ATT&CK

Threat actorsMITRE ATT&CK intrusion sets Malware & toolsSoftware families & tooling TechniquesTactics & techniques

ReportsPublished APT reporting SourcesEvery feed behind the archive

Developers

JSON APIFree CORS-enabled endpoints MCP serverModel Context Protocol access Source codeThis project on GitHub

Loading the archive…

Open Threat Intel Archive

Indicators are treated as facts and kept with their source_vendor, source URL, and dates; every feed is credited and redistribution-restricted feeds are flagged, not dropped. ATT&CK content is © MITRE, used under its terms. See NOTICE. The archive reports intelligence; it does not editorialize threat.

Indicators Actors Sources API GitHub

Open Threat Intel Archive

← Malware & tools

S0023malware

CHOPSTICK

a.k.a. Backdoor.SofacyX, SPLM, Xagent, X-Agent, webhp

CHOPSTICK is a malware family of modular backdoors used by APT28. It has been used since at least 2012 and is usually dropped on victims as second-stage malware, though it has been used as first-stage malware in several cases. It has both Windows and Linux variants. It is tracked separately from the X-Agent for Android.

Platforms: Windows, Linux

MITRE ATT&CK ↗

Linked entities · 20

usesT1008Fallback Channels usesT1092Communication Through Removable M…usesT1090.001Internal Proxy usesT1059Command and Scripting Interpreter usesT1071.003Mail Protocols usesT1071.001Web Protocols usesT1112Modify Registry usesT1497Virtualization/Sandbox Evasion usesT1113Screen Capture usesT1105Ingress Tool Transfer usesT1518.001Security Software Discovery usesT1083File and Directory Discovery usesT1027.011Fileless Storage usesT1056.001Keylogging usesT1091Replication Through Removable Med…usesT1568.002Domain Generation Algorithms usesT1573.001Symmetric Cryptography usesT1573.002Asymmetric Cryptography usesT1012Query Registry uses byG0007APT28