LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0444: ShimRat

ShimRat has been used by the suspected China-based adversary Mofang in campaigns targeting multiple countries and sectors including government, military, critical infrastructure, automobile, and weapons development. The name "ShimRat" comes from the malware's extensive use of Windows Application Shimming to maintain persistence. [1]

EnterpriseS0444MalwareObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

ShimRat is a Windows malware family associated in ATT&CK with Mofang and notable for persistence through Windows Application Shimming. For leaders, the business issue is not just the malware name: its related behaviors span persistence, privilege escalation, discovery, command-and-control resiliency, local data collection, and scheduled exfiltration. That combination is material for environments where Windows endpoints support government, military, critical infrastructure, automobile, or weapons-development operations, as described in the source reporting.

Executive priority

Prioritize ShimRat as a validation case for Windows endpoint resilience and incident readiness rather than as a standalone indicator list. Executives should ask whether the organization can prove visibility into application shims, registry persistence, Windows services, command-shell activity, web-based outbound communications, proxy-like C2 patterns, local and network-share discovery, and file deletion. This supports budget and audit decisions around endpoint logging, managed detection, IR evidence preservation, and protection of sensitive operational or engineering data.

Technical view

ATT&CK provides no official detection text for ShimRat, so SOC and detection engineering should work from the mapped behaviors. Validate coverage on Windows for Application Shimming, Registry Run Keys/Startup Folder, Windows Service creation or modification, Modify Registry, UAC bypass-related elevation signals, Windows Command Shell execution, Native API-adjacent suspicious process behavior, execution-flow hijacking, file and directory discovery, network share discovery, tool transfer, web-protocol C2, fallback channels, external proxy use, scheduled transfer, software packing, compression, deobfuscation, and file deletion. Treat these as behavior clusters: persistence plus discovery plus outbound web communications plus cleanup is more decision-useful than any single event.

Likely telemetry

  • Windows endpoint process creation and command-line logging
  • Windows Registry modification events, including Run keys and service configuration paths
  • Application Compatibility / shim database and shim installation or modification evidence
  • Windows service creation, modification, and start events
  • File creation, deletion, archive/compression, and suspicious executable metadata

Detection direction

  • Build detections around combinations of mapped techniques rather than the malware name alone, since no official ATT&CK detection guidance is provided.
  • Validate visibility into Windows Application Shimming because the official description highlights extensive use of shimming for persistence.
  • Tune for suspicious service names, service paths, and task/service masquerading while accounting for legitimate administrative and software-management activity.
  • Correlate registry persistence changes with new binaries, command-shell execution, and outbound web communications.
  • Review outbound web traffic for resilient or alternate C2 patterns, including fallback channels and external proxy-like behavior, while baselining normal proxy and update traffic.

Mitigation priorities

  • Confirm Windows endpoint logging and retention are sufficient before an incident; ShimRat-related behaviors depend heavily on host evidence.
  • Harden and monitor persistence surfaces: application shims, registry autoruns, and Windows services.
  • Restrict unnecessary administrative privileges and validate controls relevant to UAC bypass risk and privileged service or registry changes.
  • Apply application control or execution control where feasible, with monitoring for execution-flow hijacking attempts.
  • Limit and monitor outbound web access, proxy use, and unusual external communications from endpoints that should not initiate such traffic.
Additional notes and limits

ATT&CK identifies ShimRat as used by Mofang and describes campaigns targeting multiple countries and sectors. The object’s most distinctive defensive lead is Windows Application Shimming for persistence. The mapped techniques provide a practical hunt and control-validation plan across persistence, privilege escalation, execution, discovery, collection, command and control, exfiltration timing, and stealth.

The supplied ATT&CK object has no official detection section, no aliases, no explicit malware tactics listed, and only Windows as the malware platform. Technique relationship descriptions include other platforms, but platform-specific conclusions for ShimRat should be limited to Windows unless local intelligence supports more. This summary does not assert current activity, customer exposure, or guaranteed detection coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

ShimRat

ShimRat has been used by the suspected China-based adversary Mofang in campaigns targeting multiple countries and sectors including government, military, critical infrastructure, automobile, and weapons development. The name "ShimRat" comes from the malware's extensive use of Windows Application Shimming to maintain persistence. [1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

21 rows
DomainIDNameRelationship / procedure
EnterpriseT1105Ingress Tool Transfer

ShimRat can download additional files.[1]

EnterpriseT1090.002External ProxySub-technique

ShimRat can use pre-configured HTTP proxies.[1]

