S0260: InvisiMole

S0260: InvisiMole describes [InvisiMole](https://attack.mitre.org/software/S0260) is a modular spyware program that has been used by the InvisiMole Group since at least 2013. [InvisiMole](https://attack.mitre.org/software/S0260) has two backdoor modules called RC2FM and RC2CL that are used to perform post-exploitation activities. It has been discovered on compromised victims in the Ukraine and Russia. [Gamaredon Group](https://attack.mitre.org/groups/G0047) infrastructure has been used to download and execute [InvisiMole](https://attack.mitre...

Executive priority

S0260: InvisiMole is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S0260: InvisiMole by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata
Network, endpoint, and security-tool telemetry

Detection direction

Validate whether S0260: InvisiMole appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

InvisiMole

InvisiMole is a modular spyware program that has been used by the InvisiMole Group since at least 2013. InvisiMole has two backdoor modules called RC2FM and RC2CL that are used to perform post-exploitation activities. It has been discovered on compromised victims in the Ukraine and Russia. Gamaredon Group infrastructure has been used to download and execute InvisiMole against a small number of victims.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques73 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1573.001	Symmetric CryptographySub-technique	InvisiMole uses variations of a simple XOR encryption routine for C&C communications.[1]
Enterprise	T1686	Disable or Modify System Firewall	InvisiMole has a command to disable routing and the Firewall on the victim’s machine.[1]
Enterprise	T1025	Data from Removable Media	InvisiMole can collect jpeg files from connected MTP devices.[2]
Enterprise	T1218.011	Rundll32Sub-technique	InvisiMole has used rundll32.exe for execution.[2]
Enterprise	T1490	Inhibit System Recovery	InvisiMole can can remove all system restore points.[1]
Enterprise	T1055.002	Portable Executable InjectionSub-technique	InvisiMole can inject its backdoor as a portable executable into a target process.[2]
Enterprise	T1497.001	System ChecksSub-technique	InvisiMole can check for artifacts of VirtualBox, Virtual PC and VMware environment, and terminate itself if they are detected.[2]
Enterprise	T1569.002	Service ExecutionSub-technique	InvisiMole has used Windows services as a way to execute its malicious payload.[2]
Enterprise	T1070.004	File DeletionSub-technique	InvisiMole has deleted files and directories including XML and files successfully uploaded to C2 servers.[1][2]
Enterprise	T1008	Fallback Channels	InvisiMole has been configured with several servers available for alternate C2 communications.[1][2]
Enterprise	T1559.001	Component Object ModelSub-technique	InvisiMole can use the `ITaskService`, `ITaskDefinition` and `ITaskSettings` COM interfaces to schedule a task.[2]
Enterprise	T1547.001	Registry Run Keys / Startup FolderSub-technique	InvisiMole can place a lnk file in the Startup Folder to achieve persistence.[2]
Enterprise	T1055.004	Asynchronous Procedure CallSub-technique	InvisiMole can inject its code into a trusted process via the APC queue.[2]
Enterprise	T1095	Non-Application Layer Protocol	InvisiMole has used TCP to download additional modules.[2]
Enterprise	T1560.002	Archive via LibrarySub-technique	InvisiMole can use zlib to compress and decompress data.[1][2]
Enterprise	T1560.001	Archive via UtilitySub-technique	InvisiMole uses WinRAR to compress data that is intended to be exfiltrated.[1]
Enterprise	T1113	Screen Capture	InvisiMole can capture screenshots of not only the entire screen, but of each separate window open, in case they are overlapping.[1][2]
Enterprise	T1010	Application Window Discovery	InvisiMole can enumerate windows and child windows on a compromised host.[1][2]
Enterprise	T1056.001	KeyloggingSub-technique	InvisiMole can capture keystrokes on a compromised host.[2]
Enterprise	T1033	System Owner/User Discovery	InvisiMole lists local users and session information.[1]
Enterprise	T1074.001	Local Data StagingSub-technique	InvisiMole determines a working directory where it stores all the gathered data about the compromised machine.[1][2]
Enterprise	T1005	Data from Local System	InvisiMole can collect data from the system, and can monitor changes in specified directories.[1]
Enterprise	T1564.001	Hidden Files and DirectoriesSub-technique	InvisiMole can create hidden system directories.[2]
