LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0256: Mosquito

Mosquito is a Win32 backdoor that has been used by Turla. Mosquito is made up of three parts: the installer, the launcher, and the backdoor. The main backdoor is called CommanderDLL and is launched by the loader program. [1]

EnterpriseS0256MalwareObject v1.3Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Mosquito matters because ATT&CK describes it as a Windows backdoor used by Turla, with behavior spanning execution, discovery, persistence, defense evasion, and command-and-control. For leaders, the value is not a malware name alone; it is a checklist for whether Windows endpoint, registry, scripting, WMI, DLL execution, and encrypted outbound traffic controls can support a fast investigation if a stealthy backdoor is suspected.

Executive priority

Prioritize this as a Windows endpoint and incident-readiness validation issue. The mapped behaviors touch persistence through Registry/COM/run keys, execution through WMI, PowerShell, command shell, rundll32, and native APIs, plus discovery of users, processes, network configuration, and security tools. Executives should ask whether the SOC can prove visibility across those areas, whether IR can preserve evidence when files are deleted or stored in non-file locations, and whether control investments reduce abuse of legitimate Windows administration features without disrupting operations.

Technical view

ATT&CK does not provide an official detection section for Mosquito, so defenders should validate coverage through the related techniques rather than a single signature. On Windows, focus on suspicious parent-child process chains involving PowerShell, cmd.exe, WMI, and rundll32; DLL loading patterns consistent with backdoor launch behavior; Registry modifications involving persistence or COM references; Run key/startup folder changes; evidence of file transfer and subsequent deletion; and discovery activity against users, processes, network configuration, and security tooling. Because the object is described as a Win32 backdoor made of installer, launcher, and CommanderDLL components, triage should correlate installation, launch, persistence, and outbound communications rather than treating each event in isolation.

Likely telemetry

  • Windows process creation and command-line telemetry for PowerShell, cmd.exe, WMI activity, rundll32.exe, and child processes
  • Registry auditing for Run keys, startup-related entries, COM object references, and other suspicious modifications
  • DLL/module load telemetry and endpoint events related to launcher/backdoor execution
  • File creation, transfer, rename, and deletion events, including short-lived artifacts
  • Network connection and proxy/DNS/firewall logs for unusual outbound command-and-control patterns, including encrypted traffic not explained by business use

Detection direction

  • Build detections around behavior clusters mapped to the relationships, not just malware indicators: discovery followed by script or WMI execution, Registry persistence, rundll32 DLL execution, tool transfer, deletion, and outbound encrypted communications.
  • Tune carefully for administrative noise. WMI, PowerShell, cmd.exe, Registry changes, and rundll32 are legitimate Windows mechanisms, so detections should use baselines, uncommon parent processes, unusual paths, rare command lines, abnormal user context, and sequence-based correlation.
  • Check blind spots in fileless and obfuscated storage paths. ATT&CK relationships include Fileless Storage and Encrypted/Encoded File, so confirm whether endpoint tooling inspects Registry/WMI/event-log-like storage and captures enough content or metadata to investigate encoded artifacts.
  • Validate telemetry retention for cleanup behavior. File deletion can remove local evidence quickly, so central log collection and EDR historical search are important for IR reconstruction.
  • Use the Turla relationship as threat-intelligence context for prioritization and hunting, but do not treat attribution as proven from local telemetry without corroborating evidence.

Mitigation priorities

  • Start with Windows hardening that reduces abuse of built-in execution paths: constrain unnecessary PowerShell, WMI, cmd, rundll32, and script execution where business processes allow.
  • Apply least privilege and change control to Registry areas used for persistence, including Run keys, startup locations, and COM-related references.
  • Use application control or allowlisting strategies to limit unauthorized DLL and tool execution while accounting for legitimate administrative software.
  • Strengthen outbound egress monitoring and control so unusual encrypted command-and-control-like communications can be investigated and contained.
  • Ensure endpoint logging, centralized retention, and IR collection procedures cover deleted files, Registry changes, WMI activity, and DLL/module execution.
Additional notes and limits

The most defensible Glexia use of this object is as a Windows backdoor behavior coverage review. The ATT&CK relationship set provides practical hunt and control themes: execution through Windows management and shell components, persistence through Registry/COM/startup mechanisms, discovery of host and security context, stealth through fileless or encoded storage and deletion, and command-and-control through tool transfer and symmetric cryptography. This supports managed detection, IR readiness, and control validation discussions without requiring unsupported claims about current campaigns.

