LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0083: Misdat

Misdat is a backdoor that was used in Operation Dust Storm from 2010 to 2011.[1]

EnterpriseS0083MalwareObject v1.2Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Misdat matters because ATT&CK records it as a Windows backdoor historically used in Operation Dust Storm, a long-running cyber espionage campaign. The value for leaders is not the malware name itself, but the defensive pattern it represents: endpoint persistence, host discovery, local data collection, command-and-control, tool transfer, cleanup, and exfiltration over the same C2 channel.

Executive priority

Prioritize Misdat as a validation case for espionage-oriented intrusion readiness on Windows endpoints. Security leaders should ask whether the organization can prove visibility across persistence, command shell execution, suspicious C2, file staging/deletion, timestamp manipulation, and data exfiltration behaviors. This is especially relevant for incident response evidence preservation and audit conversations about endpoint monitoring and data protection controls.

Technical view

ATT&CK provides no official detection text for Misdat, so SOC and detection teams should use the mapped behaviors as the validation scope. On Windows, test whether controls observe Boot or Logon Autostart Execution, Windows Command Shell activity, Native API-linked execution patterns, System Information Discovery, File and Directory Discovery, System Language Discovery, Data from Local System, Ingress Tool Transfer, Non-Application Layer Protocol C2, Standard Encoding, Exfiltration Over C2 Channel, Software Packing, masquerading via legitimate-looking names or locations, File Deletion, Timestomp, and Clear Persistence. Correlating these behaviors is more useful than relying on a single malware signature.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry
  • Autostart and persistence location monitoring, including startup-related registry or service changes where collected
  • File creation, deletion, rename, path, and metadata/timestamp telemetry
  • Endpoint security alerts for packed or obfuscated executables
  • Network flow and protocol metadata for unusual C2 patterns, including non-application-layer or encoded communications where visible

Detection direction

  • Build detections around behavior chains: discovery followed by local file access, tool transfer, outbound C2, and cleanup is higher fidelity than any one event alone.
  • Tune Windows command shell monitoring for unusual parent-child process relationships, suspicious execution paths, and discovery commands, while accounting for administrator and software management activity.
  • Validate coverage for masquerading and trusted-directory abuse by comparing executable names, paths, signatures, and expected baselines.
  • Confirm whether file deletion and timestomping are retained in telemetry long enough for incident reconstruction; these behaviors can erase or distort evidence.
  • Review network detection assumptions: exfiltration over an existing C2 channel and standard encoding may not be obvious from payload inspection alone, especially where encryption or limited packet capture exists.

Mitigation priorities

  • Harden and monitor Windows autostart locations and restrict unnecessary write access to trusted directories.
  • Apply least privilege and application control where feasible to reduce unauthorized command shell, tool transfer, and unknown executable execution.
  • Strengthen endpoint logging retention and centralization so deletion, timestomping, and persistence cleanup do not eliminate investigative evidence.
  • Limit and monitor outbound network paths, especially unusual protocols or destinations not required for business operations.
  • Protect sensitive local data through access controls, data minimization, and monitoring of unusual file enumeration or access patterns.
Additional notes and limits

The ATT&CK object identifies Misdat as a backdoor used in Operation Dust Storm from 2010 to 2011 and links it to multiple ATT&CK techniques. The strongest defensive use is as a coverage checklist for Windows backdoor tradecraft rather than as a standalone indicator-driven detection item.

MITRE provides no official detection guidance in the supplied object, and the malware description is brief. Technique relationships describe possible observed behaviors, not guaranteed activity in every incident. Local environment baselines, telemetry depth, and retention determine whether these behaviors can be detected or investigated.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Misdat

Misdat is a backdoor that was used in Operation Dust Storm from 2010 to 2011.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

16 rows
DomainIDNameRelationship / procedure
EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

Misdat saves itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.[1][2]

EnterpriseT1083File and Directory Discovery

Misdat is capable of running commands to obtain a list of files and directories, as well as enumerating logical drives.[1]

EnterpriseT1041Exfiltration Over C2 Channel

Misdat has uploaded files and data to its C2 servers.[1]

EnterpriseT1095Non-Application Layer Protocol

Misdat network traffic communicates over a raw socket.[1]

EnterpriseT1005Data from Local System

Misdat has collected files and data from a compromised host.[1]

