LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0589: Sibot

Sibot is dual-purpose malware written in VBScript designed to achieve persistence on a compromised system as well as download and execute additional payloads. Microsoft discovered three Sibot variants in early 2021 during its investigation of APT29 and the SolarWinds Compromise.[1]

EnterpriseS0589MalwareObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

Sibot matters because it represents a Windows VBScript-based malware family designed for persistence and for downloading/executing additional payloads. In business terms, that makes it a foothold-enabling component: if similar behavior is missed, an intrusion can survive reboots, bring in new tooling, and blend into normal Windows administration paths. ATT&CK links Sibot to the SolarWinds Compromise and APT29 context, so leaders should treat it as a useful validation case for whether endpoint, script, registry, scheduled task, and web egress monitoring are mature enough for high-scrutiny intrusions.

Executive priority

Prioritize this as a control-validation and incident-readiness scenario for Windows environments, especially where business continuity depends on trusted administrative tooling and clean audit evidence. The key executive question is not whether Sibot itself is present, but whether the organization can reliably detect and investigate VBScript execution, persistence via scheduled tasks or registry changes, proxy execution through trusted Windows utilities, and outbound web-based command-and-control or payload retrieval. This supports SOC readiness, IR scoping, compliance evidence, and prioritization of endpoint logging and egress visibility investments.

Technical view

Sibot is documented as Windows malware written in VBScript for persistence and additional payload execution. ATT&CK relationships associate it with registry query/modification, network and connection discovery, command obfuscation, fileless storage, legitimate-looking resource names or locations, WMI, scheduled tasks, Visual Basic execution, indicator removal/file deletion, web protocols/web services, ingress tool transfer, deobfuscation, and proxy execution through mshta.exe and rundll32.exe. SOC and IR teams should validate visibility across script hosts, command lines, parent-child process chains, scheduled task creation or modification, registry access, WMI activity, file deletion, and outbound HTTP/S or web-service traffic from unusual processes.

Likely telemetry

  • Windows process creation events with full command line and parent-child relationships
  • VBScript and script-host execution evidence, including wscript/cscript-style activity where collected
  • Scheduled task creation, modification, and execution logs
  • Windows Registry query and modification telemetry
  • WMI execution and management activity logs

Detection direction

  • Validate detections that correlate VBScript execution with persistence changes, especially scheduled tasks and registry modifications.
  • Tune for suspicious parent-child chains involving script interpreters, mshta.exe, rundll32.exe, WMI, and outbound network activity rather than relying on single-process signatures.
  • Look for discovery behavior clustered around registry queries, network configuration checks, and connection enumeration on Windows hosts.
  • Account for command obfuscation and deobfuscation by preserving full command lines, script content where legally and technically appropriate, and decoded/normalized fields where available.
  • Hunt for fileless or registry-resident storage patterns and legitimate-looking resource names or locations that may evade simple file-path allowlists.

Mitigation priorities

  • Ensure Windows endpoint logging and EDR coverage captures script execution, command lines, registry changes, scheduled tasks, WMI, file activity, and network connections.
  • Restrict or monitor high-risk script and proxy-execution utilities such as VBScript interpreters, mshta.exe, and rundll32.exe according to business need.
  • Harden persistence surfaces by controlling who can create scheduled tasks and modify sensitive registry locations.
  • Apply least privilege for administrative accounts that can use WMI, modify registry keys, or establish persistence.
  • Strengthen outbound web filtering, proxy logging, and DNS visibility to support investigation of web protocol and web-service command-and-control patterns.
Additional notes and limits

MITRE provides no dedicated detection text for Sibot, so this take is derived from the official description, external Microsoft reference, and ATT&CK relationships. The strongest defensive value is using Sibot as a behavioral test case for Windows persistence, script execution, proxy execution, registry activity, and web-based payload/C2 visibility. Relationships to APT29 and the SolarWinds Compromise provide context, but local risk depends on the organization’s Windows estate, logging depth, administrative scripting practices, and egress monitoring maturity.

The supplied object lists Windows as the platform but does not specify tactics directly and does not provide official detection guidance. Related techniques include broader platform coverage, but this assessment is constrained to the Sibot Windows context. No claim is made that Sibot is currently active in any environment or that any control will guarantee detection.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Sibot

Sibot is dual-purpose malware written in VBScript designed to achieve persistence on a compromised system as well as download and execute additional payloads. Microsoft discovered three Sibot variants in early 2021 during its investigation of APT29 and the SolarWinds Compromise.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

18 rows
DomainIDNameRelationship / procedure
EnterpriseT1012Query Registry

Sibot has queried the registry for proxy server information.[1]

EnterpriseT1053.005Scheduled TaskSub-technique

Sibot has been executed via a scheduled task.[1]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

Sibot has downloaded a DLL to the C:\windows\system32\drivers\ folder and renamed it with a .sys extension.[1]

EnterpriseT1016System Network Configuration Discovery

Sibot checked if the compromised system is configured to use proxies.[1]

EnterpriseT1027.010Command ObfuscationSub-technique

Sibot has obfuscated scripts used in execution.[1]

EnterpriseT1047Windows Management Instrumentation

Sibot has used WMI to discover network connections and configurations. Sibot has also used the Win32_Process class to execute a malicious DLL.[1]

EnterpriseT1105Ingress Tool Transfer

Sibot can download and execute a payload onto a compromised system.[1]

EnterpriseT1070.004File DeletionSub-technique

Sibot will delete itself if a certain server response is received.[1]

EnterpriseT1102Web Service

Sibot has used a legitimate compromised website to download DLLs to the victim's machine.[1]

