LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0125: Remsec

Remsec is a modular backdoor that has been used by Strider and appears to have been designed primarily for espionage purposes. Many of its modules are written in Lua. [1]

EnterpriseS0125MalwareObject v1.5Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Remsec is a Windows modular backdoor described by ATT&CK as primarily espionage-oriented and used by Strider. Its value for defenders is not a single signature; it is the behavior set around long-running access: credential access from the SAM, extensive host and network discovery, Lua-based execution, persistence via scheduled tasks, DLL injection, multiple command-and-control protocol options, and exfiltration paths including USB/removable media. For leaders, this makes Remsec a useful planning case for whether the organization can find quiet, modular intrusion activity before it turns into data loss or prolonged unauthorized access.

Executive priority

Prioritize this as a readiness and assurance question: can Windows endpoint, identity, network, removable-media, and incident-response controls prove they would expose an espionage-style backdoor that blends discovery, credential access, persistence, and exfiltration? The business risk is strongest where sensitive data, government communications, restricted networks, or air-gapped/USB-dependent workflows exist. Budget and audit discussions should focus on evidence of coverage across credential protection, endpoint logging, scheduled task governance, removable media control, DNS/web/mail egress visibility, and response procedures for suspected long-dwell backdoors.

Technical view

Validate coverage around the ATT&CK relationships rather than relying on an official Remsec detection, because none is provided. On Windows hosts, review detections for SAM access or dumping behavior, scheduled task creation or modification, DLL injection indicators, keylogging-like input capture, Lua script or embedded Lua execution where unusual, process/file/user/system/network discovery bursts, file deletion after tool activity, and use of legitimate-looking names or locations. Network teams should validate visibility for web, mail, and DNS command-and-control patterns and unencrypted non-C2 exfiltration. IR teams should include removable media and USB exfiltration handling in scoping, especially when investigating segmented or disconnected environments.

Likely telemetry

  • Windows endpoint process creation, command-line, parent/child process, module load, and script execution telemetry
  • Windows Registry and file access events relevant to SAM credential material
  • Scheduled task creation, modification, and execution records
  • Endpoint detection telemetry for process injection, DLL loading, suspicious file placement, and file deletion
  • Authentication and local account context for discovered or targeted users

Detection direction

  • Build detections from the related behaviors: credential access from SAM, discovery clustering, scheduled task persistence, DLL injection, Lua execution, C2 over common application protocols, file cleanup, and removable-media collection or exfiltration.
  • Correlate low-severity discovery events with higher-risk events such as SAM access, new scheduled tasks, process injection, or unusual outbound DNS/web/mail traffic from the same host or user context.
  • Tune for administrative false positives: system inventory tools, vulnerability scanners, help desk scripts, backup agents, and legitimate scheduled tasks can resemble portions of the behavior. Require baselines and change context.
  • Validate blind spots around encrypted or encoded files, legitimate-looking file names or locations, and activity that uses common protocols rather than obviously malicious ports.
  • For USB scenarios, confirm whether device events are collected at all; many SOCs lack sufficient telemetry to connect removable media insertion to file collection and exfiltration.

Mitigation priorities

  • Harden credential access first: restrict administrative rights, protect local account material, and alert on SAM access patterns that require elevated privileges.
  • Control persistence and execution paths: monitor and govern scheduled tasks, suspicious DLL loading, unusual script execution, and unapproved interpreters such as Lua where not expected.
  • Improve egress governance: log and restrict outbound DNS, web, mail, and unencrypted protocols according to business need, with host attribution for investigations.
  • Apply removable media policy and monitoring where sensitive or segmented environments depend on USB workflows.
  • Strengthen endpoint visibility on Windows systems, especially for process, file, registry, module load, and persistence events.
Additional notes and limits

ATT&CK identifies Remsec as a modular backdoor used by Strider and notes that many modules are written in Lua. The relationship set is broad and spans credential access, discovery, collection, stealth, execution, persistence, privilege escalation, command-and-control, and exfiltration. The strongest defensive value is to use Remsec as a coverage exercise for espionage-style Windows intrusion behavior, not as proof of current activity in any environment.

