MalwareUsed by 1 actor

Psylo

Psylo is a Windows trojan associated with Scarlet Mimic activity and linked through infrastructure overlap with MobileOrder operations targeting the Uyghur community and related individuals. It uses HTTPS for command-and-control communications and exfiltrates stolen data over the same channel, reducing the need for separate outbound transfer mechanisms. Documented functionality includes anti-forensic timestamp manipulation through timestomping, specifically setting a chosen file’s timestamps to match those of a legitimate system file in the Windows system directory. The available reporting supports Psylo as a Windows espionage-oriented implant focused on covert command-and-control, data theft, and defense evasion.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Scarlet Mimic

we observed multiple overlaps in the infrastructure between the new samples and the old MobileOrder malware variant, as well as multiple variants of Windows Psylo Trojan previously attributed to Scarlet Mimic, that interact with the same malicious domains as the mobile malware.

via checkpoint research blogresearch.checkpoint.com

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Stealth

1 technique

T1070.006TimestompEvidence2

APT28 has performed timestomping on victim files. APT29 has used timestomping to alter the Standard Information timestamps on their web shells to match other files in the same directory. APT32 has used scheduled task raw XML with a backdated timestamp... APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.

Discovery

1 technique

T1083File and Directory DiscoveryEvidence5

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence5

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

T1105Ingress Tool TransferEvidence2

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence4

ADVSTORESHELL exfiltrates data over the same channel used for C2.

ACTIVITY FEED

Recent activity

9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

9 SOURCESView more in app

mitre attack websiteNews

Sep 30, 2024

Indicator Removal: Timestomp, Sub-technique T1070.006 - Enterprise | MITRE ATT&CK®

Malware with a command to copy timestamps from legitimate System32 files onto specified files.

checkpoint research blogNews

Sep 22, 2022

7 Years of Scarlet Mimic’s Mobile Surveillance Campaign Targeting Uyghurs - Check Point Research

A Windows trojan previously attributed to Scarlet Mimic that shares infrastructure overlaps with the MobileOrder campaign.

mitre attack websiteNews

Oct 21, 2021

Exfiltration Over C2 Channel, Technique T1041 - Enterprise | MITRE ATT&CK®

Malware that exfiltrates data to its C2 server using the same protocol as its C2 traffic.

mitre attack websiteNews

May 20, 2015

Exfiltration Over C2 Channel, Technique T1041 - Enterprise | MITRE ATT&CK®

Backdoor that exfiltrates data to C2 using the same protocol as its command traffic.

+5 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Psylo