S0284: More_eggs

More_eggs is a JScript backdoor used by Cobalt Group and FIN6. Its name was given based on the variable "More_eggs" being present in its code. There are at least two different versions of the backdoor being used, version 2.0 and version 4.4. [1][2]

EnterpriseS0284MalwareObject v3.1ModifiedApr 11, 2024, 00:40 UTC (UTC+00:00)

S0284: More_eggs describes [More_eggs](https://attack.mitre.org/software/S0284) is a JScript backdoor used by [Cobalt Group](https://attack.mitre.org/groups/G0080) and [FIN6](https://attack.mitre.org/groups/G0037). Its name was given based on the variable "More_eggs" being present in its code. There are at least two different versions of the backdoor being used, version 2.0 and version 4.4. (Citation: Talos Cobalt Group July 2018)(Citation: Security Intelligence More Eggs Aug 2019)

Executive priority

S0284: More_eggs is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S0284: More_eggs by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata
Network, endpoint, and security-tool telemetry

Detection direction

Validate whether S0284: More_eggs appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

More_eggs

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques15 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1105	Ingress Tool Transfer	More_eggs can download and launch additional payloads.[1][2]
Enterprise	T1016.001	Internet Connection DiscoverySub-technique	More_eggs has used HTTP GET requests to check internet connectivity.[2]
Enterprise	T1140	Deobfuscate/Decode Files or Information	More_eggs will decode malware components that are then dropped to the system.[2]
Enterprise	T1082	System Information Discovery	More_eggs has the capability to gather the OS version and computer name.[1][2]
Enterprise	T1071.001	Web ProtocolsSub-technique	More_eggs uses HTTPS for C2.[1][2]
Enterprise	T1573.001	Symmetric CryptographySub-technique	More_eggs has used an RC4-based encryption method for its C2 communications.[2]
Enterprise	T1059.003	Windows Command ShellSub-technique	More_eggs has used cmd.exe for execution.[2][3]
Enterprise	T1027.013	Encrypted/Encoded FileSub-technique	More_eggs's payload has been encrypted with a key that has the hostname and processor family information appended to the end.[3]
Enterprise	T1070.004	File DeletionSub-technique	More_eggs can remove itself from a system.[1][2]
Enterprise	T1016	System Network Configuration Discovery	More_eggs has the capability to gather the IP address from the victim's machine.[1]
Enterprise	T1132.001	Standard EncodingSub-technique	More_eggs has used basE91 encoding, along with encryption, for C2 communication.[2]
Enterprise	T1518.001	Security Software DiscoverySub-technique	More_eggs can obtain information on installed anti-malware programs.[1]
Enterprise	T1553.002	Code SigningSub-technique	More_eggs has used a signed binary shellcode loader and a signed Dynamic Link Library (DLL) to create a reverse shell.[2]
Enterprise	T1218.010	Regsvr32Sub-technique	More_eggs has used regsvr32.exe to execute the malicious DLL.[2]
Enterprise	T1033	System Owner/User Discovery	More_eggs has the capability to gather the username from the victim's machine.[1][2]

Associated objects

Groups, software, and campaigns

G0120: Evilnum

Evilnum is a financially motivated threat group that has been active since at least 2018.[1]

G0037: FIN6

FIN6 is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors.[1][2]

G0080: Cobalt Group

Cobalt Group is a financially motivated threat group that has primarily targeted financial institutions since at least 2016. The group has conducted intrusions to steal money via targeting ATM systems, card processing, payment systems and SWIFT systems. Cobalt Group has mainly targeted banks in Eastern Europe, Central Asia, and Southeast Asia. One of the alleged leaders was arrested in Spain in early 2018, but the group still appears to be active. The group has been known to target organizations in order to use their access to then compromise additional victims.[1][2][3][4][5][6][7] Reporting indicates there may be links between Cobalt Group and both the malware Carbanak and the group Carbanak.[8]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.2
Object version: 3.1
Created: Oct 17, 2018, 00:14 UTC (UTC+00:00)
Modified: Apr 11, 2024, 00:40 UTC (UTC+00:00)
Raw hash: bc783d3d9f6ceebc...

Imported snapshots across ATT&CK releases(2)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	3.1	Apr 11, 2024, 00:40 UTC (UTC+00:00)	Current bundle	`bc783d3d9f6c…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	3.1	Apr 11, 2024, 00:40 UTC (UTC+00:00)	Older bundle	`bc783d3d9f6c…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Talos Cobalt Group July 2018
Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.
Open source URL
[2]
Security Intelligence More Eggs Aug 2019
Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.
Open source URL
[3]
ESET EvilNum July 2020
Porolli, M. (2020, July 9). More evil: A deep look at Evilnum and its toolset. Retrieved January 22, 2021.
Open source URL
[4]
Visa FIN6 Feb 2019
Visa Public. (2019, February). FIN6 Cybercrime Group Expands Threat to eCommerce Merchants. Retrieved September 16, 2019.
Open source URL
[5]
Crowdstrike GTR2020 Mar 2020
Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020.
Open source URL
[6]
More_eggs
(Citation: Talos Cobalt Group July 2018)(Citation: ESET EvilNum July 2020)
[7]
SKID
(Citation: Crowdstrike GTR2020 Mar 2020)
[8]
SpicyOmelette
(Citation: Security Intelligence More Eggs Aug 2019)
[9]
Terra Loader
(Citation: Security Intelligence More Eggs Aug 2019)(Citation: Visa FIN6 Feb 2019)
[10]
mitre-attackS0284
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use