EnterpriseT1548.002Bypass User Account ControlSub-technique

ShimRat has hijacked the cryptbase.dll within migwiz.exe to escalate privileges. This prevented the User Access Control window from appearing.[1]

EnterpriseT1574Hijack Execution Flow

ShimRat can hijack the cryptbase.dll within migwiz.exe to escalate privileges and bypass UAC controls.[1]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

ShimRat has installed a registry based start-up key HKCU\Software\microsoft\windows\CurrentVersion\Run to maintain persistence should other methods fail.[1]

EnterpriseT1036.004Masquerade Task or ServiceSub-technique

ShimRat can impersonate Windows services and antivirus products to avoid detection on compromised systems.[1]

EnterpriseT1029Scheduled Transfer

ShimRat can sleep when instructed to do so by the C2.[1]

EnterpriseT1070.004File DeletionSub-technique

ShimRat can uninstall itself from compromised hosts, as well create and modify directories, delete, move, copy, and rename files.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

ShimRat communicated over HTTP and HTTPS with C2 servers.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

ShimRat can be issued a command shell function from the C2.[1]

EnterpriseT1140Deobfuscate/Decode Files or Information

ShimRat has decompressed its core DLL using shellcode once an impersonated antivirus component was running on a system.[1]

EnterpriseT1546.011Application ShimmingSub-technique

ShimRat has installed shim databases in the AppPatch folder.[1]

EnterpriseT1008Fallback Channels

ShimRat has used a secondary C2 location if the first was unavailable.[1]

EnterpriseT1027.002Software PackingSub-technique

ShimRat's loader has been packed with the compressed ShimRat core DLL and the legitimate DLL for it to hijack.[1]

EnterpriseT1027.015CompressionSub-technique

ShimRat has been delivered as a package that includes compressed DLL and shellcode payloads within a .dat file.[1]

EnterpriseT1106Native API

ShimRat has used Windows API functions to install the service and shim.[1]

EnterpriseT1543.003Windows ServiceSub-technique

ShimRat has installed a Windows service to maintain persistence on victim machines.[1]

EnterpriseT1135Network Share Discovery

ShimRat can enumerate connected drives for infected host machines.[1]

EnterpriseT1005Data from Local System

ShimRat has the capability to upload collected files to a C2.[1]

EnterpriseT1083File and Directory Discovery

ShimRat can list directories.[1]

EnterpriseT1112Modify Registry

ShimRat has registered two registry keys for shim databases.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0103: Mofang

Mofang is a likely China-based cyber espionage group, named for its frequent practice of imitating a victim's infrastructure. This adversary has been observed since at least May 2012 conducting focused attacks against government and critical infrastructure in Myanmar, as well as several other countries and sectors including military, automobile, and weapons industries.[1]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1090.002: External ProxyEnterpriseuses · TechniqueT1548.002: Bypass User Account ControlEnterpriseuses · TechniqueT1574: Hijack Execution FlowEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1036.004: Masquerade Task or ServiceEnterpriseuses · GroupG0103: MofangEnterpriseuses · TechniqueT1029: Scheduled TransferEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1546.011: Application ShimmingEnterpriseuses · TechniqueT1008: Fallback ChannelsEnterpriseuses · TechniqueT1027.002: Software PackingEnterpriseuses · TechniqueT1027.015: CompressionEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1543.003: Windows ServiceEnterpriseuses · TechniqueT1135: Network Share DiscoveryEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1112: Modify RegistryEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
c0a792afac650a0d...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundlec0a792afac65…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  2. [2]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  3. [3]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  4. [4]
    mitre-attackS0444
    Open source URL
  5. [5]
    mitre-attackS0444
    Open source URL
  6. [6]
    mitre-attackS0444
    Open source URL
  7. [7]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  8. [8]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  9. [9]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  10. [10]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  11. [11]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  12. [12]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  13. [13]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  14. [14]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  15. [15]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  16. [16]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  17. [17]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  18. [18]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  19. [19]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  20. [20]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  21. [21]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  22. [22]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  23. [23]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  24. [24]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  25. [25]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  26. [26]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  27. [27]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  28. [28]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  29. [29]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  30. [30]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  31. [31]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  32. [32]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  33. [33]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  34. [34]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  35. [35]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  36. [36]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  37. [37]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  38. [38]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  39. [39]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  40. [40]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  41. [41]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  42. [42]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  43. [43]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  44. [44]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  45. [45]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
  46. [46]
    FOX-IT May 2016 Mofang

    Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use