The official ATT&CK object lists Windows as the platform but does not specify tactics or provide official detection guidance. External references are limited to the supplied Kaspersky and Symantec reporting citations. This take does not assert active exploitation, customer exposure, or guaranteed detection. Local asset criticality, logging depth, egress architecture, USB policy, and baseline administrative behavior are required to determine actual risk and coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Remsec

Remsec is a modular backdoor that has been used by Strider and appears to have been designed primarily for espionage purposes. Many of its modules are written in Lua. [1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

30 rows
DomainIDNameRelationship / procedure
EnterpriseT1055.001Dynamic-link Library InjectionSub-technique

Remsec can perform DLL injection.[2]

EnterpriseT1068Exploitation for Privilege Escalation

Remsec has a plugin to drop and execute vulnerable Outpost Sandbox or avast! Virtualization drivers in order to gain kernel mode privileges.[2]

EnterpriseT1052.001Exfiltration over USBSub-technique

Remsec contains a module to move data from airgapped networks to Internet-connected systems by using a removable USB device.[3]

EnterpriseT1083File and Directory Discovery

Remsec is capable of listing contents of folders on the victim. Remsec also searches for custom network encryption software on victims.[4][3][2]

EnterpriseT1686.003Windows Host FirewallSub-technique

Remsec can add or remove applications or ports on the Windows firewall or disable it entirely.[2]

EnterpriseT1048.003Exfiltration Over Unencrypted Non-C2 ProtocolSub-technique

Remsec can exfiltrate data via a DNS tunnel or email, separately from its C2 channel.[3]

EnterpriseT1049System Network Connections Discovery

Remsec can obtain a list of active connections and open ports.[2]

EnterpriseT1070.004File DeletionSub-technique

Remsec is capable of deleting files on the victim. It also securely removes itself after collecting and exfiltrating data.[4][3][2]

EnterpriseT1056.001KeyloggingSub-technique

Remsec contains a keylogger component.[4][2]

EnterpriseT1057Process Discovery

Remsec can obtain a process list from the victim.[2]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

Some data in Remsec is encrypted using RC5 in CBC mode, AES-CBC with a hardcoded key, RC4, or Salsa20. Some data is also base64-encoded.[4][2]

EnterpriseT1556.002Password Filter DLLSub-technique

Remsec harvests plain-text credentials as a password filter registered on domain controllers.[3]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

The Remsec loader implements itself with the name Security Support Provider, a legitimate Windows function. Various Remsec .exe files mimic legitimate file names used by Microsoft, Symantec, Kaspersky, Hewlett-Packard, and VMWare. Remsec also disguised malicious modules using similar filenames as custom network encryption software on victims.[5][3]

EnterpriseT1095Non-Application Layer Protocol

Remsec is capable of using ICMP, TCP, and UDP for C2.[4][3]

EnterpriseT1018Remote System Discovery

Remsec can ping or traceroute a remote host.[2]

EnterpriseT1071.003Mail ProtocolsSub-technique

Remsec is capable of using SMTP for C2.[4][3][2][6]

EnterpriseT1059.011LuaSub-technique

Remsec can use modules written in Lua for execution.[7]

EnterpriseT1105Ingress Tool Transfer

Remsec contains a network loader to receive executable modules from remote attackers and run them on the local victim. It can also upload and download files over HTTP and HTTPS.[4][2]

EnterpriseT1003.002Security Account ManagerSub-technique

Remsec can dump the SAM database.[2]

EnterpriseT1025Data from Removable Media

Remsec has a package that collects documents from any inserted USB sticks.[2]

EnterpriseT1053.005Scheduled TaskSub-technique

Remsec schedules the execution one of its modules by creating a new scheduler task.[2]

