XTunnel
- ID
- S0117
- Type
- Malware
- Associated names
- Trojan.Shunnael, X-Tunnel, XAPS
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 25 Apr 2025
XTunnel a VPN-like network proxy tool that can relay traffic between a C2 server and a victim. It was first seen in May 2013 and reportedly used by APT28 during the compromise of the Democratic National Committee. [1] [2] [3]
Techniques used (8)
- T1008 Fallback Channels
- T1027 Obfuscated Files or Information
- T1027.016 Junk Code Insertion
- T1046 Network Service Discovery
- T1059.003 Windows Command Shell
- T1090 Proxy
- T1552.001 Credentials In Files
- T1573.002 Asymmetric Cryptography