S0137: CORESHELL

CORESHELL is a Windows downloader associated in ATT&CK with APT28, with older reporting also referring to SOURFACE. Its business significance is not just the malware name: a downloader is often a pivot point between initial compromise and additional tooling. If it is missed, defenders may lose the opportunity to contain an intrusion before persistence, discovery, command-and-control, or further payload transfer occur.

Executive priority

Treat this as a validation item for Windows endpoint, network, and incident response readiness rather than as a standalone signature problem. Leaders should ask whether SOC teams can connect suspicious Windows execution, registry-based persistence, system and storage discovery, and web/mail-based command-and-control into one investigation. Because ATT&CK provides no official detection text for CORESHELL, coverage should be proven through telemetry and response exercises, not assumed from malware naming alone.

Technical view

ATT&CK lists CORESHELL as Windows malware and relates it to obfuscation, junk code insertion, web and mail protocols for command-and-control, system and local storage discovery, ingress tool transfer, standard encoding, rundll32 abuse, registry run keys/startup folder persistence, and symmetric cryptography. SOC and IR teams should validate detections around suspicious rundll32.exe execution, new or modified Run key/startup persistence, downloader-like file creation after external communications, encoded or encrypted C2-like traffic over common protocols, and host discovery activity occurring near suspicious process execution. Because the object has no official detection guidance, detections should be behavior-led and correlated across endpoint, network, and persistence evidence.

Likely telemetry

Windows process creation and command-line telemetry, especially rundll32.exe activity
Windows registry monitoring for Run keys and startup persistence locations
File creation/modification events for newly downloaded tools or payloads
Endpoint security alerts and malware analysis artifacts related to obfuscated or packed files
Network proxy, firewall, DNS, and HTTP/S metadata for outbound web-protocol communications

Detection direction

Correlate suspicious downloader behavior with follow-on ingress tool transfer rather than relying only on static malware names or hashes.
Tune rundll32.exe analytics to distinguish normal administrative or application activity from unusual DLL paths, export names, parent processes, user contexts, or network-adjacent execution.
Monitor Run key and startup folder changes with allowlisting for known software updaters to reduce false positives.
Review outbound web and mail protocol visibility, because C2 over common protocols can blend into ordinary enterprise traffic.
Account for obfuscation, junk code, standard encoding, and symmetric cryptography as reasons static detections or payload inspection may be incomplete.

Mitigation priorities

Prioritize Windows endpoint visibility for process, registry, file, and network activity before assuming CORESHELL-specific coverage.
Restrict and monitor abuse-prone execution paths such as rundll32.exe where business operations allow, using policy and alerting rather than blanket assumptions.
Harden persistence locations by monitoring and controlling registry Run keys and startup folders.
Limit unnecessary outbound web and mail protocol paths and ensure egress logging is retained for investigations.
Strengthen incident response playbooks for downloader findings: isolate affected hosts, preserve volatile and persistence evidence, and hunt for additional transferred tools.

Additional notes and limits

The most useful defensive framing is behavioral: CORESHELL is described as a downloader, and the relationships point to persistence, discovery, C2, obfuscation, and tool transfer behaviors. The APT28 relationship increases intelligence relevance, but local evidence is still required for incident scoping or attribution.

The official ATT&CK object does not specify tactics for the malware itself and provides no official detection text. Technique relationships provide direction but not environment-specific indicators, signatures, infrastructure, prevalence, or confirmed exposure. Platform claims should be limited to Windows for this malware object, with related technique platforms treated as generic ATT&CK context.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