EnterpriseT1082System Information Discovery

Remsec can obtain the OS version information, computer name, processor architecture, machine role, and OS edition.[2]

EnterpriseT1087.001Local AccountSub-technique

Remsec can obtain a list of users.[2]

EnterpriseT1016System Network Configuration Discovery

Remsec can obtain information about network configuration, including the routing table, ARP cache, and DNS cache.[2]

EnterpriseT1033System Owner/User Discovery

Remsec can obtain information about the current user.[2]

EnterpriseT1652Device Driver Discovery

Remsec has a plugin to detect active drivers of some security products.[2]

EnterpriseT1071.001Web ProtocolsSub-technique

Remsec is capable of using HTTP and HTTPS for C2.[4][3][2]

EnterpriseT1046Network Service Discovery

Remsec has a plugin that can perform ARP scanning as well as port scanning.[2]

EnterpriseT1518.001Security Software DiscoverySub-technique

Remsec has a plugin detect security products via active drivers.[2]

EnterpriseT1071.004DNSSub-technique

Remsec is capable of using DNS for C2.[4][3][2]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0041: Strider

Strider is a threat group that has been active since at least 2011 and has targeted victims in Russia, China, Sweden, Belgium, Iran, and Rwanda.[1][2]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1055.001: Dynamic-link Library InjectionEnterpriseuses · TechniqueT1068: Exploitation for Privilege EscalationEnterpriseuses · TechniqueT1052.001: Exfiltration over USBEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1686.003: Windows Host FirewallEnterpriseuses · TechniqueT1048.003: Exfiltration Over Unencrypted Non-C2 ProtocolEnterpriseuses · TechniqueT1049: System Network Connections DiscoveryEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1056.001: KeyloggingEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1556.002: Password Filter DLLEnterpriseuses · TechniqueT1036.005: Match Legitimate Resource Name or LocationEnterpriseuses · TechniqueT1095: Non-Application Layer ProtocolEnterpriseuses · TechniqueT1018: Remote System DiscoveryEnterpriseuses · TechniqueT1071.003: Mail ProtocolsEnterpriseuses · TechniqueT1059.011: LuaEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1003.002: Security Account ManagerEnterpriseuses · TechniqueT1025: Data from Removable MediaEnterpriseuses · TechniqueT1053.005: Scheduled TaskEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1087.001: Local AccountEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.5
Created
Modified
Raw hash
c15f99ff2a8bc23b...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.5Current bundlec15f99ff2a8b…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Symantec Strider Blog

    Symantec Security Response. (2016, August 7). Strider: Cyberespionage group turns eye of Sauron on targets. Retrieved August 17, 2016.

  2. [2]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  3. [3]
    Kaspersky ProjectSauron Full Report

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 17, 2016.

    Open source URL
  4. [4]
    Symantec Remsec IOCs

    Symantec Security Response. (2016, August 8). Backdoor.Remsec indicators of compromise. Retrieved August 17, 2016.

  5. [5]
    ComputerWeekly Strider

    Warwick Ashford. (2016, August 8). Strider cyber attack group deploying malware for espionage. Retrieved January 10, 2024.

    Open source URL
  6. [6]
    Threatpost Sauron

    Michael Mimoso. (2016, August 8). ProjectSauron APT On Par With Equation, Flame, Duqu. Retrieved January 10, 2024.

    Open source URL
  7. [7]
    Kaspersky Lua

    Global Research and Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 5, 2024.

    Open source URL
  8. [8]
    Kaspersky ProjectSauron Blog

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 8). ProjectSauron: top level cyber-espionage platform covertly extracts encrypted government comms. Retrieved August 17, 2016.

    Open source URL
  9. [9]
    Kaspersky ProjectSauron Blog

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 8). ProjectSauron: top level cyber-espionage platform covertly extracts encrypted government comms. Retrieved August 17, 2016.

