KOPILUWAK
The MITRE Corporation
· Published 17/05/2023 20:49 · Modified 27/03/2026 01:03
Family
Essential information
- Confidence
- 100/100
- Is family
- Yes
- Published
- 17/05/2023 20:49
- Modified
- 27/03/2026 01:03
- Revoked
- No
- Author / Source
- The MITRE Corporation
- Related entities
- 40 attack patterns (mitre), 3 intrusion sets (apt), 1 sectors, 7 countries, 96 indicators, 1 campaign, 1 campaigns
Description
[KOPILUWAK](https://attack.mitre.org/software/S1075) is a JavaScript-based reconnaissance tool that has been used for victim profiling and C2 since at least 2017.(Citation: Mandiant Suspected Turla Campaign February 2023)
Marking (TLP)
TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
External references
Related entities
Attack patterns, malware, vulnerabilities, indicators, intrusion sets and other entities linked to this malware.
Attack patterns (MITRE) (40)
Intrusion sets (APT) (3)
-
Tomiris usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
The MITRE Corporation Confidence 100
[Turla](https://attack.mitre.org/groups/G0010) is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least…
First seen 01/01/1970 · Last seen 16/11/5138 · -
Turla, UNC4210 usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
Sectors (1)
-
Government targets
Countries (7)
-
Belarus targets
-
Ukraine targets
-
Kazakhstan targets
-
Russian Federation targets
-
Afghanistan targets
-
Tajikistan targets
-
Kyrgyzstan targets
Indicators (96)
-
stix 100/100 Revoked· Valid until 27/07/2024 · Source: AlienVault
-
stix 100/100 Revoked· Valid until 21/12/2024 · Source: AlienVault
-
stix 100/100 Revoked
ALFPER:Trojan:Win32/RoubmaniPot.A!dha SHA256 of 6239b4d374539c940cffa698e0993d199918a2fc
· Valid until 21/12/2024 · Source: AlienVault -
stix 100/100 Revoked· Valid until 21/12/2024 · Source: AlienVault
-
stix 100/100 Revoked· Valid until 04/11/2023 · Source: AlienVault
-
stix 100/100 Revoked· Valid until 04/11/2023 · Source: AlienVault
-
stix 100/100 Revoked
TEL:Trojan:Win64/GoCLR.MR!MTB SHA256 of a0de69ab52dc997ff19a18b7a6827e2beeac63bc
· Valid until 27/07/2024 · Source: AlienVault -
stix 100/100 Revoked
DotNET_SmartAssembly
· Valid until 21/12/2024 · Source: AlienVault -
stix 100/100 Revoked· Valid until 04/11/2023 · Source: AlienVault
-
stix 100/100 Revoked· Valid until 04/11/2023 · Source: AlienVault
Campaign (1)
-
C0026 uses
Campaigns (1)
-
C0026