LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0514: WellMess

WellMess is lightweight malware family with variants written in .NET and Golang that has been in use since at least 2018 by APT29.[1][2][3]

EnterpriseS0514MalwareObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

WellMess matters because it represents a lightweight Windows malware family associated in ATT&CK with APT29 and behaviors that support discovery, command execution, command-and-control, local data collection, and tool transfer. For leaders, the practical question is not only “can we find WellMess,” but whether the organization can see the common Windows, DNS, web, and identity-enumeration activity that would make similar intrusions diagnosable during an incident.

Executive priority

Prioritize this as a readiness and evidence problem: confirm that SOC, incident response, identity, and network teams can reconstruct suspicious Windows command execution, domain group discovery, local data access, and outbound web/DNS communications. Because ATT&CK provides no official detection text for this object, leadership should ask for demonstrable telemetry coverage and tested investigation workflows rather than relying on malware-name detections alone.

Technical view

ATT&CK lists WellMess as Windows malware with .NET and Golang variants and relationships to techniques including PowerShell, Windows Command Shell, system/user/network/domain discovery, local data collection, ingress tool transfer, and C2 over web and DNS with encoding, junk data, and cryptography. SOC teams should validate detections around suspicious PowerShell/cmd execution followed by discovery commands, domain group queries, local file access, outbound HTTP/S or DNS activity, and external file transfer. IR teams should be prepared for encrypted or encoded C2 content where metadata, timing, destination reputation, process lineage, and host context may be more useful than payload inspection.

Likely telemetry

  • Windows process creation events with full command line and parent/child process relationships
  • PowerShell execution and script logging where available
  • Windows command shell execution telemetry
  • Endpoint file access, file creation, and binary execution evidence for local collection and tool transfer
  • User, host, network configuration, and domain group enumeration evidence

Detection direction

  • Do not depend solely on a WellMess signature; validate behavioral coverage for the related ATT&CK techniques.
  • Correlate Windows shell or PowerShell execution with discovery activity such as system information, user, network configuration, and domain group enumeration.
  • Look for unusual outbound web or DNS communications from processes that recently performed discovery or local data access.
  • Account for C2 blind spots: junk data, standard encoding, and cryptography may reduce payload-level visibility, so metadata and endpoint context are important.
  • Tune carefully for administrative false positives, especially legitimate PowerShell, cmd, domain administration, inventory, and monitoring tools.

Mitigation priorities

  • Establish reliable endpoint, PowerShell, command-line, DNS, and proxy logging before relying on detection claims.
  • Apply least privilege and monitor access to privileged domain groups so discovery of high-value accounts is visible and actionable.
  • Restrict and monitor script and command interpreter use on Windows systems where business operations allow.
  • Use egress controls, DNS controls, and proxy inspection policies to reduce unmanaged outbound C2 paths while preserving auditable logs.
  • Maintain application control or allowlisting strategies for unapproved binaries and transferred tools where feasible.
Additional notes and limits

This take is based on the supplied ATT&CK S0514 WellMess object, its external references from CISA, NCSC, PwC, and MITRE, and the listed relationships to APT29 and ATT&CK techniques. The malware object itself has no specified tactics and no official detection text, so defensive guidance is derived from the related techniques and the Windows platform listed for the malware.

The supplied fields do not provide indicators, hashes, C2 infrastructure, specific commands, mitigations, or official analytics. Local validation is required to determine whether an environment has relevant telemetry, whether behaviors are anomalous, and whether any observed activity should be attributed to WellMess or APT29.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

WellMess

WellMess is lightweight malware family with variants written in .NET and Golang that has been in use since at least 2018 by APT29.[1][2][3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

15 rows
DomainIDNameRelationship / procedure
EnterpriseT1033System Owner/User Discovery

WellMess can collect the username on the victim machine to send to C2.[1]

EnterpriseT1059.001PowerShellSub-technique

WellMess can execute PowerShell scripts received from C2.[2][1]

EnterpriseT1005Data from Local System

WellMess can send files from the victim machine to C2.[2][1]

EnterpriseT1071.004DNSSub-technique

WellMess has the ability to use DNS tunneling for C2 communications.[2][3]

EnterpriseT1082System Information Discovery

WellMess can identify the computer name of a compromised host.[2][1]

EnterpriseT1105Ingress Tool Transfer

WellMess can write files to a compromised host.[2][1]

EnterpriseT1573.002Asymmetric CryptographySub-technique

WellMess can communicate to C2 with mutual TLS where client and server mutually check certificates.[2][4][1][3]

EnterpriseT1132.001Standard EncodingSub-technique

WellMess has used Base64 encoding to uniquely identify communication to and from the C2.[1]

EnterpriseT1573.001Symmetric CryptographySub-technique

WellMess can encrypt HTTP POST data using RC6 and a dynamically generated AES key encrypted with a hard coded RSA public key.[2][4][1]

