S0045: ADVSTORESHELL
ADVSTORESHELL is a spying backdoor that has been used by APT28 from at least 2012 to 2016. It is generally used for long-term espionage and is deployed on targets deemed interesting after a reconnaissance phase. [1] [2]
Security context for executives and security teams
S0045: ADVSTORESHELL describes [ADVSTORESHELL](https://attack.mitre.org/software/S0045) is a spying backdoor that has been used by [APT28](https://attack.mitre.org/groups/G0007) from at least 2012 to 2016. It is generally used for long-term espionage and is deployed on targets deemed interesting after a reconnaissance phase. (Citation: Kaspersky Sofacy) (Citation: ESET Sednit Part 2)
Executive priority
S0045: ADVSTORESHELL is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate S0045: ADVSTORESHELL by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
- Network, endpoint, and security-tool telemetry
Detection direction
- Validate whether S0045: ADVSTORESHELL appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
ADVSTORESHELL
ADVSTORESHELL is a spying backdoor that has been used by APT28 from at least 2012 to 2016. It is generally used for long-term espionage and is deployed on targets deemed interesting after a reconnaissance phase. [1] [2]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1546.015 | Component Object Model HijackingSub-technique | Some variants of ADVSTORESHELL achieve persistence by registering the payload as a Shell Icon Overlay handler COM object.[2] |
| Enterprise | T1082 | System Information Discovery | ADVSTORESHELL can run Systeminfo to gather information about the victim.[2]CitationBitdefender APT28 Dec 2015 |
| Enterprise | T1056.001 | KeyloggingSub-technique | ADVSTORESHELL can perform keylogging.[2]CitationBitdefender APT28 Dec 2015 |
| Enterprise | T1132.001 | Standard EncodingSub-technique | C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding.[1] |
| Enterprise | T1218.011 | Rundll32Sub-technique | ADVSTORESHELL has used rundll32.exe in a Registry value to establish persistence.CitationBitdefender APT28 Dec 2015 |
| Enterprise | T1547.001 | Registry Run Keys / Startup FolderSub-technique | ADVSTORESHELL achieves persistence by adding itself to the |
| Enterprise | T1560 | Archive Collected Data | ADVSTORESHELL encrypts with the 3DES algorithm and a hardcoded key prior to exfiltration.[2] |
| Enterprise | T1070.004 | File DeletionSub-technique | ADVSTORESHELL can delete files and directories.[2] |
| Enterprise | T1074.001 | Local Data StagingSub-technique | ADVSTORESHELL stores output from command execution in a .dat file in the %TEMP% directory.[2] |
| Enterprise | T1029 | Scheduled Transfer | ADVSTORESHELL collects, compresses, encrypts, and exfiltrates data to the C2 server every 10 minutes.[2] |
| Enterprise | T1057 | Process Discovery | ADVSTORESHELL can list running processes.[2] |
| Enterprise | T1059.003 | Windows Command ShellSub-technique | ADVSTORESHELL can create a remote shell and run a given command.[2]CitationBitdefender APT28 Dec 2015 |
| Enterprise | T1083 | File and Directory Discovery | ADVSTORESHELL can list files and directories.[2]CitationBitdefender APT28 Dec 2015 |
| Enterprise | T1573.001 | Symmetric CryptographySub-technique | A variant of ADVSTORESHELL encrypts some C2 with 3DES.CitationBitdefender APT28 Dec 2015 |
| Enterprise | T1071.001 | Web ProtocolsSub-technique | ADVSTORESHELL connects to port 80 of a C2 server using Wininet API. Data is exchanged via HTTP POSTs.[1] |
| Enterprise | T1012 | Query Registry | ADVSTORESHELL can enumerate registry keys.[2]CitationBitdefender APT28 Dec 2015 |
| Enterprise | T1120 | Peripheral Device Discovery | ADVSTORESHELL can list connected devices.[2] |
| Enterprise | T1112 | Modify Registry | ADVSTORESHELL is capable of setting and deleting Registry values.CitationBitdefender APT28 Dec 2015 |
| Enterprise | T1027 | Obfuscated Files or Information | Most of the strings in ADVSTORESHELL are encrypted with an XOR-based algorithm; some strings are also encrypted with 3DES and reversed. API function names are also reversed, presumably to avoid detection in memory.[1]CitationBitdefender APT28 Dec 2015 |
| Enterprise | T1560.003 | Archive via Custom MethodSub-technique | ADVSTORESHELL compresses output data generated by command execution with a custom implementation of the Lempel–Ziv–Welch (LZW) algorithm.[2] |
| Enterprise | T1106 | Native API | ADVSTORESHELL is capable of starting a process using CreateProcess.CitationBitdefender APT28 Dec 2015 |
| Enterprise | T1573.002 | Asymmetric CryptographySub-technique | A variant of ADVSTORESHELL encrypts some C2 with RSA.CitationBitdefender APT28 Dec 2015 |
| Enterprise | T1041 | Exfiltration Over C2 Channel | ADVSTORESHELL exfiltrates data over the same channel used for C2.[2] |
Groups, software, and campaigns
G0007: APT28
APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.[1][2] This group has been active since at least 2004.[3][4][5][6][7][8][9][10][11][12][13]
APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.[5] In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.[14] Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(3)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 20.0 | 1.1 | Current bundle | 075eb3f8c565… | ||
| 19.2 | 1.1 | Older bundle | 075eb3f8c565… | ||
| 19.1 | 1.1 | Older bundle | 075eb3f8c565… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Kaspersky Sofacy
Kaspersky Lab's Global Research and Analysis Team. (2015, December 4). Sofacy APT hits high profile targets with updated toolset. Retrieved December 10, 2015.
Open source URL - [2]ESET Sednit Part 2
ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.
- [3]mitre-attackS0045Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.