S0476: Valak

Valak matters because MITRE describes it as Windows-based, multi-stage modular malware that can act as either an information stealer or a downloader. For leaders, the practical issue is not just one malware name; it is whether the organization can detect and respond to a chain that may begin with script execution, perform host and account discovery, persist through scheduled tasks or registry changes, communicate over web protocols with fallback or multi-stage channels, collect data, and potentially bring in additional tools.

Executive priority

Prioritize Valak as a readiness test for Windows endpoint visibility, email-delivered malware response, command-and-control detection, and data collection/exfiltration monitoring. Because the relationship context includes use by TA551, a financially motivated group associated with email-based malware distribution campaigns, security leaders should ask whether SOC, IR, and compliance teams can produce evidence for endpoint execution, persistence, credential/account discovery, collection, and outbound web communications during an investigation. Budget and control decisions should focus on closing telemetry gaps rather than relying on a single malware signature.

Technical view

Validate coverage across the behaviors MITRE associates with Valak: PowerShell and JavaScript execution, WMI, scheduled tasks, registry query and modification, obfuscated or packed content, fileless storage, host/user/account/process/network discovery, web-protocol C2, fallback and multi-stage channels, ingress tool transfer, screen capture, remote email collection, automated collection, and exfiltration over C2. Since no official detection text is provided, detection engineering should map local analytics to these related techniques and confirm that Windows endpoint, script, registry, task scheduler, WMI, process, and network telemetry can be correlated into a single incident narrative.

Likely telemetry

Windows endpoint process creation and command-line telemetry
PowerShell logging and script block/module evidence where available
Windows Script Host or JavaScript/JScript execution evidence
WMI activity logs and process relationships
Scheduled task creation, modification, and execution events

Detection direction

Use behavior-based detections mapped to the related ATT&CK techniques rather than depending only on Valak-specific indicators.
Correlate script execution, WMI, scheduled task, and registry activity with subsequent discovery and outbound web communications.
Tune for administrative false positives: WMI, PowerShell, registry access, scheduled tasks, and account discovery are common in legitimate operations, so detections should consider parent process, user context, destination, timing, and sequence.
Validate visibility into multi-stage and fallback C2 patterns, including repeated outbound web traffic from unusual processes or changing destinations.
Review whether email collection and Office Suite-related telemetry is available, because MITRE maps Valak to remote email collection, but local evidence is required to determine applicability.

Mitigation priorities

Harden and monitor Windows scripting, WMI, scheduled tasks, and registry modification paths according to business need and least privilege.
Improve endpoint and network logging before relying on malware-family-specific detections, since MITRE provides no official detection guidance for this object.
Restrict unnecessary script interpreter use and administrative tooling exposure where operationally feasible.
Apply egress monitoring and filtering controls that make web-protocol C2, fallback channels, and ingress tool transfer easier to identify and contain.
Strengthen email-security and user-reporting workflows in environments concerned about email-based malware distribution, consistent with the TA551 relationship context.

Analyst notes and limits

The supplied ATT&CK object identifies Valak as Windows malware with multi-stage modular behavior and information-stealing or downloader capability. The most useful defensive interpretation is to treat it as a coverage exercise across execution, discovery, persistence, defense evasion, command and control, collection, and exfiltration behaviors represented by its related techniques. Relationship context links TA551 as a group that uses Valak, but this take does not infer current activity or customer exposure.

MITRE provides no official detection text, no aliases, and no explicit tactics on the malware object itself. Several related techniques list platforms beyond Windows, but the Valak object platform supplied here is Windows; platform-specific claims should therefore be validated locally. External reporting is referenced but not expanded beyond the supplied citation metadata.