EnterpriseT1059.005Visual BasicSub-technique

Sibot executes commands using VBScript.[1]

EnterpriseT1140Deobfuscate/Decode Files or Information

Sibot can decrypt data received from a C2 and save to a file.[1]

EnterpriseT1218.005MshtaSub-technique

Sibot has been executed via MSHTA application.[1]

EnterpriseT1218.011Rundll32Sub-technique

Sibot has executed downloaded DLLs with rundll32.exe.[1]

EnterpriseT1049System Network Connections Discovery

Sibot has retrieved a GUID associated with a present LAN connection on a compromised machine.[1]

EnterpriseT1070Indicator Removal

Sibot will delete an associated registry key if a certain server response is received.[1]

EnterpriseT1027.011Fileless StorageSub-technique

Sibot has installed a second-stage script in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\sibot registry key.[1]

EnterpriseT1112Modify Registry

Sibot has modified the Registry to install a second-stage script in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\sibot.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

Sibot communicated with its C2 server via HTTP GET requests.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0016: APT29

APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).[1][2] They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015.[3][4][5][6]

In April 2021, the US and UK governments attributed the SolarWinds Compromise to the SVR; public statements included citations to APT29, Cozy Bear, and The Dukes.[7][8] Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.[9][10][11][12][13][14]

CampaignEnterprise

C0024: SolarWinds Compromise

The SolarWinds Compromise was a sophisticated supply chain cyber operation conducted by APT29 that was discovered in mid-December 2020. APT29 used customized malware to inject malicious code into the SolarWinds Orion software build process that was later distributed through a normal software update; they also used password spraying, token theft, API abuse, spear phishing, and other supply chain attacks to compromise user accounts and leverage their associated access. Victims of this campaign included government, consulting, technology, telecom, and other organizations in North America, Europe, Asia, and the Middle East. This activity has been labled the StellarParticle campaign in industry reporting.[1] Industry reporting also initially referred to the actors involved in this campaign as UNC2452, NOBELIUM, Dark Halo, and SolarStorm.[2][3][4][5][1][6][7][8]

In April 2021, the US and UK governments attributed the SolarWinds Compromise to Russia's Foreign Intelligence Service (SVR); public statements included citations to APT29, Cozy Bear, and The Dukes.[9][10][11] The US government assessed that of the approximately 18,000 affected public and private sector customers of Solar Winds’ Orion product, a much smaller number were compromised by follow-on APT29 activity on their systems.[12]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1012: Query RegistryEnterpriseuses · TechniqueT1053.005: Scheduled TaskEnterpriseuses · TechniqueT1036.005: Match Legitimate Resource Name or LocationEnterpriseuses · CampaignC0024: SolarWinds CompromiseEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1027.010: Command ObfuscationEnterpriseuses · TechniqueT1047: Windows Management InstrumentationEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1102: Web ServiceEnterpriseuses · GroupG0016: APT29Enterpriseuses · TechniqueT1059.005: Visual BasicEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1218.005: MshtaEnterpriseuses · TechniqueT1218.011: Rundll32Enterpriseuses · TechniqueT1049: System Network Connections DiscoveryEnterpriseuses · TechniqueT1070: Indicator RemovalEnterpriseuses · TechniqueT1027.011: Fileless StorageEnterpriseuses · TechniqueT1112: Modify RegistryEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
11568116c873bfa3...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.1Current bundle11568116c873…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  2. [2]
    Cybersecurity Advisory SVR TTP May 2021

    NCSC, CISA, FBI, NSA. (2021, May 7). Further TTPs associated with SVR cyber actors. Retrieved July 29, 2021.

    Open source URL
  3. [3]
    MSTIC Nobelium Toolset May 2021

    MSTIC. (2021, May 28). Breaking down NOBELIUM’s latest early-stage toolset. Retrieved August 4, 2021.

    Open source URL
  4. [4]
    Secureworks IRON RITUAL Profile

    Secureworks CTU. (n.d.). IRON RITUAL. Retrieved February 24, 2022.

    Open source URL
  5. [5]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  6. [6]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  7. [7]
    mitre-attackS0589
    Open source URL
  8. [8]
    mitre-attackS0589
    Open source URL
  9. [9]
    mitre-attackS0589
    Open source URL
  10. [10]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  11. [11]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  12. [12]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  13. [13]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  14. [14]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  15. [15]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  16. [16]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  17. [17]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  18. [18]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  19. [19]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  20. [20]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  21. [21]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  22. [22]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  23. [23]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  24. [24]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  25. [25]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  26. [26]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  27. [27]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  28. [28]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  29. [29]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  30. [30]
    Cybersecurity Advisory SVR TTP May 2021

    NCSC, CISA, FBI, NSA. (2021, May 7). Further TTPs associated with SVR cyber actors. Retrieved July 29, 2021.

    Open source URL
  31. [31]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  32. [32]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  33. [33]
    MSTIC Nobelium Toolset May 2021

    MSTIC. (2021, May 28). Breaking down NOBELIUM’s latest early-stage toolset. Retrieved August 4, 2021.

    Open source URL
  34. [34]
    Secureworks IRON RITUAL Profile

    Secureworks CTU. (n.d.). IRON RITUAL. Retrieved February 24, 2022.

    Open source URL
  35. [35]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  36. [36]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  37. [37]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  38. [38]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  39. [39]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  40. [40]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  41. [41]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  42. [42]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  43. [43]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  44. [44]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  45. [45]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  46. [46]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  47. [47]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  48. [48]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  49. [49]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use