QUIETCANARY
The MITRE Corporation
· Published 19/05/2023 22:18 · Modified 27/03/2026 01:05
Family
Essential information
- Confidence
- 100/100
- Is family
- Yes
- Published
- 19/05/2023 22:18
- Modified
- 27/03/2026 01:05
- Revoked
- No
- Author / Source
- The MITRE Corporation
- Related entities
- 38 attack patterns (mitre), 3 intrusion sets (apt), 1 sectors, 7 countries, 96 indicators, 1 campaign, 1 campaigns
Aliases
Quietcanary Tunnus
Description
[QUIETCANARY](https://attack.mitre.org/software/S1076) is a backdoor tool written in .NET that has been used since at least 2022 to gather and exfiltrate data from victim networks.(Citation: Mandiant Suspected Turla Campaign February 2023)
Marking (TLP)
TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
External references
Related entities
Attack patterns, malware, vulnerabilities, indicators, intrusion sets and other entities linked to this malware.
Attack patterns (MITRE) (38)
Intrusion sets (APT) (3)
-
The MITRE Corporation Confidence 100
[Turla](https://attack.mitre.org/groups/G0010) is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least…
First seen 01/01/1970 · Last seen 16/11/5138 · -
Tomiris usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Turla, UNC4210 usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
Sectors (1)
-
Government targets
Countries (7)
-
Russian Federation targets
-
Afghanistan targets
-
Belarus targets
-
Tajikistan targets
-
Kazakhstan targets
-
Ukraine targets
-
Kyrgyzstan targets
Indicators (96)
-
stix 100/100 Revoked· Valid until 21/12/2024 · Source: AlienVault
-
stix 100/100 Revoked
Andromeda, Generic SHA256 of b3657bcfe8240bc0985093a0f8682703 SHA256 of b3657bcfe8240bc0985093a0f8682703
· Valid until 13/04/2024 · Source: AlienVault -
stix 100/100 Revoked· Valid until 04/11/2023 · Source: AlienVault
-
stix 100/100 Revoked· Valid until 21/12/2024 · Source: AlienVault
-
stix 100/100 Revoked· Valid until 21/12/2024 · Source: AlienVault
-
stix 100/100 Revoked· Valid until 27/07/2024 · Source: AlienVault
-
stix 100/100 Revoked
TEL:Trojan:Win64/GoCLR.MR!MTB SHA256 of a0de69ab52dc997ff19a18b7a6827e2beeac63bc
· Valid until 27/07/2024 · Source: AlienVault -
stix 100/100 Revoked· Valid until 21/12/2024 · Source: AlienVault
-
stix 100/100 Revoked· Valid until 27/07/2024 · Source: AlienVault
-
http://mtsoft.hol.es/wp-content/gallery/indicatesstix 100/100 Revoked· Valid until 04/11/2023 · Source: AlienVault
Campaign (1)
-
C0026 uses
Campaigns (1)
-
C0026