Official MITRE ATT&CK definition

Valak

Valak is a multi-stage modular malware that can function as a standalone information stealer or downloader, first observed in 2019 targeting enterprises in the US and Germany.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques 34 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1112	Modify Registry	Valak has the ability to modify the Registry key `HKCU\Software\ApplicationContainer\Appsw64` to store information regarding the C2 server and downloads.[1][2]CitationSentinelOne Valak June 2020
Enterprise	T1555.004	Windows Credential Manager Sub-technique	Valak can use a .NET compiled module named exchgrabber to enumerate credentials from the Credential Manager.CitationSentinelOne Valak June 2020
Enterprise	T1057	Process Discovery	Valak has the ability to enumerate running processes on a compromised host.[1]
Enterprise	T1564.004	NTFS File Attributes Sub-technique	Valak has the ability save and execute files as alternate data streams (ADS).[1][2]CitationSentinelOne Valak June 2020
Enterprise	T1027	Obfuscated Files or Information	Valak has the ability to base64 encode and XOR encrypt strings.[1][2]CitationSentinelOne Valak June 2020
Enterprise	T1218.010	Regsvr32 Sub-technique	Valak has used `regsvr32.exe` to launch malicious DLLs.[1][2]
Enterprise	T1071.001	Web Protocols Sub-technique	Valak has used HTTP in communications with C2.[1][2]
Enterprise	T1104	Multi-Stage Channels	Valak can download additional modules and malware capable of using separate C2 channels.[2]
Enterprise	T1008	Fallback Channels	Valak can communicate over multiple C2 hosts.[2]
Enterprise	T1518.001	Security Software Discovery Sub-technique	Valak can determine if a compromised host has security products installed.[1]
Enterprise	T1204.002	Malicious File Sub-technique	Valak has been executed via Microsoft Word documents containing malicious macros.[1][2]CitationSentinelOne Valak June 2020
Enterprise	T1113	Screen Capture	Valak has the ability to take screenshots on a compromised host.[1]
Enterprise	T1033	System Owner/User Discovery	Valak can gather information regarding the user.[1]
Enterprise	T1559.002	Dynamic Data Exchange Sub-technique	Valak can execute tasks via OLE.CitationSentinelOne Valak June 2020
Enterprise	T1059.007	JavaScript Sub-technique	Valak can execute JavaScript containing configuration data for establishing persistence.[1]
Enterprise	T1082	System Information Discovery	Valak can determine the Windows version and computer name on a compromised host.[1]CitationSentinelOne Valak June 2020
Enterprise	T1566.001	Spearphishing Attachment Sub-technique	Valak has been delivered via spearphishing e-mails with password protected ZIP files.[2]
Enterprise	T1119	Automated Collection	Valak can download a module to search for and build a report of harvested credential data.CitationSentinelOne Valak June 2020
Enterprise	T1105	Ingress Tool Transfer	Valak has downloaded a variety of modules and payloads to the compromised host, including IcedID and NetSupport Manager RAT-based malware.[2][1]
Enterprise	T1041	Exfiltration Over C2 Channel	Valak has the ability to exfiltrate data over the C2 channel.[1][2]CitationSentinelOne Valak June 2020
Enterprise	T1552.002	Credentials in Registry Sub-technique	Valak can use the clientgrabber module to steal e-mail credentials from the Registry.CitationSentinelOne Valak June 2020
Enterprise	T1016	System Network Configuration Discovery	Valak has the ability to identify the domain and the MAC and IP addresses of an infected machine.[1]
Enterprise	T1114.002	Remote Email Collection Sub-technique	Valak can collect sensitive mailing information from Exchange servers, including credentials and the domain certificate of an enterprise.[1]
Enterprise	T1027.002	Software Packing Sub-technique	Valak has used packed DLL payloads.CitationSentinelOne Valak June 2020
Enterprise	T1027.011	Fileless Storage Sub-technique	Valak has the ability to store information regarding the C2 server and downloads in the Registry key `HKCU\Software\ApplicationContainer\Appsw64`.[1][2]CitationSentinelOne Valak June 2020
Enterprise	T1012	Query Registry	Valak can use the Registry for code updates and to collect credentials.[2]
Enterprise	T1053.005	Scheduled Task Sub-technique	Valak has used scheduled tasks to execute additional payloads and to gain persistence on a compromised host.[1][2]CitationSentinelOne Valak June 2020
Enterprise	T1140	Deobfuscate/Decode Files or Information	Valak has the ability to decode and decrypt downloaded files.[1][2]
Enterprise	T1132.001	Standard Encoding Sub-technique	Valak has returned C2 data as encoded ASCII.[2]
Enterprise	T1087.002	Domain Account Sub-technique	Valak has the ability to enumerate domain admin accounts.[1]
Enterprise	T1087.001	Local Account Sub-technique	Valak has the ability to enumerate local admin accounts.[1]
Enterprise	T1059.001	PowerShell Sub-technique	Valak has used PowerShell to download additional modules.[1]
Enterprise	T1047	Windows Management Instrumentation	Valak can use `wmic process call create` in a scheduled task to launch plugins and for execution.CitationSentinelOne Valak June 2020
Enterprise	T1566.002	Spearphishing Link Sub-technique	Valak has been delivered via malicious links in e-mail.CitationSentinelOne Valak June 2020

Associated objects

Groups, software, and campaigns

G0127: TA551

TA551 is a financially-motivated threat group that has been active since at least 2018. [1] The group has primarily targeted English, German, Italian, and Japanese speakers through email-based malware distribution campaigns. [2]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release: 19.1
Object version: 1.3
Created: Jun 19, 2020, 17:11 UTC (UTC+00:00)
Modified: Apr 16, 2025, 20:38 UTC (UTC+00:00)
Raw hash: a6dcffdbba5388a8...

Imported snapshots across ATT&CK releases (1)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.1	Jun 3, 2026, 07:54 UTC (UTC+00:00)	1.3	Apr 16, 2025, 20:38 UTC (UTC+00:00)	Current bundle	`a6dcffdbba53…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Cybereason Valak May 2020

Salem, E. et al. (2020, May 28). VALAK: MORE THAN MEETS THE EYE . Retrieved June 19, 2020.
Open source URL
[2]
Unit 42 Valak July 2020

Duncan, B. (2020, July 24). Evolution of Valak, from Its Beginnings to Mass Distribution. Retrieved August 31, 2020.
Open source URL
[3]
mitre-attack S0476
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use

Analyst context for executives and security teams