by Turla to compromise a government entity; no further detail is provided in the content.

+10 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping20

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

HyperStack