KOPILUWAK
The MITRE Corporation
· Published 17/05/2023 20:49 · Modified 27/03/2026 01:03
Family
Essential information
- Confidence
- 100/100
- Is family
- Yes
- Published
- 17/05/2023 20:49
- Modified
- 27/03/2026 01:03
- Revoked
- No
- Author / Source
- The MITRE Corporation
- Related entities
- 40 attack patterns (mitre), 3 intrusion sets (apt), 1 sectors, 7 countries, 96 indicators, 1 campaign, 1 campaigns
Description
[KOPILUWAK](https://attack.mitre.org/software/S1075) is a JavaScript-based reconnaissance tool that has been used for victim profiling and C2 since at least 2017.(Citation: Mandiant Suspected Turla Campaign February 2023)
Marking (TLP)
TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
External references
Related entities
Attack patterns, malware, vulnerabilities, indicators, intrusion sets and other entities linked to this malware.
Attack patterns (MITRE) (40)
Intrusion sets (APT) (3)
-
Tomiris usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
The MITRE Corporation Confidence 100
[Turla](https://attack.mitre.org/groups/G0010) is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least…
First seen 01/01/1970 · Last seen 16/11/5138 · -
Turla, UNC4210 usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
Sectors (1)
-
Government targets
Countries (7)
-
Belarus targets
-
Ukraine targets
-
Kazakhstan targets
-
Russian Federation targets
-
Afghanistan targets
-
Tajikistan targets
-
Kyrgyzstan targets
Indicators (96)
-
stix 100/100 Revoked· Valid until 21/12/2024 · Source: AlienVault
-
stix 100/100 Revoked· Valid until 21/12/2024 · Source: AlienVault
-
stix 100/100 Revoked
SHA256 of 7c1b25518dee1e30b5a6eaa1ea8e4a3780c24d0c
· Valid until 21/12/2024 · Source: AlienVault -
40327f9e4a9dfcfca1a4ea251a49712592480f8findicatesyara 100/100 Revoked· Valid until 13/04/2024 · Source: AlienVault -
stix 100/100 Revoked· Valid until 21/12/2024 · Source: AlienVault
-
stix 100/100 Revoked· Valid until 10/06/2023 · Source: AlienVault
-
stix 100/100 Revoked· Valid until 21/12/2024 · Source: AlienVault
-
stix 100/100 Revoked· Valid until 21/12/2024 · Source: AlienVault
-
stix 100/100 Revoked
vad_contains_network_strings SHA256 of a4aff23b9a58b598524a71f09aa67994083a9c83
· Valid until 21/12/2024 · Source: AlienVault -
stix 100/100 Revoked· Valid until 21/12/2024 · Source: AlienVault
Campaign (1)
-
C0026 uses
Campaigns (1)
-
C0026