LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0044: JHUHUGIT

JHUHUGIT is malware used by APT28. It is based on Carberp source code and serves as reconnaissance malware. [1] [2] [3] [4]

EnterpriseS0044MalwareObject v2.2Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

S0044: JHUHUGIT describes [JHUHUGIT](https://attack.mitre.org/software/S0044) is malware used by [APT28](https://attack.mitre.org/groups/G0007). It is based on Carberp source code and serves as reconnaissance malware. (Citation: Kaspersky Sofacy) (Citation: F-Secure Sofacy 2015) (Citation: ESET Sednit Part 1) (Citation: FireEye APT28 January 2017)

Executive priority

S0044: JHUHUGIT is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S0044: JHUHUGIT by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

  • Official ATT&CK relationships and object metadata
  • Network, endpoint, and security-tool telemetry

Detection direction

  • Validate whether S0044: JHUHUGIT appears in your detection coverage and tabletop scenarios.
  • Use the object to align executive risk language with SOC, incident response, and detection engineering work.
  • Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

  • Map the object to existing controls and identify missing telemetry or response ownership.
  • Prioritize mitigations that reduce exposure on the listed platforms and tactics.
  • Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

JHUHUGIT

JHUHUGIT is malware used by APT28. It is based on Carberp source code and serves as reconnaissance malware. [1] [2] [3] [4]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

20 rows
DomainIDNameRelationship / procedure
EnterpriseT1008Fallback Channels

JHUHUGIT tests if it can reach its C2 server by first attempting a direct connection, and if it fails, obtaining proxy settings and sending the connection through a proxy, and finally injecting code into a running browser if the proxy method fails.[3]

EnterpriseT1057Process Discovery

JHUHUGIT obtains a list of running processes on the victim.[3][5]

EnterpriseT1053.005Scheduled TaskSub-technique

JHUHUGIT has registered itself as a scheduled task to run each time the current user logs in.[3]CitationESET Sednit July 2015

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

JHUHUGIT has used a Registry Run key to establish persistence by executing JavaScript code within the rundll32.exe process.[3]

EnterpriseT1037.001Logon Script (Windows)Sub-technique

JHUHUGIT has registered a Windows shell script under the Registry key HKCU\Environment\UserInitMprLogonScript to establish persistence.[3][6]

EnterpriseT1059.003Windows Command ShellSub-technique

JHUHUGIT uses a .bat file to execute a .dll.[6]

EnterpriseT1068Exploitation for Privilege Escalation

JHUHUGIT has exploited CVE-2015-1701 and CVE-2015-2387 to escalate privileges.[3]CitationESET Sednit July 2015

EnterpriseT1546.015Component Object Model HijackingSub-technique

JHUHUGIT has used COM hijacking to establish persistence by hijacking a class named MMDeviceEnumerator and also by registering the payload as a Shell Icon Overlay handler COM object ({3543619C-D563-43f7-95EA-4DA7E1CC396A}).[3][6]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

Many strings in JHUHUGIT are obfuscated with a XOR algorithm.[2][3][6]

EnterpriseT1543.003Windows ServiceSub-technique

JHUHUGIT has registered itself as a service to establish persistence.[3]

EnterpriseT1055Process Injection

JHUHUGIT performs code injection injecting its own functions to browser processes.[2][5]

EnterpriseT1218.011Rundll32Sub-technique

JHUHUGIT is executed using rundll32.exe.[2][6]

EnterpriseT1680Local Storage Discovery

JHUHUGIT obtains a build identifier as well as victim hard drive information from Windows registry key HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum. Another JHUHUGIT variant gathers the victim storage volume serial number and the storage device name.[3][5]

EnterpriseT1070.004File DeletionSub-technique

The JHUHUGIT dropper can delete itself from the victim. Another JHUHUGIT variant has the capability to delete specified files.[3][5]

EnterpriseT1105Ingress Tool Transfer

JHUHUGIT can retrieve an additional payload from its C2 server.[3][5] JHUHUGIT has a command to download files to the victim’s machine.[6]

EnterpriseT1113Screen Capture

A JHUHUGIT variant takes screenshots by simulating the user pressing the "Take Screenshot" key (VK_SCREENSHOT), accessing the screenshot saved in the clipboard, and converting it to a JPG image.CitationUnit 42 Playbook Dec 2017[6]

