MalwareUsed by 1 actor

MCMD

MCMD is a Windows remote access trojan associated with the Russia-linked IRON LIBERTY espionage group, also known as Energetic Bear or Dragonfly. It has been used in intrusion activity targeting sectors of strategic interest, including energy, nuclear, and defense organizations. MCMD is designed to provide remote access and operator control over compromised systems while minimizing user visibility and maintaining persistence across reboots and logons.

Observed MCMD behavior includes establishing persistence through Windows Scheduled Tasks and Registry Run keys. It also employs defense-evasion measures by modifying process presentation so activity is not visible on the desktop, and it has been disguised with benign-looking names to reduce suspicion. In addition to maintaining access, MCMD supports file transfer from infected hosts, including uploading files from victim systems, indicating a role in collection and exfiltration workflows typical of espionage operations.

The available information supports classifying MCMD as a RAT focused on persistent remote control, stealthy execution, and operator-driven data theft from Windows endpoints.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Dragonfly

To provide additional insights about IRON LIBERTY and its malware, Secureworks Counter Threat Unit™ (CTU) researchers are publishing an analysis of the threat group and details about the Karagany malware and the MCMD remote access trojan (RAT).

via sophos threat researchsophos.com

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

3 techniques

T1053Scheduled Task/JobEvidence1

“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”

T1053.005Scheduled TaskEvidence3

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

T1059.003Windows Command ShellEvidence3

The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

Persistence

4 techniques

T1053Scheduled Task/JobEvidence1

T1053.005Scheduled TaskEvidence3

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

T1112Modify RegistryEvidence1

Across the content, malware repeatedly 'adds Registry Run keys', 'creates Registry entries', 'modifies the Windows Registry', or 'overwrites registry keys' to maintain persistence.

T1547.001Registry Run Keys / Startup FolderEvidence6

The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.

Privilege Escalation

3 techniques

T1053Scheduled Task/JobEvidence1

T1053.005Scheduled TaskEvidence3

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

T1547.001Registry Run Keys / Startup FolderEvidence6

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence4

The content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.

T1036MasqueradingEvidence3

actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe ... APT1 ... used ... AcroRD32.exe ... as a name for malware ... APT28 ... changed extensions on files containing exfiltrated data to make them appear benign ... APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update.

T1140Deobfuscate/Decode Files or InformationEvidence1

"CARROTBALL has used a custom base64 alphabet to decode files." / "CARROTBAT has the ability to download a base64 encoded payload."

T1564.003Hidden WindowEvidence3

Agent Tesla has used ProcessWindowStyle.Hidden to hide windows. APT-C-36 has set the ShowWindow property of the Win32_ProcessStartup object to zero to hide PowerShell execution. APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Across the content, malware repeatedly 'adds Registry Run keys', 'creates Registry entries', 'modifies the Windows Registry', or 'overwrites registry keys' to maintain persistence.

Collection

1 technique

T1005Data from Local SystemEvidence1

Andariel has collected large numbers of files from compromised network systems for later extraction... APT28 has retrieved internal documents from machines inside victim environments... BADNEWS crawls the victim's local drives and collects documents... many listed groups and malware collect files, documents, credentials, payment card data, or other information from compromised hosts.

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence4

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

T1105Ingress Tool TransferEvidence1

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

Many entries state malware or actors can upload, transfer, send, or exfiltrate files from compromised hosts to command-and-control servers or attacker infrastructure.

ACTIVITY FEED

Recent activity

14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

14 SOURCESView more in app

mitre attack websiteNews

Mar 20, 2026

Hide Artifacts: Hidden Window, Sub-technique T1564.003 - Enterprise | MITRE ATT&CK®

Malware that alters processes to keep them from being visible on the desktop.

sophos threat researchNews

Jan 1, 2026

Own The Router, Own The Traffic | SOPHOS

MCMD is identified in the content as a remote access trojan associated with IRON LIBERTY, but no further operational details are provided in this article.

mitre attack websiteNews

Oct 21, 2021

Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Sub-technique T1547.001 - Enterprise | MITRE ATT&CK®

Malware that establishes persistence via Registry Run keys.

mitre attack websiteNews

Oct 21, 2021

Data from Local System, Technique T1005 - Enterprise | MITRE ATT&CK®

Malware capable of uploading files from infected devices.

+10 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

MCMD

The available information supports classifying MCMD as a RAT focused on persistent remote control, stealthy execution, and operator-driven data theft from Windows endpoints.