HyperStack
- ID
- S0537
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 20 Jan 2026
HyperStack is a RPC-based backdoor used by Turla since at least 2018. HyperStack has similarities to other backdoors used by Turla including Carbon.[1]
Techniques used (6)
- T1078.001 Default Accounts
- T1087.001 Local Account
- T1106 Native API
- T1112 Modify Registry
- T1559 Inter-Process Communication
- T1573.001 Symmetric Cryptography