LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0267: FELIXROOT

FELIXROOT is a backdoor that has been used to target Ukrainian victims. [1]

EnterpriseS0267MalwareObject v2.2Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

S0267: FELIXROOT describes [FELIXROOT](https://attack.mitre.org/software/S0267) is a backdoor that has been used to target Ukrainian victims. (Citation: FireEye FELIXROOT July 2018)

Executive priority

S0267: FELIXROOT is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S0267: FELIXROOT by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

  • Official ATT&CK relationships and object metadata
  • Network, endpoint, and security-tool telemetry

Detection direction

  • Validate whether S0267: FELIXROOT appears in your detection coverage and tabletop scenarios.
  • Use the object to align executive risk language with SOC, incident response, and detection engineering work.
  • Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

  • Map the object to existing controls and identify missing telemetry or response ownership.
  • Prioritize mitigations that reduce exposure on the listed platforms and tactics.
  • Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

FELIXROOT

FELIXROOT is a backdoor that has been used to target Ukrainian victims. [1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

19 rows
DomainIDNameRelationship / procedure
EnterpriseT1057Process Discovery

FELIXROOT collects a list of running processes.[2]

EnterpriseT1112Modify Registry

FELIXROOT deletes the Registry key HKCU\Software\Classes\Applications\rundll32.exe\shell\open.[1]

EnterpriseT1680Local Storage Discovery

FELIXROOT collects the victim’s volume serial number.[1][2]

EnterpriseT1518.001Security Software DiscoverySub-technique

FELIXROOT checks for installed security software like antivirus and firewall.[2]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

FELIXROOT encrypts strings in the backdoor using a custom XOR algorithm.[1][2]

EnterpriseT1082System Information Discovery

FELIXROOT collects the victim’s computer name, processor architecture, OS version, and system type.[1][2]

EnterpriseT1012Query Registry

FELIXROOT queries the Registry for specific keys for potential privilege escalation and proxy information. FELIXROOT has also used WMI to query the Windows Registry.[1][2]

EnterpriseT1071.001Web ProtocolsSub-technique

FELIXROOT uses HTTP and HTTPS to communicate with the C2 server.[1][2]

EnterpriseT1016System Network Configuration Discovery

FELIXROOT collects information about the network including the IP address and DHCP server.[2]

EnterpriseT1047Windows Management Instrumentation

FELIXROOT uses WMI to query the Windows Registry.[2]

EnterpriseT1124System Time Discovery

FELIXROOT gathers the time zone information from the victim’s machine.[2]

EnterpriseT1560Archive Collected Data

FELIXROOT encrypts collected data with AES and Base64 and then sends it to the C2 server.[1]

EnterpriseT1218.011Rundll32Sub-technique

FELIXROOT uses Rundll32 for executing the dropper program.[1][2]

EnterpriseT1033System Owner/User Discovery

FELIXROOT collects the username from the victim’s machine.[1][2]

EnterpriseT1547.009Shortcut ModificationSub-technique

FELIXROOT creates a .LNK file for persistence.[2]

EnterpriseT1105Ingress Tool Transfer

FELIXROOT downloads and uploads files to and from the victim’s machine.[1][2]

EnterpriseT1059.003Windows Command ShellSub-technique

FELIXROOT executes batch scripts on the victim’s machine, and can launch a reverse shell for command execution.[1][2]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

FELIXROOT adds a shortcut file to the startup folder for persistence.[2]

EnterpriseT1070.004File DeletionSub-technique

FELIXROOT deletes the .LNK file from the startup directory as well as the dropper components.[1]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1112: Modify RegistryEnterpriseuses · TechniqueT1680: Local Storage DiscoveryEnterpriseuses · TechniqueT1518.001: Security Software DiscoveryEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1012: Query RegistryEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1047: Windows Management InstrumentationEnterpriseuses · TechniqueT1124: System Time DiscoveryEnterpriseuses · TechniqueT1560: Archive Collected DataEnterpriseuses · TechniqueT1218.011: Rundll32Enterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1547.009: Shortcut ModificationEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1070.004: File DeletionEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.2
Object version
2.2
Created
Modified
Raw hash
0b6eadca550816ee...
Imported snapshots across ATT&CK releases(2)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.22.2Current bundle0b6eadca5508…
19.12.2Older bundle0b6eadca5508…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    FireEye FELIXROOT July 2018

    Patil, S. (2018, June 26). Microsoft Office Vulnerabilities Used to Distribute FELIXROOT Backdoor in Recent Campaign. Retrieved November 17, 2024.

    Open source URL
  2. [2]
    ESET GreyEnergy Oct 2018

    Cherepanov, A. (2018, October). GREYENERGY A successor to BlackEnergy. Retrieved November 15, 2018.

    Open source URL
  3. [3]
    FELIXROOT

    (Citation: FireEye FELIXROOT July 2018)(Citation: ESET GreyEnergy Oct 2018)

  4. [4]
    GreyEnergy mini

    (Citation: ESET GreyEnergy Oct 2018)

  5. [5]
    mitre-attackS0267
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use