CORESHELL

Malware updated 5 months ago (2024-05-04T16:34:53.325Z)
Download STIX
Preview STIX
Coreshell is a variant of Sofacy malware used by threat actors to compromise systems and steal sensitive information. Malware, like Coreshell, can infect computer systems through suspicious downloads, emails, or websites. Once inside, it can disrupt operations, steal personal information, or hold data hostage for ransom. In mid-May, IRON TWILIGHT operators installed XTunnel as a Coreshell child process on an already compromised system. They also installed Coreshell on a compromised bridge server that provided a connection between a TV station's corporate and broadcast networks. The installation of Coreshell on the bridge server suggests that the threat actors may have considered data on that system to be of interest or crucial to achieving their goals. The Sofacy group expanded its arsenal in 2013, adding more backdoors and tools, including CORESHELL, SPLM, JHUHUGIT, AZZY, and others. This highlights the continued evolution and sophistication of malware, making it increasingly challenging to defend against these threats. Organizations need to remain vigilant, employ robust security measures, and update their defenses regularly to stay ahead of evolving malware like Coreshell.
Description last updated: 2023-06-23T17:26:25.961Z
Aliases We are not currently tracking any aliases
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Source Document References
Information about the CORESHELL Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more