LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0018: Sykipot

Sykipot is malware that has been used in spearphishing campaigns since approximately 2007 against victims primarily in the US. One variant of Sykipot hijacks smart cards on victims. [1] The group using this malware has also been referred to as Sykipot. [2]

EnterpriseS0018MalwareObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Automated summary not available

Glexia publishes ATT&CK takes only after source-hash and schema validation. Until then, use the official MITRE definition below and the defensive relationship context on this page.

Official MITRE ATT&CK definition

Sykipot

Sykipot is malware that has been used in spearphishing campaigns since approximately 2007 against victims primarily in the US. One variant of Sykipot hijacks smart cards on victims. [1] The group using this malware has also been referred to as Sykipot. [2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

11 rows
DomainIDNameRelationship / procedure
EnterpriseT1007System Service Discovery

Sykipot may use net start to display running services.CitationAlienVault Sykipot 2011

EnterpriseT1573.002Asymmetric CryptographySub-technique

Sykipot uses SSL for encrypting C2 communications.[2]

EnterpriseT1111Multi-Factor Authentication Interception

Sykipot is known to contain functionality that enables targeting of smart card technologies to proxy authentication for connections to restricted network resources using detected hardware tokens.[1]

EnterpriseT1087.002Domain AccountSub-technique

Sykipot may use net group "domain admins" /domain to display accounts in the "domain admins" permissions group and net localgroup "administrators" to list local system administrator group membership.CitationAlienVault Sykipot 2011

EnterpriseT1057Process Discovery

Sykipot may gather a list of running processes by running tasklist /v.CitationAlienVault Sykipot 2011

EnterpriseT1056.001KeyloggingSub-technique

Sykipot contains keylogging functionality to steal passwords.[1]

EnterpriseT1018Remote System Discovery

Sykipot may use net view /domain to display hostnames of available systems on a network.CitationAlienVault Sykipot 2011

EnterpriseT1049System Network Connections Discovery

Sykipot may use netstat -ano to display active network connections.CitationAlienVault Sykipot 2011

EnterpriseT1016System Network Configuration Discovery

Sykipot may use ipconfig /all to gather system network configuration details.CitationAlienVault Sykipot 2011

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

Sykipot has been known to establish persistence by adding programs to the Run Registry key.[2]

EnterpriseT1055.001Dynamic-link Library InjectionSub-technique

Sykipot injects itself into running instances of outlook.exe, iexplore.exe, or firefox.exe.CitationAlienVault Sykipot 2011

Relationship explorer

All related ATT&CK context

uses · TechniqueT1007: System Service DiscoveryEnterpriseuses · TechniqueT1573.002: Asymmetric CryptographyEnterpriseuses · TechniqueT1111: Multi-Factor Authentication InterceptionEnterpriseuses · TechniqueT1087.002: Domain AccountEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1056.001: KeyloggingEnterpriseuses · TechniqueT1018: Remote System DiscoveryEnterpriseuses · TechniqueT1049: System Network Connections DiscoveryEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1055.001: Dynamic-link Library InjectionEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
20.0
Object version
1.1
Created
Modified
Raw hash
339f79b7b7d4204f...
Imported snapshots across ATT&CK releases(3)
ReleaseBundle importedObject versionModifiedStatusRaw hash
20.01.1Current bundle339f79b7b7d4…
19.21.1Older bundle339f79b7b7d4…
19.11.1Older bundle339f79b7b7d4…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Alienvault Sykipot DOD Smart Cards

    Blasco, J. (2012, January 12). Sykipot variant hijacks DOD and Windows smart cards. Retrieved January 10, 2016.

    Open source URL
  2. [2]
    Blasco 2013

    Blasco, J. (2013, March 21). New Sykipot developments [Blog]. Retrieved November 12, 2014.

  3. [3]
    mitre-attackS0018
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use