EnvyScout
The MITRE Corporation
· Published 02/08/2021 17:31 · Modified 27/03/2026 01:03
Family
Essential information
- Confidence
- 100/100
- Is family
- Yes
- Published
- 02/08/2021 17:31
- Modified
- 27/03/2026 01:03
- Revoked
- No
- Author / Source
- The MITRE Corporation
- Related entities
- 20 attack patterns (mitre), 1 intrusion sets (apt), 1 sectors, 18 indicators, 1 reports
Description
[EnvyScout](https://attack.mitre.org/software/S0634) is a dropper that has been used by [APT29](https://attack.mitre.org/groups/G0016) since at least 2021.(Citation: MSTIC Nobelium Toolset May 2021)
Marking (TLP)
TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
External references
Related entities
Attack patterns, malware, vulnerabilities, indicators, intrusion sets and other entities linked to this malware.
Attack patterns (MITRE) (20)
Intrusion sets (APT) (1)
-
The MITRE Corporation Confidence 100
[APT29](https://attack.mitre.org/groups/G0016) is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).(Citation: White House Imposing Costs RU Gov April 2021)(Citation: UK Gov Malign RIS Activity April…
First seen 01/01/1970 · Last seen 16/11/5138 ·
Sectors (1)
-
Government targets
Indicators (18)
-
stix 100/100 Revoked· Valid until 23/10/2023 · Source: AlienVault
-
stix 100/100 Revoked· Valid until 23/10/2023 · Source: AlienVault
-
stix 100/100 Revoked· Valid until 23/10/2023 · Source: AlienVault
-
stix 100/100 Revoked· Valid until 23/10/2023 · Source: AlienVault
-
stix 100/100 Revoked· Valid until 23/10/2023 · Source: AlienVault
-
stix 100/100 Revoked
invalid_trailer_structure
· Valid until 23/10/2023 · Source: AlienVault -
stix 100/100 Revoked· Valid until 23/10/2023 · Source: AlienVault
-
stix 100/100 Revoked· Valid until 23/10/2023 · Source: AlienVault
-
stix 100/100 Revoked
Ole2.Macro.Agent-9858864-1
· Valid until 23/10/2023 · Source: AlienVault -
stix 100/100 Revoked· Valid until 23/10/2023 · Source: AlienVault
-
stix 100/100 Revoked· Valid until 23/10/2023 · Source: AlienVault
-
stix 100/100 Revoked· Valid until 23/10/2023 · Source: AlienVault
Reports (1)
-
Confidence 100 18 CVEs 200 MITREs 200 Malwares 20 APTs 26 Tools