Malware

CMDEmber

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1583.001DomainsEvidence1

WIP26 is characterized by the abuse of public Cloud infrastructure – Microsoft 365 Mail, Microsoft Azure, Google Firebase, and Dropbox – for malware delivery, data exfiltration, and C2 purposes.

Execution

2 techniques

T1059.001PowerShellEvidence1

The data exfiltration was orchestrated through the execution of PowerShell commands to transport key data to Microsoft Azure instances.

T1059.003Windows Command ShellEvidence1

The main functionality of CMD365 and CMDEmber is to execute attacker-provided system commands using the Windows command interpreter.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

The C2 server and CMD365 exchange encrypted and Base64-encoded data. For data encryption and decryption, the malware uses the AES key Xc4u7x!A%D*G-KaPdSr56tp2s5v8y/B?

T1036MasqueradingEvidence1

The CMD365 and CMDEmber samples we observed masquerade as utility software, such as a PDF editor or browser, and as software that conducts update operations. The masquerading attempt involves the use of filenames, application icons, and digital signatures that indicate existing software vendors.

Discovery

3 techniques

T1016System Network Configuration DiscoveryEvidence1

The exfiltrated data includes ... the IPv4 and physical addresses of all operational network interfaces on the infected machine.

T1033System Owner/User DiscoveryEvidence1

The exfiltrated data includes some of the information that the CMDEmber collects – ... the name of the user in whose context CMDEmber executes ...

T1082System Information DiscoveryEvidence1

The exfiltrated data includes some of the information that the CMDEmber collects – the computer name, the bitness, name, and ID of the CMDEmber process, the name of the user in whose context CMDEmber executes, and the IPv4 and physical addresses of all operational network interfaces on the infected machine.

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

CMDEmber sends and receives data from the C2 server by issuing HTTP POST and GET requests, respectively.

T1105Ingress Tool TransferEvidence1

This capability was used to conduct a variety of activities, such as reconnaissance, privilege escalation, staging of additional malware, and data exfiltration.

Exfiltration

1 technique

T1567Exfiltration Over Web ServiceEvidence1

The data exfiltration was orchestrated through the execution of PowerShell commands to transport key data to Microsoft Azure instances.

INDICATORS OF COMPROMISE

IOCs tracked for this family

8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

2 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

3 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app3 months ago

hash.sha1●●●●●●●●●●●●View more in app1 year ago

uri●●●●●●●●●●●●View more in app1 year ago

domain●●●●●●●●●●●●View more in app1 year ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

sentinelone labsNews

Apr 11, 2025

WIP26 Espionage | Threat Actors Abuse Cloud Infrastructure in Targeted Telco Attacks | SentinelOne

A .NET backdoor that uses Google Firebase Realtime Database as command-and-control. It executes system commands through the Windows command interpreter, exfiltrates host information, and exchanges encrypted Base64/JSON data with its C2.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching8

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

CMDEmber

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1583.001DomainsEvidence1

WIP26 is characterized by the abuse of public Cloud infrastructure – Microsoft 365 Mail, Microsoft Azure, Google Firebase, and Dropbox – for malware delivery, data exfiltration, and C2 purposes.

Execution

2 techniques

T1059.001PowerShellEvidence1

The data exfiltration was orchestrated through the execution of PowerShell commands to transport key data to Microsoft Azure instances.

T1059.003Windows Command ShellEvidence1

The main functionality of CMD365 and CMDEmber is to execute attacker-provided system commands using the Windows command interpreter.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

The C2 server and CMD365 exchange encrypted and Base64-encoded data. For data encryption and decryption, the malware uses the AES key Xc4u7x!A%D*G-KaPdSr56tp2s5v8y/B?

T1036MasqueradingEvidence1

Discovery

3 techniques

T1016System Network Configuration DiscoveryEvidence1

The exfiltrated data includes ... the IPv4 and physical addresses of all operational network interfaces on the infected machine.

T1033System Owner/User DiscoveryEvidence1

The exfiltrated data includes some of the information that the CMDEmber collects – ... the name of the user in whose context CMDEmber executes ...

T1082System Information DiscoveryEvidence1

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

CMDEmber sends and receives data from the C2 server by issuing HTTP POST and GET requests, respectively.

T1105Ingress Tool TransferEvidence1

This capability was used to conduct a variety of activities, such as reconnaissance, privilege escalation, staging of additional malware, and data exfiltration.

Exfiltration

1 technique

T1567Exfiltration Over Web ServiceEvidence1

The data exfiltration was orchestrated through the execution of PowerShell commands to transport key data to Microsoft Azure instances.

INDICATORS OF COMPROMISE

IOCs tracked for this family

8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

2 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

3 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app3 months ago

hash.sha1●●●●●●●●●●●●View more in app1 year ago

uri●●●●●●●●●●●●View more in app1 year ago

domain●●●●●●●●●●●●View more in app1 year ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

sentinelone labsNews

Apr 11, 2025

WIP26 Espionage | Threat Actors Abuse Cloud Infrastructure in Targeted Telco Attacks | SentinelOne

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching8

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.