CORESHELL

CORESHELL is a downloader used by APT28. The older versions of this malware are known as SOURFACE and newer versions as CORESHELL.[1] [2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques11 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1071.001	Web ProtocolsSub-technique	CORESHELL can communicate over HTTP for C2.[1][3]
Enterprise	T1071.003	Mail ProtocolsSub-technique	CORESHELL can communicate over SMTP and POP3 for C2.[1][3]
Enterprise	T1132.001	Standard EncodingSub-technique	CORESHELL C2 messages are Base64-encoded.[1]
Enterprise	T1680	Local Storage Discovery	CORESHELL collects the volume serial number from the victim and sends the information to its C2 server.[1]
Enterprise	T1082	System Information Discovery	CORESHELL collects hostname and OS version data from the victim and sends the information to its C2 server.[1]
Enterprise	T1027.016	Junk Code InsertionSub-technique	CORESHELL contains unused machine instructions in a likely attempt to hinder analysis.[1]
Enterprise	T1218.011	Rundll32Sub-technique	CORESHELL is installed via execution of rundll32 with an export named "init" or "InitW."[3]
Enterprise	T1547.001	Registry Run Keys / Startup FolderSub-technique	CORESHELL has established persistence by creating autostart extensibility point (ASEP) Registry entries in the Run key and other Registry keys, as well as by creating shortcuts in the Internet Explorer Quick Start folder.[3]
Enterprise	T1105	Ingress Tool Transfer	CORESHELL downloads another dropper from its C2 server.[1]
Enterprise	T1027	Obfuscated Files or Information	CORESHELL obfuscates strings using a custom stream cipher.[1]
Enterprise	T1573.001	Symmetric CryptographySub-technique	CORESHELL C2 messages are encrypted with custom stream ciphers using six-byte or eight-byte keys.[1]

Associated objects

Groups, software, and campaigns

G0007: APT28

APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.[1][2] This group has been active since at least 2004.[3][4][5][6][7][8][9][10][11][12][13]

APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.[5] In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.[14] Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.1
Object version: 2.2
Created: May 31, 2017, 21:33 UTC (UTC+00:00)
Modified: Oct 22, 2025, 02:47 UTC (UTC+00:00)
Raw hash: 7cfda86561175e3c...