    Open source URL
  10. [10]
    Kaspersky ProjectSauron Blog

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 8). ProjectSauron: top level cyber-espionage platform covertly extracts encrypted government comms. Retrieved August 17, 2016.

    Open source URL
  11. [11]
    ProjectSauron

    ProjectSauron is used to refer both to the threat group also known as G0041 as well as the malware platform also known as S0125. (Citation: Kaspersky ProjectSauron Blog)

  12. [12]
    ProjectSauron

    ProjectSauron is used to refer both to the threat group also known as G0041 as well as the malware platform also known as S0125. (Citation: Kaspersky ProjectSauron Blog)

  13. [13]
    ProjectSauron

    ProjectSauron is used to refer both to the threat group also known as G0041 as well as the malware platform also known as S0125. (Citation: Kaspersky ProjectSauron Blog)

  14. [14]
    Symantec Strider Blog

    Symantec Security Response. (2016, August 7). Strider: Cyberespionage group turns eye of Sauron on targets. Retrieved August 17, 2016.

  15. [15]
    Symantec Strider Blog

    Symantec Security Response. (2016, August 7). Strider: Cyberespionage group turns eye of Sauron on targets. Retrieved August 17, 2016.

  16. [16]
    mitre-attackS0125
    Open source URL
  17. [17]
    mitre-attackS0125
    Open source URL
  18. [18]
    mitre-attackS0125
    Open source URL
  19. [19]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  20. [20]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  21. [21]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  22. [22]
    Kaspersky ProjectSauron Full Report

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 17, 2016.

    Open source URL
  23. [23]
    Kaspersky ProjectSauron Full Report

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 17, 2016.

    Open source URL
  24. [24]
    Kaspersky ProjectSauron Full Report

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 17, 2016.

    Open source URL
  25. [25]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  26. [26]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  27. [27]
    Symantec Remsec IOCs

    Symantec Security Response. (2016, August 8). Backdoor.Remsec indicators of compromise. Retrieved August 17, 2016.

  28. [28]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  29. [29]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  30. [30]
    Kaspersky ProjectSauron Full Report

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 17, 2016.

    Open source URL
  31. [31]
    Kaspersky ProjectSauron Full Report

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 17, 2016.

    Open source URL
  32. [32]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  33. [33]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  34. [34]
    Kaspersky ProjectSauron Full Report

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 17, 2016.

    Open source URL
  35. [35]
    Kaspersky ProjectSauron Full Report

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 17, 2016.

    Open source URL
  36. [36]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  37. [37]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  38. [38]
    Symantec Remsec IOCs

    Symantec Security Response. (2016, August 8). Backdoor.Remsec indicators of compromise. Retrieved August 17, 2016.

  39. [39]
    Symantec Remsec IOCs

    Symantec Security Response. (2016, August 8). Backdoor.Remsec indicators of compromise. Retrieved August 17, 2016.

  40. [40]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  41. [41]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  42. [42]
    Symantec Remsec IOCs

    Symantec Security Response. (2016, August 8). Backdoor.Remsec indicators of compromise. Retrieved August 17, 2016.

  43. [43]
    Symantec Remsec IOCs

    Symantec Security Response. (2016, August 8). Backdoor.Remsec indicators of compromise. Retrieved August 17, 2016.

  44. [44]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  45. [45]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  46. [46]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  47. [47]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  48. [48]
    Symantec Remsec IOCs

    Symantec Security Response. (2016, August 8). Backdoor.Remsec indicators of compromise. Retrieved August 17, 2016.

  49. [49]
    Symantec Remsec IOCs

    Symantec Security Response. (2016, August 8). Backdoor.Remsec indicators of compromise. Retrieved August 17, 2016.

  50. [50]
    Kaspersky ProjectSauron Full Report

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 17, 2016.

    Open source URL
  51. [51]
    Kaspersky ProjectSauron Full Report

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 17, 2016.

