LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0589: Sibot

Sibot is dual-purpose malware written in VBScript designed to achieve persistence on a compromised system as well as download and execute additional payloads. Microsoft discovered three Sibot variants in early 2021 during its investigation of APT29 and the SolarWinds Compromise.[1]

EnterpriseS0589MalwareObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Automated summary not available

Glexia publishes ATT&CK takes only after source-hash and schema validation. Until then, use the official MITRE definition below and the defensive relationship context on this page.

Official MITRE ATT&CK definition

Sibot

Sibot is dual-purpose malware written in VBScript designed to achieve persistence on a compromised system as well as download and execute additional payloads. Microsoft discovered three Sibot variants in early 2021 during its investigation of APT29 and the SolarWinds Compromise.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

18 rows
DomainIDNameRelationship / procedure
EnterpriseT1012Query Registry

Sibot has queried the registry for proxy server information.[1]

EnterpriseT1053.005Scheduled TaskSub-technique

Sibot has been executed via a scheduled task.[1]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

Sibot has downloaded a DLL to the C:\windows\system32\drivers\ folder and renamed it with a .sys extension.[1]

EnterpriseT1016System Network Configuration Discovery

Sibot checked if the compromised system is configured to use proxies.[1]

EnterpriseT1027.010Command ObfuscationSub-technique

Sibot has obfuscated scripts used in execution.[1]

EnterpriseT1047Windows Management Instrumentation

Sibot has used WMI to discover network connections and configurations. Sibot has also used the Win32_Process class to execute a malicious DLL.[1]

EnterpriseT1105Ingress Tool Transfer

Sibot can download and execute a payload onto a compromised system.[1]

EnterpriseT1070.004File DeletionSub-technique

Sibot will delete itself if a certain server response is received.[1]

EnterpriseT1102Web Service

Sibot has used a legitimate compromised website to download DLLs to the victim's machine.[1]

EnterpriseT1059.005Visual BasicSub-technique

Sibot executes commands using VBScript.[1]

EnterpriseT1140Deobfuscate/Decode Files or Information

Sibot can decrypt data received from a C2 and save to a file.[1]

EnterpriseT1218.005MshtaSub-technique

Sibot has been executed via MSHTA application.[1]

EnterpriseT1218.011Rundll32Sub-technique

Sibot has executed downloaded DLLs with rundll32.exe.[1]

EnterpriseT1049System Network Connections Discovery

Sibot has retrieved a GUID associated with a present LAN connection on a compromised machine.[1]

EnterpriseT1070Indicator Removal

Sibot will delete an associated registry key if a certain server response is received.[1]

EnterpriseT1027.011Fileless StorageSub-technique

Sibot has installed a second-stage script in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\sibot registry key.[1]

EnterpriseT1112Modify Registry

Sibot has modified the Registry to install a second-stage script in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\sibot.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

Sibot communicated with its C2 server via HTTP GET requests.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0016: APT29

APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).[1][2] They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015.[3][4][5][6]

In April 2021, the US and UK governments attributed the SolarWinds Compromise to the SVR; public statements included citations to APT29, Cozy Bear, and The Dukes.[7][8] Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.[9][10][11][12][13][14]

CampaignEnterprise

C0024: SolarWinds Compromise

The SolarWinds Compromise was a sophisticated supply chain cyber operation conducted by APT29 that was discovered in mid-December 2020. APT29 used customized malware to inject malicious code into the SolarWinds Orion software build process that was later distributed through a normal software update; they also used password spraying, token theft, API abuse, spear phishing, and other supply chain attacks to compromise user accounts and leverage their associated access. Victims of this campaign included government, consulting, technology, telecom, and other organizations in North America, Europe, Asia, and the Middle East. This activity has been labled the StellarParticle campaign in industry reporting.[1] Industry reporting also initially referred to the actors involved in this campaign as UNC2452, NOBELIUM, Dark Halo, and SolarStorm.[2][3][4][5][1][6][7][8]

In April 2021, the US and UK governments attributed the SolarWinds Compromise to Russia's Foreign Intelligence Service (SVR); public statements included citations to APT29, Cozy Bear, and The Dukes.[9][10][11] The US government assessed that of the approximately 18,000 affected public and private sector customers of Solar Winds’ Orion product, a much smaller number were compromised by follow-on APT29 activity on their systems.[12]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1012: Query RegistryEnterpriseuses · TechniqueT1053.005: Scheduled TaskEnterpriseuses · TechniqueT1036.005: Match Legitimate Resource Name or LocationEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1027.010: Command ObfuscationEnterpriseuses · TechniqueT1047: Windows Management InstrumentationEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1102: Web ServiceEnterpriseuses · TechniqueT1059.005: Visual BasicEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1218.005: MshtaEnterpriseuses · TechniqueT1218.011: Rundll32Enterpriseuses · TechniqueT1049: System Network Connections DiscoveryEnterpriseuses · TechniqueT1070: Indicator RemovalEnterpriseuses · TechniqueT1027.011: Fileless StorageEnterpriseuses · TechniqueT1112: Modify RegistryEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · CampaignC0024: SolarWinds CompromiseEnterpriseuses · GroupG0016: APT29Enterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
20.0
Object version
1.1
Created
Modified
Raw hash
11568116c873bfa3...
Imported snapshots across ATT&CK releases(3)
ReleaseBundle importedObject versionModifiedStatusRaw hash
20.01.1Current bundle11568116c873…
19.21.1Older bundle11568116c873…
19.11.1Older bundle11568116c873…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  2. [2]
    mitre-attackS0589
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use