Imported snapshots across ATT&CK releases(1)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	2.2	Oct 22, 2025, 02:47 UTC (UTC+00:00)	Current bundle	`7cfda8656117…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
FireEye APT28
FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.
Open source URL
[2]
FireEye APT28 January 2017
FireEye iSIGHT Intelligence. (2017, January 11). APT28: At the Center of the Storm. Retrieved November 17, 2024.
Open source URL
[3]
Microsoft SIR Vol 19
Anthe, C. et al. (2015, October 19). Microsoft Security Intelligence Report Volume 19. Retrieved December 23, 2015.
[4]
Secureworks IRON TWILIGHT Active Measures March 2017
Secureworks CTU. (2017, March 30). IRON TWILIGHT Supports Active Measures. Retrieved February 28, 2022.
Open source URL
[5]
CORESHELL
(Citation: FireEye APT28) (Citation: FireEye APT28 January 2017)
[6]
CORESHELL
(Citation: FireEye APT28) (Citation: FireEye APT28 January 2017)
[7]
CORESHELL
(Citation: FireEye APT28) (Citation: FireEye APT28 January 2017)
[8]
FireEye APT28
FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.
Open source URL
[9]
FireEye APT28
FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.
Open source URL
[10]
FireEye APT28 January 2017
FireEye iSIGHT Intelligence. (2017, January 11). APT28: At the Center of the Storm. Retrieved November 17, 2024.
Open source URL
[11]
FireEye APT28 January 2017
FireEye iSIGHT Intelligence. (2017, January 11). APT28: At the Center of the Storm. Retrieved November 17, 2024.
Open source URL
[12]
SOURFACE
(Citation: FireEye APT28) (Citation: FireEye APT28 January 2017)(Citation: Securelist Sofacy Feb 2018)
[13]
SOURFACE
(Citation: FireEye APT28) (Citation: FireEye APT28 January 2017)(Citation: Securelist Sofacy Feb 2018)
[14]
SOURFACE
(Citation: FireEye APT28) (Citation: FireEye APT28 January 2017)(Citation: Securelist Sofacy Feb 2018)
[15]
Securelist Sofacy Feb 2018
Kaspersky Lab's Global Research & Analysis Team. (2018, February 20). A Slice of 2017 Sofacy Activity. Retrieved November 27, 2018.
Open source URL
[16]
Securelist Sofacy Feb 2018
Kaspersky Lab's Global Research & Analysis Team. (2018, February 20). A Slice of 2017 Sofacy Activity. Retrieved November 27, 2018.
Open source URL
[17]
Securelist Sofacy Feb 2018
Kaspersky Lab's Global Research & Analysis Team. (2018, February 20). A Slice of 2017 Sofacy Activity. Retrieved November 27, 2018.
Open source URL
[18]
Sofacy
This designation has been used in reporting both to refer to the threat group ([APT28](https://attack.mitre.org/groups/G0007)) and its associated malware.(Citation: FireEye APT28) (Citation: FireEye APT28 January 2017)(Citation: Securelist Sofacy Feb 2018)
[19]
Sofacy
This designation has been used in reporting both to refer to the threat group ([APT28](https://attack.mitre.org/groups/G0007)) and its associated malware.(Citation: FireEye APT28) (Citation: FireEye APT28 January 2017)(Citation: Securelist Sofacy Feb 2018)
[20]
Sofacy
This designation has been used in reporting both to refer to the threat group ([APT28](https://attack.mitre.org/groups/G0007)) and its associated malware.(Citation: FireEye APT28) (Citation: FireEye APT28 January 2017)(Citation: Securelist Sofacy Feb 2018)
[21]
mitre-attackS0137
Open source URL
[22]
mitre-attackS0137
Open source URL
[23]
mitre-attackS0137
Open source URL
[24]
FireEye APT28
FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.
Open source URL
[25]
FireEye APT28
FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.
Open source URL
[26]
Microsoft SIR Vol 19
Anthe, C. et al. (2015, October 19). Microsoft Security Intelligence Report Volume 19. Retrieved December 23, 2015.
[27]
FireEye APT28
FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.
Open source URL
[28]
FireEye APT28
FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.
Open source URL
[29]
Microsoft SIR Vol 19
Anthe, C. et al. (2015, October 19). Microsoft Security Intelligence Report Volume 19. Retrieved December 23, 2015.
[30]
Microsoft SIR Vol 19
Anthe, C. et al. (2015, October 19). Microsoft Security Intelligence Report Volume 19. Retrieved December 23, 2015.
[31]
FireEye APT28
FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.
Open source URL
[32]
FireEye APT28
FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.
Open source URL
[33]
FireEye APT28
FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.
Open source URL
[34]
FireEye APT28
FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.
Open source URL
[35]
FireEye APT28
FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.
Open source URL
[36]
FireEye APT28
FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.
Open source URL
[37]
FireEye APT28
FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.
Open source URL
[38]
FireEye APT28
FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.
Open source URL
[39]
FireEye APT28
FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.
Open source URL
[40]
FireEye APT28
FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.
Open source URL
[41]
Secureworks IRON TWILIGHT Active Measures March 2017
Secureworks CTU. (2017, March 30). IRON TWILIGHT Supports Active Measures. Retrieved February 28, 2022.
Open source URL
[42]
Microsoft SIR Vol 19
Anthe, C. et al. (2015, October 19). Microsoft Security Intelligence Report Volume 19. Retrieved December 23, 2015.
[43]
Microsoft SIR Vol 19
Anthe, C. et al. (2015, October 19). Microsoft Security Intelligence Report Volume 19. Retrieved December 23, 2015.
[44]
Microsoft SIR Vol 19
Anthe, C. et al. (2015, October 19). Microsoft Security Intelligence Report Volume 19. Retrieved December 23, 2015.
[45]
FireEye APT28
FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.
Open source URL
[46]
FireEye APT28
FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.
Open source URL
[47]
FireEye APT28
FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use