Enterprise	T1068	Exploitation for Privilege Escalation	InvisiMole has exploited CVE-2007-5633 vulnerability in the speedfan.sys driver to obtain kernel mode privileges.[2]
Enterprise	T1132.002	Non-Standard EncodingSub-technique	InvisiMole can use a modified base32 encoding to encode data within the subdomain of C2 requests.[2]
Enterprise	T1112	Modify Registry	InvisiMole has a command to create, set, copy, or delete a specified Registry key or value.[1][2]
Enterprise	T1218.002	Control PanelSub-technique	InvisiMole can register itself for execution and persistence via the Control Panel.[2]
Enterprise	T1059.007	JavaScriptSub-technique	InvisiMole can use a JavaScript file as part of its execution chain.[2]
Enterprise	T1007	System Service Discovery	InvisiMole can obtain running services on the victim.[1]
Enterprise	T1016	System Network Configuration Discovery	InvisiMole gathers information on the IP forwarding table, MAC address, configured proxy, and network SSID.[1][2]
Enterprise	T1480.001	Environmental KeyingSub-technique	InvisiMole can use Data Protection API to encrypt its components on the victim’s computer, to evade detection, and to make sure the payload can only be decrypted and loaded on one specific compromised computer.[2]
Enterprise	T1055.015	ListPlantingSub-technique	InvisiMole has used ListPlanting to inject code into a trusted process.[2]
Enterprise	T1090.001	Internal ProxySub-technique	InvisiMole can function as a proxy to create a server that relays communication between the client and C&C server, or between two clients.[1]
Enterprise	T1055	Process Injection	InvisiMole can inject itself into another process to avoid detection including use of a technique called ListPlanting that customizes the sorting algorithm in a ListView structure.[2]
Enterprise	T1082	System Information Discovery	InvisiMole can gather information on the OS version, computer name, DEP policy, and memory size.[1][2]
Enterprise	T1059.003	Windows Command ShellSub-technique	InvisiMole can launch a remote shell to execute commands.[1][2]
Enterprise	T1680	Local Storage Discovery	InvisiMole can gather information on the mapped drives and system volume serial number.[1][2]
Enterprise	T1543.003	Windows ServiceSub-technique	InvisiMole can register a Windows service named CsPower as part of its execution chain, and a Windows service named clr_optimization_v2.0.51527_X86 to achieve persistence.[2]
Enterprise	T1071.004	DNSSub-technique	InvisiMole has used a custom implementation of DNS tunneling to embed C2 communications in DNS requests and replies.[2]
Enterprise	T1027	Obfuscated Files or Information	InvisiMole avoids analysis by encrypting all strings, internal files, configuration data and by using a custom executable format.[1][2]
Enterprise	T1123	Audio Capture	InvisiMole can record sound using input audio devices.[1][2]
Enterprise	T1087.001	Local AccountSub-technique	InvisiMole has a command to list account information on the victim’s machine.[1]
Enterprise	T1083	File and Directory Discovery	InvisiMole can list information about files in a directory and recently opened or used documents. InvisiMole can also search for specific files by supplied file mask.[1]
Enterprise	T1518	Software Discovery	InvisiMole can collect information about installed software used by specific users, software executed on user login, and software executed by each system.[1][2]
Enterprise	T1560.003	Archive via Custom MethodSub-technique	InvisiMole uses a variation of the XOR cipher to encrypt files before exfiltration.[1]
Enterprise	T1070.006	TimestompSub-technique	InvisiMole samples were timestomped by the authors by setting the PE timestamps to all zero values. InvisiMole also has a built-in command to modify file times.[1]
Enterprise	T1140	Deobfuscate/Decode Files or Information	InvisiMole can decrypt, unpack and load a DLL from its resources, or from blobs encrypted with Data Protection API, two-key triple DES, and variations of the XOR cipher.[1][2]
Enterprise	T1105	Ingress Tool Transfer	InvisiMole can upload files to the victim's machine for operations.[1][2]
Enterprise	T1001.003	Protocol or Service ImpersonationSub-technique	InvisiMole can mimic HTTP protocol with custom HTTP “verbs” HIDE, ZVVP, and NOP.[1][2]
Enterprise	T1070.005	Network Share Connection RemovalSub-technique	InvisiMole can disconnect previously connected remote drives.[1]
