T1554: Compromise Host Software Binary
Adversaries may modify host software binaries to establish persistent access to systems. Software binaries/executables provide a wide range of system commands or services, programs, and libraries. Common software binaries are SSH clients, FTP clients, email clients, web browsers, and many other user or server applications.
Adversaries may establish persistence though modifications to host software binaries. For example, an adversary may replace or otherwise infect a legitimate application binary (or support files) with a backdoor. Since these binaries may be routinely executed by applications or the user, the adversary can leverage this for persistent access to the host. An adversary may also modify a software binary such as an SSH client in order to persistently collect credentials during logins (i.e., Modify Authentication Process).[1]
An adversary may also modify an existing binary by patching in malicious functionality (e.g., IAT Hooking/Entry point patching)[2] prior to the binary’s legitimate execution. For example, an adversary may modify the entry point of a binary to point to malicious code patched in by the adversary before resuming normal execution flow.[3]
After modifying a binary, an adversary may attempt to impair defenses by preventing it from updating (e.g., via the `yum-versionlock` command or `versionlock.list` file in Linux systems that use the yum package manager).[1]
Analyst context for executives and security teams
T1554 matters because it turns trusted software into a persistence mechanism. If an attacker can replace or patch a legitimate binary, library, client, browser, VPN component, or service file, normal user or system activity may keep re-launching the malicious code. For leaders, the key issue is trust: backups, patching, endpoint tooling, and identity investigations can miss persistence if they assume installed software is intact.
Executive priority
Prioritize this technique where business-critical hosts, administrative access paths, remote access infrastructure, Linux/macOS/Windows servers, and ESXi environments depend on trusted binaries that are rarely integrity-checked. It has direct implications for incident response scoping, credential assurance, software integrity evidence for audits, and operational resilience. Relationship context includes campaigns and software tied to electric power disruption, VPN appliance compromise, OpenSSH backdoors, credential theft, and wipers, so risk owners should ask whether high-value systems have defensible software integrity validation and recovery procedures, not just malware alerts.
Technical view
ATT&CK lists this as a persistence technique across ESXi, Linux, macOS, and Windows. The official description highlights binary replacement, infection of support files, malicious patching such as entry point/IAT modification, modified SSH clients for credential collection, and attempts to prevent updates such as Linux yum version locking. Because no official detection text is provided, SOC and IR teams should validate coverage through the related detection strategy DET0336 and local controls: compare critical binaries and libraries against trusted package/vendor baselines, monitor unexpected changes to executable paths and support files, review package-manager lock/configuration changes, and treat modified authentication or remote-access components as both persistence and credential-risk evidence.
Likely telemetry
- File integrity monitoring for executables, libraries, application support files, and service components
- Package manager logs and configuration changes, including version lock artifacts on Linux systems using yum
- Endpoint process execution and module/library load telemetry for trusted applications executing unexpected code paths or modified files
- Code-signing or signature validation results for executable and script artifacts where available
- Authentication and remote-access component logs, especially for SSH clients/servers and VPN-related components referenced in relationship context
Detection direction
- Build detections around integrity drift on high-value binaries rather than only process names; a trusted process name can be the persistence container.
- Tune file-change alerts with software deployment, patching, and configuration-management windows to reduce false positives while preserving alerts for out-of-band binary or library changes.
- Validate whether package-manager controls can identify update prevention behaviors, including yum version locking where applicable.
- For Linux examples such as OpenSSH backdoors in related software, correlate binary/library changes with new credential collection indicators and unusual authentication activity.
- For macOS and Windows examples in related software, ensure signature validation and trusted baseline comparison are part of triage, not just malware name detection.
Mitigation priorities
- Start with code signing and signature verification where supported, consistent with ATT&CK mitigation M1045.
- Maintain trusted hashes or package/vendor baselines for critical binaries, shared libraries, authentication components, remote-access software, and service support files.
