SUGARUSH
- ID
- S1049
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 22 Oct 2025
SUGARUSH is a small custom backdoor that can establish a reverse shell over TCP to a hard coded C2 address. SUGARUSH was first identified during analysis of UNC3890's C0010 campaign targeting Israeli companies, which began in late 2020.[1]
Techniques used (6)
- T1016.001 Internet Connection Discovery
- T1059.003 Windows Command Shell
- T1095 Non-Application Layer Protocol
- T1543.003 Windows Service
- T1571 Non-Standard Port
- T1680 Local Storage Discovery