EnterpriseT1016System Network Configuration Discovery

A JHUHUGIT variant gathers network interface card information.CitationUnit 42 Playbook Dec 2017

EnterpriseT1132.001Standard EncodingSub-technique

A JHUHUGIT variant encodes C2 POST data base64.CitationUnit 42 Playbook Dec 2017

EnterpriseT1071.001Web ProtocolsSub-technique

JHUHUGIT variants have communicated with C2 servers over HTTP and HTTPS.[3][5]CitationUnit 42 Playbook Dec 2017

EnterpriseT1115Clipboard Data

A JHUHUGIT variant accesses a screenshot saved in the clipboard and converts it to a JPG image.CitationUnit 42 Playbook Dec 2017

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0007: APT28

APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.[1][2] This group has been active since at least 2004.[3][4][5][6][7][8][9][10][11][12][13]

APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.[5] In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.[14] Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.

Relationship explorer

All related ATT&CK context

uses · GroupG0007: APT28Enterpriseuses · TechniqueT1008: Fallback ChannelsEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1053.005: Scheduled TaskEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1037.001: Logon Script (Windows)Enterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1068: Exploitation for Privilege EscalationEnterpriseuses · TechniqueT1546.015: Component Object Model HijackingEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1543.003: Windows ServiceEnterpriseuses · TechniqueT1055: Process InjectionEnterpriseuses · TechniqueT1218.011: Rundll32Enterpriseuses · TechniqueT1680: Local Storage DiscoveryEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1132.001: Standard EncodingEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1115: Clipboard DataEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.2
Object version
2.2
Created
Modified
Raw hash
e921a788f9c0b4f4...
Imported snapshots across ATT&CK releases(2)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.22.2Current bundlee921a788f9c0…
19.12.2Older bundlee921a788f9c0…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Kaspersky Sofacy

    Kaspersky Lab's Global Research and Analysis Team. (2015, December 4). Sofacy APT hits high profile targets with updated toolset. Retrieved December 10, 2015.

    Open source URL
  2. [2]
    F-Secure Sofacy 2015

    F-Secure. (2015, September 8). Sofacy Recycles Carberp and Metasploit Code. Retrieved August 3, 2016.

    Open source URL
  3. [3]
    ESET Sednit Part 1

    ESET. (2016, October). En Route with Sednit - Part 1: Approaching the Target. Retrieved November 8, 2016.

  4. [4]
    FireEye APT28 January 2017

    FireEye iSIGHT Intelligence. (2017, January 11). APT28: At the Center of the Storm. Retrieved November 17, 2024.

    Open source URL
  5. [5]
    Unit 42 Sofacy Feb 2018

    Lee, B, et al. (2018, February 28). Sofacy Attacks Multiple Government Entities. Retrieved March 15, 2018.

    Open source URL
  6. [6]
    Talos Seduploader Oct 2017

    Mercer, W., et al. (2017, October 22). "Cyber Conflict" Decoy Document Used in Real Cyber Conflict. Retrieved November 2, 2018.

    Open source URL
  7. [7]
    GAMEFISH

    (Citation: FireEye APT28 January 2017)

  8. [8]
    JHUHUGIT

    (Citation: FireEye APT28 January 2017)

  9. [9]
    JKEYSKW

    (Citation: FireEye APT28 January 2017)

  10. [10]
    Sednit

    This designation has been used in reporting both to refer to the threat group ([APT28](https://attack.mitre.org/groups/G0007)) and its associated malware.(Citation: FireEye APT28 January 2017)

  11. [11]
    Seduploader

    (Citation: FireEye APT28 January 2017)(Citation: Talos Seduploader Oct 2017)

  12. [12]
    SofacyCarberp

    (Citation: Unit 42 Sofacy Feb 2018)

  13. [13]
    Symantec APT28 Oct 2018

    Symantec Security Response. (2018, October 04). APT28: New Espionage Operations Target Military and Government Organizations. Retrieved November 14, 2018.

    Open source URL
  14. [14]
    Trojan.Sofacy

    This designation has been used in reporting both to refer to the threat group ([Skeleton Key](https://attack.mitre.org/software/S0007)) and its associated malware.(Citation: Symantec APT28 Oct 2018)

  15. [15]
    mitre-attackS0044
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use