EnterpriseT1059.003Windows Command ShellSub-technique

WellMess can execute command line scripts received from C2.[2]

EnterpriseT1069.002Domain GroupsSub-technique

WellMess can identify domain group membership for the current user.[1]

EnterpriseT1016System Network Configuration Discovery

WellMess can identify the IP address and user domain on the target machine.[2][1]

EnterpriseT1140Deobfuscate/Decode Files or Information

WellMess can decode and decrypt data received from C2.[2][4][1]

EnterpriseT1071.001Web ProtocolsSub-technique

WellMess can use HTTP and HTTPS in C2 communications.[2][4][1][3]

EnterpriseT1001.001Junk DataSub-technique

WellMess can use junk data in the Base64 string for additional obfuscation.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0016: APT29

APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).[1][2] They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015.[3][4][5][6]

In April 2021, the US and UK governments attributed the SolarWinds Compromise to the SVR; public statements included citations to APT29, Cozy Bear, and The Dukes.[7][8] Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.[9][10][11][12][13][14]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1071.004: DNSEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1573.002: Asymmetric CryptographyEnterpriseuses · TechniqueT1132.001: Standard EncodingEnterpriseuses · TechniqueT1573.001: Symmetric CryptographyEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1069.002: Domain GroupsEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1001.001: Junk DataEnterpriseuses · GroupG0016: APT29Enterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
029d3c7d48717412...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundle029d3c7d4871…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    CISA WellMess July 2020

    CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.

    Open source URL
  2. [2]
    PWC WellMess July 2020

    PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.

    Open source URL
  3. [3]
    NCSC APT29 July 2020

    National Cyber Security Centre. (2020, July 16). Advisory: APT29 targets COVID-19 vaccine development. Retrieved September 29, 2020.

    Open source URL
  4. [4]
    PWC WellMess C2 August 2020

    PWC. (2020, August 17). WellMess malware: analysis of its Command and Control (C2) server. Retrieved September 29, 2020.

    Open source URL
  5. [5]
    Cybersecurity Advisory SVR TTP May 2021

    NCSC, CISA, FBI, NSA. (2021, May 7). Further TTPs associated with SVR cyber actors. Retrieved July 29, 2021.

    Open source URL
  6. [6]
    CISA WellMess July 2020

    CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.

    Open source URL
  7. [7]
    CISA WellMess July 2020

    CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.

    Open source URL
  8. [8]
    NCSC APT29 July 2020

    National Cyber Security Centre. (2020, July 16). Advisory: APT29 targets COVID-19 vaccine development. Retrieved September 29, 2020.

    Open source URL
  9. [9]
    NCSC APT29 July 2020

    National Cyber Security Centre. (2020, July 16). Advisory: APT29 targets COVID-19 vaccine development. Retrieved September 29, 2020.

    Open source URL
  10. [10]
    PWC WellMess July 2020

    PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.

    Open source URL
  11. [11]
    PWC WellMess July 2020

    PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.

    Open source URL
  12. [12]
    mitre-attackS0514
    Open source URL
  13. [13]
    mitre-attackS0514
    Open source URL
  14. [14]
    mitre-attackS0514
    Open source URL
  15. [15]
    CISA WellMess July 2020

    CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.

    Open source URL
  16. [16]
    CISA WellMess July 2020

    CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.

    Open source URL
  17. [17]
    CISA WellMess July 2020

    CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.

    Open source URL
  18. [18]
    CISA WellMess July 2020

    CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.

    Open source URL
  19. [19]
    PWC WellMess July 2020

    PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.

    Open source URL
  20. [20]
    PWC WellMess July 2020

    PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.

    Open source URL
  21. [21]
    CISA WellMess July 2020

    CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.

    Open source URL
  22. [22]
    CISA WellMess July 2020

    CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.

    Open source URL
  23. [23]
    PWC WellMess July 2020

    PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.

    Open source URL
  24. [24]
    PWC WellMess July 2020

    PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.

    Open source URL
  25. [25]
    NCSC APT29 July 2020

    National Cyber Security Centre. (2020, July 16). Advisory: APT29 targets COVID-19 vaccine development. Retrieved September 29, 2020.

    Open source URL
  26. [26]
    NCSC APT29 July 2020

    National Cyber Security Centre. (2020, July 16). Advisory: APT29 targets COVID-19 vaccine development. Retrieved September 29, 2020.

    Open source URL
  27. [27]
    PWC WellMess July 2020

    PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.

    Open source URL
  28. [28]
    PWC WellMess July 2020

    PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.

    Open source URL
  29. [29]
    CISA WellMess July 2020

    CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.

    Open source URL
  30. [30]
    CISA WellMess July 2020

    CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.

    Open source URL
  31. [31]
    PWC WellMess July 2020

    PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.

