SLOTHFULMEDIA
- ID
- S0533
- Type
- Malware
- Associated names
- JackOfHearts, QueenOfClubs
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 22 Oct 2025
SLOTHFULMEDIA is a remote access Trojan written in C++ that has been used by an unidentified "sophisticated cyber actor" since at least January 2017.[1][2] It has been used to target government organizations, defense contractors, universities, and energy companies in Russia, India, Kazakhstan, Kyrgyzstan, Malaysia, Ukraine, and Eastern Europe.[3][4]
In October 2020, Kaspersky Labs assessed SLOTHFULMEDIA is part of an activity cluster it refers to as "IAmTheKing".[4] ESET also noted code similarity between SLOTHFULMEDIA and droppers used by a group it refers to as "PowerPool".[5]
Techniques used (24)
- T1001 Data Obfuscation
- T1005 Data from Local System
- T1007 System Service Discovery
- T1033 System Owner/User Discovery
- T1036.004 Masquerade Task or Service
- T1036.005 Match Legitimate Resource Name or Location
- T1041 Exfiltration Over C2 Channel
- T1049 System Network Connections Discovery
- T1055 Process Injection
- T1056.001 Keylogging
- T1057 Process Discovery
- T1059.003 Windows Command Shell
- T1070.004 File Deletion
- T1071.001 Web Protocols
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1105 Ingress Tool Transfer
- T1112 Modify Registry
- T1113 Screen Capture
- T1489 Service Stop
- T1543.003 Windows Service
- T1564.001 Hidden Files and Directories
- T1569.002 Service Execution
- T1680 Local Storage Discovery