Enterprise	T1119	Automated Collection	InvisiMole can sort and collect specific documents as well as generate a list of all files on a newly inserted drive and store them in an encrypted file.[1][2]
Enterprise	T1548.002	Bypass User Account ControlSub-technique	InvisiMole can use fileless UAC bypass and create an elevated COM object to escalate privileges.[1][2]
Enterprise	T1564.003	Hidden WindowSub-technique	InvisiMole has executed legitimate tools in hidden windows.[2]
Enterprise	T1080	Taint Shared Content	InvisiMole can replace legitimate software or documents in the compromised network with their trojanized versions, in an attempt to propagate itself within the network.[2]
Enterprise	T1125	Video Capture	InvisiMole can remotely activate the victim’s webcam to capture content.[1][2]
Enterprise	T1518.001	Security Software DiscoverySub-technique	InvisiMole can check for the presence of network sniffers, AV, and BitDefender firewall.[2]
Enterprise	T1547.009	Shortcut ModificationSub-technique	InvisiMole can use a .lnk shortcut for the Control Panel to establish persistence.[2]
Enterprise	T1574.001	DLLSub-technique	InvisiMole can be launched by using DLL search order hijacking in which the wrapper DLL is placed in the same folder as explorer.exe and loaded during startup into the Windows Explorer process instead of the legitimate library.[1]
Enterprise	T1046	Network Service Discovery	InvisiMole can scan the network for open ports and vulnerable instances of RDP and SMB protocols.[2]
Enterprise	T1204.002	Malicious FileSub-technique	InvisiMole can deliver trojanized versions of software and documents, relying on user execution.[2]
Enterprise	T1124	System Time Discovery	InvisiMole gathers the local system time from the victim’s machine.[1][2]
Enterprise	T1053.005	Scheduled TaskSub-technique	InvisiMole has used scheduled tasks named `MSST` and `\Microsoft\Windows\Autochk\Scheduled` to establish persistence.[2]
Enterprise	T1071.001	Web ProtocolsSub-technique	InvisiMole uses HTTP for C2 communications.[1]
Enterprise	T1135	Network Share Discovery	InvisiMole can gather network share information.[1]
Enterprise	T1090.002	External ProxySub-technique	InvisiMole InvisiMole can identify proxy servers used by the victim and use them for C2 communication.[1][2]
Enterprise	T1057	Process Discovery	InvisiMole can obtain a list of running processes.[1][2]
Enterprise	T1036.004	Masquerade Task or ServiceSub-technique	InvisiMole has attempted to disguise itself by registering under a seemingly legitimate service name.[2]
Enterprise	T1027.005	Indicator Removal from ToolsSub-technique	InvisiMole has undergone regular technical improvements in an attempt to evade detection.[2]
Enterprise	T1203	Exploitation for Client Execution	InvisiMole has installed legitimate but vulnerable Total Video Player software and wdigest.dll library drivers on compromised hosts to exploit stack overflow and input validation vulnerabilities for code execution.[2]
Enterprise	T1036.005	Match Legitimate Resource Name or LocationSub-technique	InvisiMole has disguised its droppers as legitimate software or documents, matching their original names and locations, and saved its files as mpr.dll in the Windows folder.[1][2]
Enterprise	T1106	Native API	InvisiMole can use winapiexec tool for indirect execution of `ShellExecuteW` and `CreateProcessA`.[2]
Enterprise	T1012	Query Registry	InvisiMole can enumerate Registry values, keys, and data.[1]
Enterprise	T1210	Exploitation of Remote Services	InvisiMole can spread within a network via the BlueKeep (CVE-2019-0708) and EternalBlue (CVE-2017-0144) vulnerabilities in RDP and SMB respectively.[2]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.2
Object version: 2.1
Created: Oct 17, 2018, 00:14 UTC (UTC+00:00)
Modified: Apr 25, 2025, 14:43 UTC (UTC+00:00)
Raw hash: 3f68e1202752ceb9...

Imported snapshots across ATT&CK releases(2)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	2.1	Apr 25, 2025, 14:43 UTC (UTC+00:00)	Current bundle	`3f68e1202752…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	2.1	Apr 25, 2025, 14:43 UTC (UTC+00:00)	Older bundle	`3f68e1202752…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
ESET InvisiMole June 2018
Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.
Open source URL
[2]
ESET InvisiMole June 2020
Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.
Open source URL
[3]
InvisiMole
(Citation: ESET InvisiMole June 2018)
[4]
mitre-attackS0260
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use