MalwareUsed by 2 actors

FileFiend

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Black Shadow

The FileFiend binaries, named by Gambit Security in their original report, appear under the decoy filename Exchangedb.exe, distributed across five victim subdirectories under the metro/ folder structure.

via huntio bloghunt.io

Ababil of Minab

via huntio bloghunt.io

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Stealth

1 technique

T1036.005Match Legitimate Resource Name or LocationEvidence1

MITRE ATT&CK Mapping Technique ID Name Evidence T1036.005 Masquerading: Match Legitimate Name or Location The FileFiend malware was disguised as Exchangedb.exe, imitating a legitimate Microsoft Exchange-related utility.

Discovery

2 techniques

T1083File and Directory DiscoveryEvidence1

The binary could enumerate local drives and SMB shares, walk the file system, and send files to a hard-coded C2 [command-and-control] server.

T1135Network Share DiscoveryEvidence2

“They also deployed a bespoke C++ tool internally named FileFiend that could enumerate local drives and SMB shares and send files to a hardcoded server.”

Collection

4 techniques

T1005Data from Local SystemEvidence1

MITRE ATT&CK Mapping Technique ID Name Evidence T1005 Data from Local System Collected data included database backups, PST email files, configuration files, and exported credentials from victim systems.

T1039Data from Network Shared DriveEvidence1

“They also deployed a bespoke C++ tool internally named FileFiend that could enumerate local drives and SMB shares and send files to a hardcoded server.”

T1119Automated CollectionEvidence1

MITRE ATT&CK Mapping Technique ID Name Evidence T1119 Automated Collection The FileFiend tool (Exchangedb.exe) automatically enumerated local drives and SMB network shares for data collection.

T1560Archive Collected DataEvidence1

Alternatively, data of interest is compressed into RAR archives on a host inside the victim environment and uploaded to the organization's public website at the web root

Command and Control

2 techniques

T1102Web ServiceEvidence1

MITRE ATT&CK Mapping Technique ID Name Evidence T1102 Web Service Victim data was staged in the victim's own web root and retrieved remotely using the Axel download utility over HTTP.

T1105Ingress Tool TransferEvidence1

from where they are extracted using the Axel command-line download accelerator and tunneled through proxychains.

Exfiltration

3 techniques

T1041Exfiltration Over C2 ChannelEvidence1

The binary could enumerate local drives and SMB shares, walk the file system, and send files to a hard-coded C2 [command-and-control] server.

T1567Exfiltration Over Web ServiceEvidence1

“The attackers built a custom Flask-based receiver in Python to collect stolen data in encrypted chunks, with endpoints for starting sessions, resuming interrupted transfers, and validating chunk hashes.”

T1567.002Exfiltration to Cloud StorageEvidence1

“The attackers built a custom Flask-based receiver in Python to collect stolen data in encrypted chunks...”

INDICATORS OF COMPROMISE

IOCs tracked for this family

6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

3 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app1 day ago

domain●●●●●●●●●●●●View more in app1 day ago

ip.v4●●●●●●●●●●●●View more in app1 day ago

hash.sha256●●●●●●●●●●●●View more in app3 days ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

huntio blogNews

Jun 18, 2026

Ababil of Minab Exposed: LA Metro SCADA Backups and Israeli Victim Data Left Open on an Iranian Staging Server

Custom uploader/exfiltration malware used in the Ababil of Minab campaign. It was disguised as Exchangedb.exe and used to automatically enumerate local drives and SMB network shares for data collection, including PST files and other sensitive data.

security affairsNews

May 27, 2026

The LA Metro Attack Wasn't Hacktivism. It Was a State Operation With a Costume On.

A bespoke C++ data theft tool used to enumerate local drives and SMB shares and exfiltrate files to a hardcoded server.

the hacker newsNews

May 26, 2026

MuddyWater Uses DLL Side-Loading in Espionage Campaign Targeting 9 Countries

A bespoke C++ file collection and exfiltration tool that can enumerate local drives and SMB shares, traverse the file system, and send files to a hard-coded command-and-control server.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching6

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.