POSHSPY
- ID
- S0150
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 25 Apr 2025
POSHSPY is a backdoor that has been used by APT29 since at least 2015. It appears to be used as a secondary backdoor used if the actors lost access to their primary backdoors. [1]
Techniques used (8)
- T1027 Obfuscated Files or Information
- T1030 Data Transfer Size Limits
- T1059.001 PowerShell
- T1070.006 Timestomp
- T1105 Ingress Tool Transfer
- T1546.003 Windows Management Instrumentation Event Subscription
- T1568.002 Domain Generation Algorithms
- T1573.002 Asymmetric Cryptography