T9000
- ID
- S0098
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 25 Apr 2025
T9000 is a backdoor that is a newer variant of the T5000 malware family, also known as Plat1. Its primary function is to gather information about the victim. It has been used in multiple targeted attacks against U.S.-based organizations. [1] [2]
Techniques used (13)
- T1016 System Network Configuration Discovery
- T1033 System Owner/User Discovery
- T1082 System Information Discovery
- T1113 Screen Capture
- T1119 Automated Collection
- T1120 Peripheral Device Discovery
- T1123 Audio Capture
- T1124 System Time Discovery
- T1125 Video Capture
- T1518.001 Security Software Discovery
- T1546.010 AppInit DLLs
- T1560.003 Archive via Custom Method
- T1574.001 DLL