Loading malware…
Attor is a modular Windows cyberespionage platform active since at least 2013 and publicly documented in 2019. It has been used in highly targeted operations against a small number of government and diplomatic victims, with a particular focus on Russian-speaking and Russia-based targets, including victims in Eastern Europe. The malware is built around a central dispatcher that manages multiple plugins, allowing operators to tailor capabilities per victim.
Documented Attor functionality includes screenshot capture of targeted applications, keylogging and credential collection, clipboard collection, audio recording, monitoring of inserted storage devices and connected modems or phones, exfiltration over its command-and-control channel, and cleanup of collected files and logs after exfiltration. A notable and uncommon capability is GSM device fingerprinting via AT commands over serial COM interfaces, used to collect metadata such as device manufacturer, model, software version, carrier information, and identifiers from connected modems or older phones. This suggests an espionage use case involving peripheral-aware victim profiling.
Attor supports multiple persistence mechanisms, including scheduled tasks, Registry Run key modification, and registration of a new Windows service. It has also used rundll32-based loading and CreateProcessW for execution. For defense evasion, it can hide artifacts by setting file and directory attributes such as hidden and system, and its plugin architecture has been protected with asymmetric encryption. Collected data has been encrypted with a randomly generated Blowfish key protected by RSA. Attor communications have been associated with Tor-based, layered command-and-control designed to complicate tracing and analysis. Overall, Attor is a sophisticated espionage implant set distinguished by modular surveillance features, strong operational security, and rare mobile-device fingerprinting tradecraft.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This persistence trick is used by APT28 group and software like Attor and Zebrocy at the wild.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
The same COM object may be created from VBScript, PowerShell, Python, or C/C++... The same plugin also contains COM exposed functionality for launching VBScript and PowerShell through COM client code.
The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.
Background Intelligent Transfer Service (BITS) is another COM-exposed Windows service that attackers use... The IBackgroundCopyJob interface is used to add files to a job, set priority, determine state, and start or stop transfers. Malware using this interface may perform payload download, staging, or exfiltration... In the example used here, the Attor plugin uses IBackgroundCopyJob to communicate with a C2 server.
UserInitMprLogonScript Windows enables the execution of logon scripts whenever a user or group of users logs into a system. Adding a script’s path to the HKCU\Environment\UserInitMprLogonScript Registry key accomplishes this.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.
Background Intelligent Transfer Service (BITS) is another COM-exposed Windows service that attackers use... The IBackgroundCopyJob interface is used to add files to a job, set priority, determine state, and start or stop transfers. Malware using this interface may perform payload download, staging, or exfiltration... In the example used here, the Attor plugin uses IBackgroundCopyJob to communicate with a C2 server.
UserInitMprLogonScript Windows enables the execution of logon scripts whenever a user or group of users logs into a system. Adding a script’s path to the HKCU\Environment\UserInitMprLogonScript Registry key accomplishes this.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.
Background Intelligent Transfer Service (BITS) is another COM-exposed Windows service that attackers use... The IBackgroundCopyJob interface is used to add files to a job, set priority, determine state, and start or stop transfers. Malware using this interface may perform payload download, staging, or exfiltration... In the example used here, the Attor plugin uses IBackgroundCopyJob to communicate with a C2 server.
Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations.
The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."
The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, sw_vers -productVersion, and fsutil.
The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.
Numerous entries mention enumerating drives, logical disks, disk type, free space, or volume information; examples include 'Babuk can enumerate disk volumes,' 'Cuba can enumerate local drives,' and 'TAINTEDSCRIBE can use DriveList to retrieve drive information.'
The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.
The content is a MITRE ATT&CK-style listing of malware and threat actors that "can capture screenshots," "take screenshots," "perform screen captures," or "watch the victim's screen." It ends with references to "CopyFromScreen" and "xwd."
Agrius used a custom tool, sql.net4.exe, to query SQL databases and then identify and extract personally identifiable information... AppleSeed has automatically collected data from USB drives, keystrokes, and screen images before exfiltration... Ember Bear engages in mass collection from compromised systems during intrusions.
Attor also incorporates Tor to avoid tracking, and distributes network communications to help thwart analysis. “Plugins themselves are heavily synchronized, with network communication alone being spread across four different components, each implementing a different layer,” explained researchers.
Tor is used for communication, aiming for anonymity and untraceability, and the overall setup makes it impossible to analyze the communication unless all pieces of the puzzle have been collected.
85 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Windows-based modular cyberespionage platform with plugins managed by a dispatcher component. Reported capabilities include screen capture, audio recording, keylogging, clipboard capture, file collection and upload, process/window monitoring, persistence, Tor-based C2 communications, and GSM/GPRS device fingerprinting. In the COM example, it uses BITS via IBackgroundCopyJob for C2 communications and uses COM-exposed functionality to launch VBScript and PowerShell and enumerate endpoint security software via IWbemClassObject.
Named malware/tool referenced in the content without additional description.
Malware capable of altering last-access times on files and registry keys for anti-forensics.
Malware whose dispatcher injects into running processes for privilege escalation and evasion.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.