AutoIt backdoor
- ID
- S0129
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 25 Apr 2025
AutoIt backdoor is malware that has been used by the actors responsible for the MONSOON campaign. The actors frequently used it in weaponized .pps files exploiting CVE-2014-6352. [1] This malware makes use of the legitimate scripting language for Windows GUI automation with the same name.
Techniques used (4)
- T1059.001 PowerShell
- T1083 File and Directory Discovery
- T1132.001 Standard Encoding
- T1548.002 Bypass User Account Control