Loading malware…
SideTwist is a Windows backdoor used by the Iranian-linked cyberespionage group APT34, also known as OilRig and Helix Kitten. It was identified in an April 2021 campaign against Lebanese organizations and has subsequently appeared in phishing operations targeting enterprise victims. Its capabilities include remote command execution, file download and upload, host reconnaissance, and data exfiltration over its command-and-control channel.
SideTwist collects the current username, computer name, and local domain name using Windows APIs, including GetUserNameW, GetComputerNameW, and GetComputerNameExW. A documented variant derives a unique victim identifier from this information. Command-and-control traffic uses Base64 encoding and encryption, with multi-byte XOR implemented in a documented variant. SideTwist primarily communicates over port 443 and can fall back to port 80; use of port 443 does not necessarily indicate TLS, as a variant communicates using HTTP. Commands can be concealed within HTML script content, and command results are returned through HTTP POST requests.
Documented delivery uses malicious macros in Word documents, including a lure impersonating a marketing-services company. The macros extract and deploy the backdoor and establish persistence through a scheduled task that runs every five minutes. In this implementation, the backdoor performs one command-and-control session per execution and relies on the task for recurring activity. It also checks for a deployment-created trigger file and exits when that file is absent, providing an anti-sandbox execution check.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A new APT34 campaign targeting Lebanese organizations, deploying a new backdoor variant called SideTwist.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
Several entries refer generically to command-line interfaces, shell commands, scripting engines, or script execution without always specifying the exact interpreter.
AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.
The content repeatedly describes malware and threat actors collecting the username, identifying the current user, enumerating logged-on users, or running commands such as whoami, query user, and quser to determine user context on compromised systems.
Andariel has collected large numbers of files from compromised network systems for later extraction... APT28 has retrieved internal documents from machines inside victim environments... BADNEWS crawls the victim's local drives and collects documents... many listed groups and malware collect files, documents, credentials, payment card data, or other information from compromised hosts.
APT41 used the Steam community page as a fallback mechanism for C2. Bazar has the ability to use an alternative C2 server if the primary server fails. BISCUIT malware contains a secondary fallback command and control server that is contacted after the primary command and control server.
The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications. | Specific implementations mentioned include 'HTTP POST requests,' 'HTTP GET requests,' 'custom HTTP cookies,' 'Cookie HTTP header,' 'HTTP Upgrade request' for WebSocket initiation, and use of APIs such as 'Microsoft Graph API' or 'Dropbox HTTP API' for C2.
The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."
ADVSTORESHELL C2 traffic is encrypted, then encoded with Base64 encoding. APT19 HTTP malware variant used Base64 to encode communications to the C2 server. APT33 has used base64 to encode command and control traffic.
8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor observed in a 2021 campaign against Lebanese organizations. A variant was subsequently delivered through phishing in 2023, using a fake African government license-registration form to target a Saudi Arabian victim.
A backdoor malware previously associated with APT34. In this content it is used as the comparison point for Menorah, with noted similarities in victim fingerprinting, C2 communication, shell command execution, and file upload/download capabilities.
APT34-used trojan/backdoor variant that establishes persistence via a scheduled task, checks for an update.xml file as an anti-sandbox gate, collects host identifiers, communicates with a C2 over HTTP, executes shell commands, downloads files, uploads local files, and then exits until reinvoked.
Backdoor that can collect the username on a targeted system.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.