S0445: ShimRatReporter
ShimRatReporter is a tool used by suspected Chinese adversary Mofang to automatically conduct initial discovery. The details from this discovery are used to customize follow-on payloads (such as ShimRat) as well as set up faux infrastructure which mimics the adversary's targets. ShimRatReporter has been used in campaigns targeting multiple countries and sectors including government, military, critical infrastructure, automobile, and weapons development.[1]
Automated summary not available
Glexia publishes ATT&CK takes only after source-hash and schema validation. Until then, use the official MITRE definition below and the defensive relationship context on this page.
ShimRatReporter
ShimRatReporter is a tool used by suspected Chinese adversary Mofang to automatically conduct initial discovery. The details from this discovery are used to customize follow-on payloads (such as ShimRat) as well as set up faux infrastructure which mimics the adversary's targets. ShimRatReporter has been used in campaigns targeting multiple countries and sectors including government, military, critical infrastructure, automobile, and weapons development.[1]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1041 | Exfiltration Over C2 Channel | ShimRatReporter sent generated reports to the C2 via HTTP POST requests.[1] |
| Enterprise | T1105 | Ingress Tool Transfer | ShimRatReporter had the ability to download additional payloads.[1] |
| Enterprise | T1049 | System Network Connections Discovery | ShimRatReporter used the Windows function |
| Enterprise | T1518 | Software Discovery | ShimRatReporter gathered a list of installed software on the infected host.[1] |
| Enterprise | T1087 | Account Discovery | ShimRatReporter listed all non-privileged and privileged accounts available on the machine.[1] |
| Enterprise | T1560 | Archive Collected Data | ShimRatReporter used LZ compression to compress initial reconnaissance reports before sending to the C2.[1] |
| Enterprise | T1036.005 | Match Legitimate Resource Name or LocationSub-technique | ShimRatReporter spoofed itself as |
| Enterprise | T1016 | System Network Configuration Discovery | ShimRatReporter gathered the local proxy, domain, IP, routing tables, mac address, gateway, DNS servers, and DHCP status information from an infected host.[1] |
| Enterprise | T1069 | Permission Groups Discovery | ShimRatReporter gathered the local privileges for the infected host.[1] |
| Enterprise | T1082 | System Information Discovery | ShimRatReporter gathered the operating system name and specific Windows version of an infected machine.[1] |
| Enterprise | T1020 | Automated Exfiltration | ShimRatReporter sent collected system and network information compiled into a report to an adversary-controlled C2.[1] |
| Enterprise | T1071.001 | Web ProtocolsSub-technique | ShimRatReporter communicated over HTTP with preconfigured C2 servers.[1] |
| Enterprise | T1027 | Obfuscated Files or Information | ShimRatReporter encrypted gathered information with a combination of shifting and XOR using a static key.[1] |
| Enterprise | T1119 | Automated Collection | ShimRatReporter gathered information automatically, without instruction from a C2, related to the user and host machine that is compiled into a report and sent to the operators.[1] |
| Enterprise | T1106 | Native API | ShimRatReporter used several Windows API functions to gather information from the infected system.[1] |
| Enterprise | T1057 | Process Discovery | ShimRatReporter listed all running processes on the machine.[1] |
Groups, software, and campaigns
G0103: Mofang
Mofang is a likely China-based cyber espionage group, named for its frequent practice of imitating a victim's infrastructure. This adversary has been observed since at least May 2012 conducting focused attacks against government and critical infrastructure in Myanmar, as well as several other countries and sectors including military, automobile, and weapons industries.[1]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(3)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 20.0 | 1.0 | Current bundle | 483e12d53731… | ||
| 19.2 | 1.0 | Older bundle | 483e12d53731… | ||
| 19.1 | 1.0 | Older bundle | 483e12d53731… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]FOX-IT May 2016 Mofang
Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.
Open source URL - [2]mitre-attackS0445Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.