- Restrict write access to application directories, system binary paths, libraries, and package-manager configuration to authorized administrative workflows.
- Integrate software deployment and patch management with integrity monitoring so unauthorized changes are distinguishable from approved updates.
- Include binary integrity checks in incident response containment and eradication before restoring service or rotating credentials.
Analyst notes and limits
The most useful defensive question is: which trusted binaries would we not notice being changed? This technique is especially material when persistence hides inside software that operators, administrators, or services execute routinely. Relationship context broadens the practical concern beyond ordinary endpoints to remote-access and infrastructure components, but local asset inventory determines what is truly in scope.
The supplied ATT&CK object does not provide official detection text, and the mitigation relationship only explicitly provides Code Signing. Telemetry and control guidance therefore reflects conservative defensive validation derived from the official description, platforms, tactics, external references, and relationships. Local operating systems, package managers, software inventories, and logging depth are required to determine actual coverage.
Compromise Host Software Binary
Adversaries may modify host software binaries to establish persistent access to systems. Software binaries/executables provide a wide range of system commands or services, programs, and libraries. Common software binaries are SSH clients, FTP clients, email clients, web browsers, and many other user or server applications.
Adversaries may establish persistence though modifications to host software binaries. For example, an adversary may replace or otherwise infect a legitimate application binary (or support files) with a backdoor. Since these binaries may be routinely executed by applications or the user, the adversary can leverage this for persistent access to the host. An adversary may also modify a software binary such as an SSH client in order to persistently collect credentials during logins (i.e., Modify Authentication Process).[1]
An adversary may also modify an existing binary by patching in malicious functionality (e.g., IAT Hooking/Entry point patching)[2] prior to the binary’s legitimate execution. For example, an adversary may modify the entry point of a binary to point to malicious code patched in by the adversary before resuming normal execution flow.[3]
After modifying a binary, an adversary may attempt to impair defenses by preventing it from updating (e.g., via the `yum-versionlock` command or `versionlock.list` file in Linux systems that use the yum package manager).[1]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Groups, software, and campaigns
G1048: UNC3886
UNC3886 is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pacific-Japan (APJ) regions. UNC3886 has displayed a deep understanding of edge devices and virtualization technologies through the exploitation of zero-day vulnerabilities and the use of novel malware families and utilities.[1][2]
G1023: APT5
APT5 is a China-based espionage actor that has been active since at least 2007 primarily targeting the telecommunications, aerospace, and defense industries throughout the U.S., Europe, and Asia. APT5 has displayed advanced tradecraft and significant interest in compromising networking devices and their underlying software including through the use of zero-day exploits.[1][2][3][4][5][6]
S9014: PHASEJAM
S1116: WARPWIRE
WARPWIRE is a Javascript credential stealer that targets plaintext passwords and usernames for exfiltration that was used during Cutting Edge to target Ivanti Connect Secure VPNs.[1][2]
S0604: Industroyer
Industroyer is a sophisticated malware framework designed to cause an impact to the working processes of Industrial Control Systems (ICS), specifically components used in electrical substations.[1] Industroyer was used in the attacks on the Ukrainian power grid in December 2016.[2] This is the first publicly known malware specifically designed to target and impact operations in the electric grid.[3]
S1136: BFG Agonizer
BFG Agonizer is a wiper related to the open-source project CRYLINE-v.5.0. The malware is associated with wiping operations conducted by the Agrius threat actor.[1]
S1118: BUSHWALK
