Malware

Splinter

Splinter is a Rust-based Windows post-exploitation implant and red-team tool that has been observed on multiple victim systems. It operates as a task-driven implant configured through embedded JSON data and communicates with an operator-controlled command-and-control server over HTTPS using authenticated sessions. Known functionality includes execution of Windows commands, bidirectional file transfer, remote process injection for module execution, collection of cloud account information, and self-deletion. Its process-injection workflow includes creating a thread in a remote process to run PE-loading shellcode and execute a payload.

Splinter has been observed as both executable and DLL variants and appears designed for use after initial compromise rather than as a standalone intrusion vector. Public reporting did not attribute its development or operational use to a specific threat actor with confidence. Separate reporting has noted a stage-two payload named Splinter within a BitterAPT activity cluster, but attribution of the broader toolset remains uncertain. The malware is notable because, although presented as a red-team capability, its feature set is fully suitable for malicious post-compromise operations in enterprise environments.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059.003Windows Command ShellEvidence1

Splinter tasks have the following post-exploitation features: Execute a Windows command

Privilege Escalation

2 techniques

T1055Process InjectionEvidence1

Splinter uses the classic process injection method as an option for running additional modules. Figure 1 shows thread creation in a remote process that runs a PE loader shellcode that in turn executes the payload.

T1055.001Dynamic-link Library InjectionEvidence1

Figure 1 shows thread creation in a remote process that runs a PE loader shellcode that in turn executes the payload. Both the PE loader and the payload are written to the remote process defined by the attacker.

Stealth

3 techniques

T1055Process InjectionEvidence1

T1055.001Dynamic-link Library InjectionEvidence1

T1070.004File DeletionEvidence1

Splinter tasks have the following post-exploitation features: Self-delete

Discovery

1 technique

T1526Cloud Service DiscoveryEvidence1

Splinter tasks have the following post-exploitation features: ... Gather information from a certain cloud service account

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

Splinter tasks have the following post-exploitation features: ... Drop a file from the attacker’s server to the victim’s system

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Splinter tasks have the following post-exploitation features: Upload a file from the victim’s system to the attacker’s server

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app2 years ago

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

palo alto networks unit 42 blogNews

Sep 19, 2024

Discovering Splinter: A First Look at a New Post-Exploitation Red Team Tool

Splinter is a Rust-based post-exploitation red team tool/implant that connects to an HTTPS C2 server using embedded credentials, receives tasks from the server, executes Windows commands, performs remote process injection to run additional modules, uploads and downloads files, gathers information from a cloud service account, and can self-delete.

securelistNews

Apr 27, 2021

APT trends report Q1 2021 | Securelist

Stage-2 payload used by BitterAPT in the TurtlePower campaign.

microsoft wdsiNews

Jan 25, 2026

VirTool:Win32/SPLINTER.A!MTB threat description - Microsoft Security Intelligence

Splinter is referenced as malware detected via the VirTool:Win32/SPLINTER.A!MTB signature/behavior, which is described as scanning memory to identify the presence of the Splinter threat.

microsoft wdsiNews

Mar 18, 2026

Behavior:Win32/Splinter.A!sms threat description - Microsoft Security Intelligence

Splinter is referenced as malware detected via a behavior-based method (Behavior:Win32/Splinter.A!sms) that scans memory to identify the presence of the threat.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Splinter