    Open source URL
  32. [32]
    PWC WellMess July 2020

    PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.

    Open source URL
  33. [33]
    CISA WellMess July 2020

    CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.

    Open source URL
  34. [34]
    CISA WellMess July 2020

    CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.

    Open source URL
  35. [35]
    PWC WellMess July 2020

    PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.

    Open source URL
  36. [36]
    PWC WellMess July 2020

    PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.

    Open source URL
  37. [37]
    CISA WellMess July 2020

    CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.

    Open source URL
  38. [38]
    CISA WellMess July 2020

    CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.

    Open source URL
  39. [39]
    NCSC APT29 July 2020

    National Cyber Security Centre. (2020, July 16). Advisory: APT29 targets COVID-19 vaccine development. Retrieved September 29, 2020.

    Open source URL
  40. [40]
    NCSC APT29 July 2020

    National Cyber Security Centre. (2020, July 16). Advisory: APT29 targets COVID-19 vaccine development. Retrieved September 29, 2020.

    Open source URL
  41. [41]
    PWC WellMess C2 August 2020

    PWC. (2020, August 17). WellMess malware: analysis of its Command and Control (C2) server. Retrieved September 29, 2020.

    Open source URL
  42. [42]
    PWC WellMess July 2020

    PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.

    Open source URL
  43. [43]
    PWC WellMess July 2020

    PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.

    Open source URL
  44. [44]
    CISA WellMess July 2020

    CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.

    Open source URL
  45. [45]
    CISA WellMess July 2020

    CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.

    Open source URL
  46. [46]
    CISA WellMess July 2020

    CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.

    Open source URL
  47. [47]
    CISA WellMess July 2020

    CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.

    Open source URL
  48. [48]
    PWC WellMess C2 August 2020

    PWC. (2020, August 17). WellMess malware: analysis of its Command and Control (C2) server. Retrieved September 29, 2020.

    Open source URL
  49. [49]
    PWC WellMess C2 August 2020

    PWC. (2020, August 17). WellMess malware: analysis of its Command and Control (C2) server. Retrieved September 29, 2020.

    Open source URL
  50. [50]
    PWC WellMess July 2020

    PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.

    Open source URL
  51. [51]
    PWC WellMess July 2020

    PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.

    Open source URL
  52. [52]
    PWC WellMess July 2020

    PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.

    Open source URL
  53. [53]
    PWC WellMess July 2020

    PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.

    Open source URL
  54. [54]
    CISA WellMess July 2020

    CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.

    Open source URL
  55. [55]
    CISA WellMess July 2020

    CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.

    Open source URL
  56. [56]
    CISA WellMess July 2020

    CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.

    Open source URL
  57. [57]
    CISA WellMess July 2020

    CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.

    Open source URL
  58. [58]
    PWC WellMess July 2020

    PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.

    Open source URL
  59. [59]
    PWC WellMess July 2020

    PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.

    Open source URL
  60. [60]
    CISA WellMess July 2020

    CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.

    Open source URL
  61. [61]
    CISA WellMess July 2020

    CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.

    Open source URL
  62. [62]
    PWC WellMess C2 August 2020

    PWC. (2020, August 17). WellMess malware: analysis of its Command and Control (C2) server. Retrieved September 29, 2020.

    Open source URL
  63. [63]
    PWC WellMess C2 August 2020

    PWC. (2020, August 17). WellMess malware: analysis of its Command and Control (C2) server. Retrieved September 29, 2020.

    Open source URL
  64. [64]
    PWC WellMess July 2020

    PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.

    Open source URL
  65. [65]
    PWC WellMess July 2020

    PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.

    Open source URL
  66. [66]
    CISA WellMess July 2020

    CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.

    Open source URL
  67. [67]
    NCSC APT29 July 2020

    National Cyber Security Centre. (2020, July 16). Advisory: APT29 targets COVID-19 vaccine development. Retrieved September 29, 2020.

    Open source URL
  68. [68]
    PWC WellMess C2 August 2020

    PWC. (2020, August 17). WellMess malware: analysis of its Command and Control (C2) server. Retrieved September 29, 2020.

    Open source URL
  69. [69]
    PWC WellMess July 2020

    PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.

    Open source URL
  70. [70]
    CISA WellMess July 2020

    CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.

    Open source URL
  71. [71]
    CISA WellMess July 2020

    CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.

    Open source URL
  72. [72]
    NCSC APT29 July 2020

    National Cyber Security Centre. (2020, July 16). Advisory: APT29 targets COVID-19 vaccine development. Retrieved September 29, 2020.

    Open source URL
  73. [73]
    PWC WellMess C2 August 2020

    PWC. (2020, August 17). WellMess malware: analysis of its Command and Control (C2) server. Retrieved September 29, 2020.

    Open source URL
  74. [74]
    PWC WellMess July 2020

    PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use