EnterpriseT1070.004File DeletionSub-technique

Misdat is capable of deleting the backdoor file.[1]

EnterpriseT1070.009Clear PersistenceSub-technique

Misdat is capable of deleting Registry keys used for persistence.[1]

EnterpriseT1082System Information Discovery

The initial beacon packet for Misdat contains the operating system version of the victim.[1]

EnterpriseT1547Boot or Logon Autostart Execution

Misdat has created registry keys for persistence, including `HKCU\Software\dnimtsoleht\StubPath`, `HKCU\Software\snimtsOleht\StubPath`, `HKCU\Software\Backtsaleht\StubPath`, `HKLM\SOFTWARE\Microsoft\Active Setup\Installed. Components\{3bf41072-b2b1-21c8-b5c1-bd56d32fbda7}`, and `HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{3ef41072-a2f1-21c8-c5c1-70c2c3bc7905}`.[1]

EnterpriseT1132.001Standard EncodingSub-technique

Misdat network traffic is Base64-encoded plaintext.[1]

EnterpriseT1105Ingress Tool Transfer

Misdat is capable of downloading files from the C2.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

Misdat is capable of providing shell functionality to the attacker to execute commands.[1]

EnterpriseT1614.001System Language DiscoverySub-technique

Misdat has attempted to detect if a compromised host had a Japanese keyboard via the Windows API call `GetKeyboardType`.[1]

EnterpriseT1027.002Software PackingSub-technique

Misdat was typically packed using UPX.[1]

EnterpriseT1070.006TimestompSub-technique

Many Misdat samples were programmed using Borland Delphi, which will mangle the default PE compile timestamp of a file.[1]

EnterpriseT1106Native API

Misdat has used Windows APIs, including `ExitWindowsEx` and `GetKeyboardType`.[1]

Associated objects

Groups, software, and campaigns

CampaignEnterprise

C0016: Operation Dust Storm

Operation Dust Storm was a long-standing persistent cyber espionage campaign that targeted multiple industries in Japan, South Korea, the United States, Europe, and several Southeast Asian countries. By 2015, the Operation Dust Storm threat actors shifted from government and defense-related intelligence targets to Japanese companies or Japanese subdivisions of larger foreign organizations supporting Japan's critical infrastructure, including electricity generation, oil and natural gas, finance, transportation, and construction.[1]

Operation Dust Storm threat actors also began to use Android backdoors in their operations by 2015, with all identified victims at the time residing in Japan or South Korea.[1]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1036.005: Match Legitimate Resource Name or LocationEnterpriseuses · CampaignC0016: Operation Dust StormEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1095: Non-Application Layer ProtocolEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1070.009: Clear PersistenceEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1547: Boot or Logon Autostart ExecutionEnterpriseuses · TechniqueT1132.001: Standard EncodingEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1614.001: System Language DiscoveryEnterpriseuses · TechniqueT1027.002: Software PackingEnterpriseuses · TechniqueT1070.006: TimestompEnterpriseuses · TechniqueT1106: Native APIEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.2
Created
Modified
Raw hash
0bea1555997d2db1...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.2Current bundle0bea1555997d…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  2. [2]
    Microsoft DTC

    Microsoft. (2011, January 12). Distributed Transaction Coordinator. Retrieved February 25, 2016.

    Open source URL
  3. [3]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  4. [4]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  5. [5]
    mitre-attackS0083
    Open source URL
  6. [6]
    mitre-attackS0083
    Open source URL
  7. [7]
    mitre-attackS0083
    Open source URL
  8. [8]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  9. [9]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  10. [10]
    Microsoft DTC

    Microsoft. (2011, January 12). Distributed Transaction Coordinator. Retrieved February 25, 2016.

    Open source URL
  11. [11]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  12. [12]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  13. [13]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  14. [14]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  15. [15]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  16. [16]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  17. [17]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  18. [18]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  19. [19]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  20. [20]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  21. [21]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  22. [22]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  23. [23]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  24. [24]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  25. [25]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  26. [26]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  27. [27]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  28. [28]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  29. [29]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  30. [30]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  31. [31]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  32. [32]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  33. [33]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  34. [34]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  35. [35]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  36. [36]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  37. [37]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  38. [38]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  39. [39]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use