LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0453: Pony

Pony is a credential stealing malware, though has also been used among adversaries for its downloader capabilities. The source code for Pony Loader 1.0 and 2.0 were leaked online, leading to their use by various threat actors.[1]

EnterpriseS0453MalwareObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

Pony is a Windows malware family described by ATT&CK as a credential stealer that has also been used as a downloader. Its practical risk is that an apparently ordinary phishing-driven endpoint infection can become both an identity problem and a staging point for additional tools. Because the Pony Loader source code was leaked and used by various threat actors, defenders should not rely only on a single malware name or signature; they should validate coverage for the behaviors ATT&CK relates to it.

Executive priority

Treat Pony as a test case for whether the organization can connect email security, Windows endpoint visibility, web egress monitoring, and identity response. Key leadership questions: would the SOC see a malicious attachment or link leading to Windows execution, would credential exposure trigger an identity containment process, and would web-based command-and-control or follow-on tool download be noticed quickly enough to protect business operations? This object is also useful for audit and readiness evidence because ATT&CK provides no official detection text, so local control validation is required.

Technical view

ATT&CK lists Pony for Windows and relates it to phishing attachments and links, user execution of malicious files or links, Windows command shell, Native API use, system and local account discovery, password guessing, web-protocol command-and-control, ingress tool transfer, masquerading, compression, junk code insertion, time-based checks, and file deletion. SOC and IR teams should validate behavioral coverage across the infection chain rather than only looking for a Pony label. Prioritize Windows endpoint process/file telemetry, email and web telemetry, authentication evidence, and network egress patterns. Because official detection guidance is not provided, detections should be tested against local baselines and tuned for legitimate administrative command shell use, software downloads, compressed archives, and normal file cleanup activity.

Likely telemetry

  • Email security logs for spearphishing attachments and links
  • Endpoint detection telemetry for Windows process creation, command shell activity, file creation, file deletion, and masqueraded artifacts
  • Web proxy, DNS, firewall, and HTTP/S metadata for web-protocol command-and-control and file download activity
  • Authentication logs showing password guessing patterns, failed logons, and unusual account access attempts where applicable
  • Windows host telemetry for system information discovery and local account enumeration

Detection direction

  • Correlate initial email delivery evidence with endpoint execution of downloaded or attached files rather than treating mail and endpoint alerts separately.
  • Hunt for suspicious Windows command shell or Native API-driven execution that appears after user interaction with a link or attachment.
  • Monitor for local account and system discovery followed by credential-related activity or outbound web communications.
  • Tune web egress analytics for unusual HTTP/S destinations, file transfers, and downloader-like sequences while accounting for normal software update and business download traffic.
  • Include file deletion and masquerading in post-execution detection logic, but avoid high-noise standalone alerts unless combined with execution, discovery, or network activity.

Mitigation priorities

  • Start with phishing resilience: email attachment/link controls, user execution safeguards, and user reporting workflows for suspicious messages.
  • Harden Windows endpoints with least privilege, execution control where appropriate, and endpoint monitoring that captures process, file, and command-line context.
  • Protect identity systems by enforcing strong authentication, monitoring failed logon patterns, and preparing rapid credential reset or containment procedures for suspected credential theft.
  • Restrict and monitor outbound web traffic so downloader and command-and-control behaviors have fewer unmanaged paths.
  • Preserve incident response evidence by ensuring endpoint and network logs are retained long enough to investigate file deletion, tool transfer, and credential-access activity.
Additional notes and limits

The ATT&CK object identifies Pony as credential stealing malware with downloader capabilities and notes that Pony Loader 1.0 and 2.0 source code leaked online. The relationship set provides the main defensive value: it maps Pony to phishing-driven execution, Windows execution behaviors, discovery, credential access, web-based C2, tool transfer, and stealth techniques. Local validation should focus on whether these behaviors are visible and actionable in the organization’s telemetry.

ATT&CK provides no official detection text, no aliases, and no object-level tactics for Pony in the supplied fields. The relationship descriptions include platforms beyond Windows, but the Pony software object itself is listed for Windows, so environment-specific conclusions require local evidence. This summary does not assert active exploitation, attribution, prevalence, or guaranteed detection coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Pony

Pony is a credential stealing malware, though has also been used among adversaries for its downloader capabilities. The source code for Pony Loader 1.0 and 2.0 were leaked online, leading to their use by various threat actors.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

16 rows
DomainIDNameRelationship / procedure
EnterpriseT1106Native API

Pony has used several Windows functions for various purposes.[1]

EnterpriseT1204.002Malicious FileSub-technique

Pony has attempted to lure targets into downloading an attached executable (ZIP, RAR, or CAB archives) or document (PDF or other MS Office format).[1]

EnterpriseT1027.015CompressionSub-technique

Pony attachments have been delivered via compressed archive files.[1]

EnterpriseT1036Masquerading

Pony has used the Adobe Reader icon for the downloaded file to look more trustworthy.[1]

EnterpriseT1105Ingress Tool Transfer

Pony can download additional files onto the infected system.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

Pony has used batch scripts to delete itself after execution.[1]

EnterpriseT1027.016Junk Code InsertionSub-technique

Pony obfuscates memory flow by adding junk instructions when executing to make analysis more difficult.[1]

EnterpriseT1566.002Spearphishing LinkSub-technique

Pony has been delivered via spearphishing emails which contained malicious links.[1]

EnterpriseT1082System Information Discovery

Pony has collected the Service Pack, language, and region information to send to the C2.[1]

EnterpriseT1497.003Time Based ChecksSub-technique

Pony has delayed execution using a built-in function to avoid detection and analysis.[1]

EnterpriseT1204.001Malicious LinkSub-technique

Pony has attempted to lure targets into clicking links in spoofed emails from legitimate banks.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

Pony has sent collected information to the C2 via HTTP POST request.[1]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

Pony has been delivered via spearphishing attachments.[1]

EnterpriseT1087.001Local AccountSub-technique

Pony has used the NetUserEnum function to enumerate local accounts.[1]

EnterpriseT1110.001Password GuessingSub-technique

Pony has used a small dictionary of common passwords against a collected list of local accounts.[1]

EnterpriseT1070.004File DeletionSub-technique

Pony has used scripts to delete itself after execution.[1]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1027.015: CompressionEnterpriseuses · TechniqueT1036: MasqueradingEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1027.016: Junk Code InsertionEnterpriseuses · TechniqueT1566.002: Spearphishing LinkEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1497.003: Time Based ChecksEnterpriseuses · TechniqueT1204.001: Malicious LinkEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · TechniqueT1087.001: Local AccountEnterpriseuses · TechniqueT1110.001: Password GuessingEnterpriseuses · TechniqueT1070.004: File DeletionEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
11fd500ed2c3d5b7...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundle11fd500ed2c3…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  2. [2]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  3. [3]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  4. [4]
    mitre-attackS0453
    Open source URL
  5. [5]
    mitre-attackS0453
    Open source URL
  6. [6]
    mitre-attackS0453
    Open source URL
  7. [7]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  8. [8]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  9. [9]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  10. [10]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  11. [11]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  12. [12]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  13. [13]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  14. [14]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  15. [15]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  16. [16]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  17. [17]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  18. [18]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  19. [19]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  20. [20]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  21. [21]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  22. [22]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  23. [23]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  24. [24]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  25. [25]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  26. [26]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  27. [27]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  28. [28]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  29. [29]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  30. [30]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  31. [31]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  32. [32]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  33. [33]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  34. [34]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  35. [35]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  36. [36]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use