KOPILUWAK
The MITRE Corporation
· Published 17/05/2023 20:49 · Modified 27/03/2026 01:03
Family
Essential information
- Confidence
- 100/100
- Is family
- Yes
- Published
- 17/05/2023 20:49
- Modified
- 27/03/2026 01:03
- Revoked
- No
- Author / Source
- The MITRE Corporation
- Related entities
- 40 attack patterns (mitre), 3 intrusion sets (apt), 1 sectors, 7 countries, 96 indicators, 1 campaign, 1 campaigns
Description
[KOPILUWAK](https://attack.mitre.org/software/S1075) is a JavaScript-based reconnaissance tool that has been used for victim profiling and C2 since at least 2017.(Citation: Mandiant Suspected Turla Campaign February 2023)
Marking (TLP)
TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
External references
Related entities
Attack patterns, malware, vulnerabilities, indicators, intrusion sets and other entities linked to this malware.
Attack patterns (MITRE) (40)
Intrusion sets (APT) (3)
-
Tomiris usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
The MITRE Corporation Confidence 100
[Turla](https://attack.mitre.org/groups/G0010) is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least…
First seen 01/01/1970 · Last seen 16/11/5138 · -
Turla, UNC4210 usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
Sectors (1)
-
Government targets
Countries (7)
-
Belarus targets
-
Ukraine targets
-
Kazakhstan targets
-
Russian Federation targets
-
Afghanistan targets
-
Tajikistan targets
-
Kyrgyzstan targets
Indicators (96)
-
stix 100/100 Revoked
ConventionEngine_Term_Users SHA256 of 9902917a3af585e695141caf347a2f19a065a7df
· Valid until 27/07/2024 · Source: AlienVault -
stix 100/100 Revoked· Valid until 27/07/2024 · Source: AlienVault
-
stix 100/100 Revoked· Valid until 27/07/2024 · Source: AlienVault
-
stix 100/100 Revoked· Valid until 04/11/2023 · Source: AlienVault
-
stix 100/100 Revoked
regexpr_pos SHA256 of 66271b2536481a6b2a3ae21412ce5ef50a692cfa
· Valid until 27/07/2024 · Source: AlienVault -
2e4391dba8410f2c72d1bc0ed0180d4b5c0ac316indicatesyara 100/100 Revoked· Valid until 13/04/2024 · Source: AlienVault -
stix 100/100 Revoked
Win64:Trojan-gen SHA256 of da6635def86b50a5de25f148426f68d3d8ab450a
· Valid until 27/07/2024 · Source: AlienVault -
stix 100/100 Revoked· Valid until 27/07/2024 · Source: AlienVault
-
mail.arlingtonhousing.usindicatesstix 100/100 Revoked· Valid until 31/12/2024 · Source: AlienVault -
stix 100/100 Revoked
ConventionEngine_Keyword_Socket SHA256 of 19357154ff3e43c968fd09f61db1e6e8084384fa
· Valid until 27/07/2024 · Source: AlienVault -
stix 100/100 Revoked· Valid until 04/11/2023 · Source: AlienVault
Campaign (1)
-
C0026 uses
Campaigns (1)
-
C0026