MalwareUsed by 1 actor

TrailBlazer

TrailBlazer is a modular malware associated with Russian SVR cyber actors, including APT29/Cozy Bear activity. It has been described as custom, sophisticated malware used in multi-platform operations targeting Windows and Linux systems, and as an implant capable of collecting sensitive information. Reported behaviors include persistence via Windows Management Instrumentation (WMI), specifically WMI event subscription mechanisms. TrailBlazer has hidden its binary or process under legitimate-looking filenames and has used filenames matching the compromised system name to reduce detection. For command-and-control evasion, it has used random identifier strings to obscure C2 operations and result codes, and it can masquerade its HTTP C2 traffic as legitimate Google Notifications requests. High-confidence indicators and behaviors mentioned in the source are WMI-based persistence, legitimate-filename masquerading, host-name-based file naming, random C2 identifiers, and Google Notifications-themed HTTP C2 traffic.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

APT29

SVR cyber actors’ novel tooling and techniques include: Custom, sophisticated multi-platform malware targeting Windows and Linux systems (e.g., GoldMax and TrailBlazer)

via cisa advisoriescisa.gov

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1195Supply Chain CompromiseEvidence1

SVR cyber threat actors were responsible for the SolarWinds Orion supply chain compromise and the associated campaign that affected U.S. government agencies, critical infrastructure entities, and private sector organizations.

Persistence

1 technique

T1546.003Windows Management Instrumentation Event SubscriptionEvidence2

Multiple actors and tools (e.g., APT29, APT33, FIN8, Turla, Blue Mockingbird, PoshC2, POSHSPY, RegDuke, SeaDuke) are described as using WMI event subscriptions/filters/consumers to establish persistence, including triggering at system boot or on specific process start (e.g., WINWORD.EXE).

Privilege Escalation

1 technique

T1546.003Windows Management Instrumentation Event SubscriptionEvidence2

Stealth

1 technique

T1036MasqueradingEvidence1

Credential Access

1 technique

T1539Steal Web Session CookieEvidence1

Lateral movement via the “credential hopping” technique, which includes browser cookie theft to bypass multifactor authentication (MFA) on privileged cloud accounts.

Lateral Movement

1 technique

T1570Lateral Tool TransferEvidence1

SVR cyber actors have used a range of initial exploitation techniques... coupled with stealthy intrusion tradecraft within compromised networks... Lateral movement via the “credential hopping” technique...

Command and Control

3 techniques

T1001Data ObfuscationEvidence1

T1001.001Junk DataEvidence1

T1071.001Web ProtocolsEvidence4

The content repeatedly describes threat actors and malware using HTTP and HTTPS for command and control, such as: "Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests."

ACTIVITY FEED

Recent activity

9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

9 SOURCESView more in app

mitre attack websiteNews

Oct 1, 2019

Event Triggered Execution: Windows Management Instrumentation Event Subscription, Sub-technique T1546.003 - Enterprise | MITRE ATT&CK®

Malware that can use WMI to establish persistence.

cyber njNews

Jan 1, 2008

Russia - APT29 | NJCCIC

Implant used for persistence and command-and-control, disguised with legitimate filenames and maintained through WMI event subscription.

mitre attackNews

Jan 24, 2026

Data Obfuscation, Technique T1001 - Enterprise | MITRE ATT&CK®

Masquerades C2 traffic as legitimate Google Notifications HTTP requests.

mitre attackNews

Jan 24, 2026

Masquerading, Technique T1036 - Enterprise | MITRE ATT&CK®

Malware that uses environment-specific filenames (matching hostnames) to blend into victim systems and evade detection.

+4 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

TrailBlazer