BUBBLEWRAP

ID: S0043
Type: Malware
Associated names: Backdoor.APT.FakeWinHTTPHelper
Platforms: Windows
Source: attack.mitre.org
MITRE last modified: 25 Apr 2025

BUBBLEWRAP is a full-featured, second-stage backdoor used by the admin@338 group. It is set to run when the system boots and includes functionality to check, upload, and register plug-ins that can further enhance its capabilities. ^[1]

Techniques used (3)

T1071.001 Web Protocols
T1082 System Information Discovery
T1095 Non-Application Layer Protocol

Groups using it (1)

G0018 admin@338

References

FireEye admin@338