Malware

SHUTTERSPEED

SHUTTERSPEED is malware associated with screen-capture collection on compromised systems. Its documented capability is the capture of screenshots from victim hosts, indicating use for surveillance, operator situational awareness, or collection of sensitive on-screen information during post-compromise activity. No high-confidence information is available here about its malware family classification, delivery vector, platform specificity, persistence mechanisms, or broader intrusion workflow beyond screenshot capture.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

3 distinct techniques documented for this family, organized by ATT&CK tactic.

Discovery

1 technique

T1082System Information DiscoveryEvidence9

The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."

Collection

1 technique

T1113Screen CaptureEvidence4

The content is a MITRE ATT&CK-style listing of malware and threat actors that "can capture screenshots," "take screenshots," "perform screen captures," or "watch the victim's screen." It ends with references to "CopyFromScreen" and "xwd."

Command and Control

1 technique

T1105Ingress Tool TransferEvidence2

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

mitre attack websiteNews

Oct 21, 2021

Screen Capture, Technique T1113 - Enterprise | MITRE ATT&CK®

Backdoor malware with screenshot capture capability.

mitre attack websiteNews

Jan 1, 2021

Screen Capture, Technique T1113 - Enterprise | MITRE ATT&CK®

Backdoor malware capable of capturing screenshots.

mitre attackNews

Jan 25, 2026

Screen Capture, Technique T1113 - Enterprise | MITRE ATT&CK®

Backdoor with screenshot capture capability.

mitre attackNews

Jan 25, 2026

Screen Capture, Technique T1113 - Enterprise | MITRE ATT&CK®

Backdoor with screenshot capture capability.

+1 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping3

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

SHUTTERSPEED