MITRE ATT&CK / Software / S0146
TEXTMATE
- ID
- S0146
- Type
- Malware
- Associated names
- DNSMessenger
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 17 Apr 2025
TEXTMATE is a second-stage PowerShell backdoor that is memory-resident. It was observed being used along with POWERSOURCE in February 2017. [1]
Techniques used (2)
Groups using it (1)
References
- FireEye FIN7 March 2017