ATT&CK provides no official detection text for Mosquito, and the malware object itself has no specified tactics. Some related techniques list broader platforms, but the Mosquito object is supplied as Windows, so platform-specific conclusions should remain Windows-focused. Local baselines, endpoint telemetry quality, network architecture, and business use of administration tools are required before determining actual exposure or detection coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Mosquito

Mosquito is a Win32 backdoor that has been used by Turla. Mosquito is made up of three parts: the installer, the launcher, and the backdoor. The main backdoor is called CommanderDLL and is launched by the loader program. [1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

17 rows
DomainIDNameRelationship / procedure
EnterpriseT1047Windows Management Instrumentation

Mosquito's installer uses WMI to search for antivirus display names.[1]

EnterpriseT1033System Owner/User Discovery

Mosquito runs whoami on the victim’s machine.[1]

EnterpriseT1218.011Rundll32Sub-technique

Mosquito's launcher uses rundll32.exe in a Registry Key value to start the main backdoor capability.[1]

EnterpriseT1070.004File DeletionSub-technique

Mosquito deletes files using DeleteFileW API call.[1]

EnterpriseT1573.001Symmetric CryptographySub-technique

Mosquito uses a custom encryption algorithm, which consists of XOR and a stream that is similar to the Blum Blum Shub algorithm.[1]

EnterpriseT1518.001Security Software DiscoverySub-technique

Mosquito's installer searches the Registry and system to see if specific antivirus tools are installed on the system.[1]

EnterpriseT1059.001PowerShellSub-technique

Mosquito can launch PowerShell Scripts.[1]

EnterpriseT1112Modify Registry

Mosquito can modify Registry keys under HKCU\Software\Microsoft\[dllname] to store configuration values. Mosquito also modifies Registry keys under HKCR\CLSID\...\InprocServer32 with a path to the launcher.[1]

EnterpriseT1105Ingress Tool Transfer

Mosquito can upload and download files to the victim.[1]

EnterpriseT1546.015Component Object Model HijackingSub-technique

Mosquito uses COM hijacking as a method of persistence.[1]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

Mosquito’s installer is obfuscated with a custom crypter to obfuscate the installer.[1]

EnterpriseT1057Process Discovery

Mosquito runs tasklist to obtain running processes.[1]

EnterpriseT1016System Network Configuration Discovery

Mosquito uses the ipconfig command.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

Mosquito executes cmd.exe and uses a pipe to read the results and send back the output to the C2 server.[1]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

Mosquito establishes persistence under the Registry key HKCU\Software\Run auto_update.[1]

EnterpriseT1106Native API

Mosquito leverages the CreateProcess() and LoadLibrary() calls to execute files with the .dll and .exe extensions.[1]

EnterpriseT1027.011Fileless StorageSub-technique

Mosquito stores configuration values under the Registry key HKCU\Software\Microsoft\[dllname].[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0010: Turla

Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.[1][2][3][4][5]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1047: Windows Management InstrumentationEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1218.011: Rundll32Enterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1573.001: Symmetric CryptographyEnterpriseuses · GroupG0010: TurlaEnterpriseuses · TechniqueT1518.001: Security Software DiscoveryEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1112: Modify RegistryEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1546.015: Component Object Model HijackingEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1027.011: Fileless StorageEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.3
Created
Modified
Raw hash
03bfe8ab6bb082f2...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.3Current bundle03bfe8ab6bb0…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  2. [2]
    ESET Turla Mosquito May 2018

    ESET Research. (2018, May 22). Turla Mosquito: A shift towards more generic tools. Retrieved July 3, 2018.

    Open source URL
  3. [3]
    Secureworks IRON HUNTER Profile

    Secureworks CTU. (n.d.). IRON HUNTER. Retrieved February 22, 2022.

  4. [4]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  5. [5]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  6. [6]
    Mosquito

    (Citation: ESET Turla Mosquito Jan 2018)

  7. [7]
    Mosquito

    (Citation: ESET Turla Mosquito Jan 2018)

  8. [8]
    Mosquito

    (Citation: ESET Turla Mosquito Jan 2018)

  9. [9]
    mitre-attackS0256
    Open source URL
  10. [10]
    mitre-attackS0256
    Open source URL
  11. [11]
    mitre-attackS0256
    Open source URL
  12. [12]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  13. [13]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  14. [14]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  15. [15]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  16. [16]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  17. [17]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  18. [18]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  19. [19]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  20. [20]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  21. [21]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  22. [22]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  23. [23]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  24. [24]
    ESET Turla Mosquito May 2018

    ESET Research. (2018, May 22). Turla Mosquito: A shift towards more generic tools. Retrieved July 3, 2018.

    Open source URL
  25. [25]
    Secureworks IRON HUNTER Profile

    Secureworks CTU. (n.d.). IRON HUNTER. Retrieved February 22, 2022.

  26. [26]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  27. [27]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  28. [28]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  29. [29]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  30. [30]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  31. [31]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  32. [32]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  33. [33]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  34. [34]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  35. [35]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  36. [36]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  37. [37]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  38. [38]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  39. [39]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  40. [40]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  41. [41]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  42. [42]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  43. [43]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  44. [44]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  45. [45]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  46. [46]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use