BUSHWALK is a web shell written in Perl that was inserted into the legitimate querymanifest.cgi file on compromised Ivanti Connect Secure VPNs during Cutting Edge.[1][2]
S0641: Kobalos
Kobalos is a multi-platform backdoor that can be used against Linux, FreeBSD, and Solaris. Kobalos has been deployed against high profile targets, including high-performance computers, academic servers, an endpoint security vendor, and a large internet service provider; it has been found in Europe, North America, and Asia. Kobalos was first identified in late 2019.[1][2]
S0487: Kessel
S0595: ThiefQuest
ThiefQuest is a virus, data stealer, and wiper that presents itself as ransomware targeting macOS systems. ThiefQuest was first seen in 2020 distributed via trojanized pirated versions of popular macOS software on Russian forums sharing torrent links.[1] Even though ThiefQuest presents itself as ransomware, since the dynamically generated encryption key is never sent to the attacker it may be more appropriately thought of as a form of wiper malware.[2][3]
S1121: LITTLELAMB.WOOLTEA
LITTLELAMB.WOOLTEA is a backdoor that was used by UNC5325 during Cutting Edge to deploy malware on targeted Ivanti Connect Secure VPNs and to establish persistence across system upgrades and patches.[1]
S1184: BOLDMOVE
BOLDMOVE is a type of backdoor malware written in C linked to People’s Republic of China operations from 2022 through 2023. BOLDMOVE includes both Windows and Linux variants, with some Linux variants specifically designed for FortiGate Firewall devices. BOLDMOVE is linked to zero-day exploitation of CVE-2022-42475 in FortiOSS SSL-VPNs.[1] The record for BOLDMOVE only covers known Linux variants.
S0377: Ebury
Ebury is an OpenSSH backdoor and credential stealer targeting Linux servers and container hosts developed by Windigo. Ebury is primarily installed through modifying shared libraries (`.so` files) executed by the legitimate OpenSSH program. First seen in 2009, Ebury has been used to maintain a botnet of servers, deploy additional malware, and steal cryptocurrency wallets, credentials, and credit card details.[1][2][3][4]
S1119: LIGHTWIRE
LIGHTWIRE is a web shell written in Perl that was used during Cutting Edge to maintain access and enable command execution by imbedding into the legitimate compcheckresult.cgi component of Ivanti Secure Connect VPNs.[1][2]
C0029: Cutting Edge
Cutting Edge was a campaign conducted by suspected China-nexus espionage actors, variously identified as UNC5221/UTA0178 and UNC5325, that began as early as December 2023 with the exploitation of zero-day vulnerabilities in Ivanti Connect Secure (previously Pulse Secure) VPN appliances. Cutting Edge targeted the U.S. defense industrial base and multiple sectors globally including telecommunications, financial, aerospace, and technology. Cutting Edge featured the use of defense evasion and living-off-the-land (LoTL) techniques along with the deployment of web shells and other custom malware.[1][2][3][4][5]
C0025: 2016 Ukraine Electric Power Attack
2016 Ukraine Electric Power Attack was a Sandworm Team campaign during which they used Industroyer malware to target and disrupt distribution substations within the Ukrainian power grid. This campaign was the second major public attack conducted against Ukraine by Sandworm Team.[1][2]
C0056: RedPenguin
The RedPenguin project was launched by Juniper in July 2024 to investigate reported malware infections of Juniper MX Series routers. RedPenguin activity was separately attributed to UNC3886 and included the deployment of multiple custom versions of the publicly-available TINYSHELL backdoor on Juniper routers.[1][2]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 2.2 | Current bundle | ddde01b3d5f0… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Google Cloud Mandiant UNC3886 2024
Punsaen Boonyakarn, Shawn Chew, Logeswaran Nadarajan, Mathew Potaczek, Jakub Jozwiak, and Alex Marvi. (2024, June 18). Cloaked and Covert: Uncovering UNC3886 Espionage Operations. Retrieved September 24, 2024.
Open source URL -
[2]
Unit42 Banking Trojans Hooking 2022
Or Chechik. (2022, October 31). Banking Trojan Techniques: How Financially Motivated Malware Became Infrastructure. Retrieved September 27, 2023.
Open source URL -
[3]
ESET FontOnLake Analysis 2021
Vladislav Hrčka. (2021, January 1). FontOnLake. Retrieved September 27, 2023.
Open source URL -
[4]
mitre-attack T1554Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.