POLLBLEND
- ID
- S9066
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 2 Oct 2026
POLLBLEND is a Windows tunneler written C++ that has utilized hardcoded C2 servers and leveraged hardcoded URI parameters for follow-on actions.[1] POLLBLEND was first observed in 2025 and has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1]
Techniques used (5)
- T1041 Exfiltration Over C2 Channel
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1553.002 Code Signing
- T1574.001 DLL