    Open source URL
  52. [52]
    ComputerWeekly Strider

    Warwick Ashford. (2016, August 8). Strider cyber attack group deploying malware for espionage. Retrieved January 10, 2024.

    Open source URL
  53. [53]
    Kaspersky ProjectSauron Full Report

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 17, 2016.

    Open source URL
  54. [54]
    Kaspersky ProjectSauron Full Report

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 17, 2016.

    Open source URL
  55. [55]
    Kaspersky ProjectSauron Full Report

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 17, 2016.

    Open source URL
  56. [56]
    Kaspersky ProjectSauron Full Report

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 17, 2016.

    Open source URL
  57. [57]
    Symantec Remsec IOCs

    Symantec Security Response. (2016, August 8). Backdoor.Remsec indicators of compromise. Retrieved August 17, 2016.

  58. [58]
    Symantec Remsec IOCs

    Symantec Security Response. (2016, August 8). Backdoor.Remsec indicators of compromise. Retrieved August 17, 2016.

  59. [59]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  60. [60]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  61. [61]
    Kaspersky ProjectSauron Full Report

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 17, 2016.

    Open source URL
  62. [62]
    Kaspersky ProjectSauron Full Report

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 17, 2016.

    Open source URL
  63. [63]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  64. [64]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  65. [65]
    Symantec Remsec IOCs

    Symantec Security Response. (2016, August 8). Backdoor.Remsec indicators of compromise. Retrieved August 17, 2016.

  66. [66]
    Symantec Remsec IOCs

    Symantec Security Response. (2016, August 8). Backdoor.Remsec indicators of compromise. Retrieved August 17, 2016.

  67. [67]
    Threatpost Sauron

    Michael Mimoso. (2016, August 8). ProjectSauron APT On Par With Equation, Flame, Duqu. Retrieved January 10, 2024.

    Open source URL
  68. [68]
    Kaspersky Lua

    Global Research and Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 5, 2024.

    Open source URL
  69. [69]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  70. [70]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  71. [71]
    Symantec Remsec IOCs

    Symantec Security Response. (2016, August 8). Backdoor.Remsec indicators of compromise. Retrieved August 17, 2016.

  72. [72]
    Symantec Remsec IOCs

    Symantec Security Response. (2016, August 8). Backdoor.Remsec indicators of compromise. Retrieved August 17, 2016.

  73. [73]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  74. [74]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  75. [75]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  76. [76]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  77. [77]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  78. [78]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  79. [79]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  80. [80]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  81. [81]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  82. [82]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  83. [83]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  84. [84]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  85. [85]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  86. [86]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  87. [87]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  88. [88]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  89. [89]
    Kaspersky ProjectSauron Full Report

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 17, 2016.

    Open source URL
  90. [90]
    Kaspersky ProjectSauron Full Report

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 17, 2016.

    Open source URL
  91. [91]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  92. [92]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  93. [93]
    Symantec Remsec IOCs

    Symantec Security Response. (2016, August 8). Backdoor.Remsec indicators of compromise. Retrieved August 17, 2016.

  94. [94]
    Symantec Remsec IOCs

    Symantec Security Response. (2016, August 8). Backdoor.Remsec indicators of compromise. Retrieved August 17, 2016.

  95. [95]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  96. [96]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  97. [97]
    Kaspersky ProjectSauron Full Report

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 17, 2016.

    Open source URL
  98. [98]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  99. [99]
    Symantec Remsec IOCs

    Symantec Security Response. (2016, August 8). Backdoor.Remsec indicators of compromise. Retrieved August 17, 2016.

  100. [100]
    Kaspersky ProjectSauron Blog

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 8). ProjectSauron: top level cyber-espionage platform covertly extracts encrypted government comms. Retrieved August 17, 2016.

    Open source URL
  101. [101]
    Symantec Strider Blog

    Symantec Security Response. (2016, August 7). Strider: Cyberespionage group turns eye of Sauron on targets. Retrieved August 17, 2016.

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use