LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0642: BADFLICK

BADFLICK is a backdoor used by Leviathan in spearphishing campaigns first reported in 2018 that targeted the U.S. engineering and maritime industries.[1][2]

EnterpriseS0642MalwareObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

BADFLICK is a Windows backdoor that ATT&CK reports was used by Leviathan in spearphishing campaigns against U.S. engineering and maritime industries. Its practical significance is not just the malware name: the related behaviors span phishing attachment execution, host and network discovery, local data collection, archiving, tool transfer, deobfuscation, and time-based anti-analysis checks. For leaders, this makes BADFLICK a useful planning case for whether phishing defenses, endpoint visibility, SOC triage, and incident response can connect the initial email event to post-compromise discovery and data staging activity.

Executive priority

Prioritize this as an espionage-style intrusion readiness issue where intellectual property, engineering data, maritime operations, regulated information, and partner trust may be at stake. Executives should ask whether the organization can prove coverage across the chain: targeted email delivery, user execution of malicious files, Windows endpoint behavior, command-and-control file transfer, discovery commands, local data access, and archive creation. The decision value is in validating resilience and audit evidence before an incident, not assuming a specific current threat to the organization.

Technical view

For SOC, detection engineering, and IR teams, use the ATT&CK relationships as the validation map. BADFLICK is associated with Windows and uses behaviors mapped to Spearphishing Attachment, Malicious File execution, System Information Discovery, System Network Configuration Discovery, File and Directory Discovery, Data from Local System, Ingress Tool Transfer, Deobfuscate/Decode Files or Information, Time Based Checks, and Archive via Library. Because ATT&CK provides no official detection text for this malware object, teams should not rely on a BADFLICK-specific signature alone. Validate whether telemetry can correlate suspicious attachment execution with subsequent discovery, file enumeration, local data access, archive creation, decoding/deobfuscation activity, and inbound tool transfer on the same host or user session.

Likely telemetry

  • Email security logs for spearphishing attachments, attachment metadata, sender context, and delivery/disposition outcomes
  • Endpoint process creation and command-line telemetry on Windows hosts
  • File system telemetry for suspicious enumeration, access to sensitive local paths, and archive creation
  • Network telemetry for command-and-control-like file transfer or external ingress of tools
  • Endpoint events showing decoding, deobfuscation, or execution of newly introduced files

Detection direction

  • Build correlation from malicious or suspicious attachment execution to near-term host discovery, network configuration discovery, and file/directory discovery events.
  • Tune for sequences of local data access followed by archive creation, especially when tied to a user process spawned from an email-delivered file.
  • Validate visibility for ingress tool transfer rather than only outbound exfiltration; the relationship to T1105 means post-compromise tool delivery is part of the behavior set.
  • Account for false positives from legitimate administration, software deployment, compression utilities, and help desk troubleshooting by requiring unusual parent-child process chains, user context, destination reputation, or timing after attachment execution.
  • Because no official ATT&CK detection guidance is supplied for BADFLICK, treat detections as behavior-based hypotheses that require local baselining and testing.

Mitigation priorities

  • Reduce spearphishing attachment risk with attachment inspection, safe handling controls, and user reporting workflows aligned to targeted phishing scenarios.
  • Harden Windows endpoints to restrict unnecessary execution from user-writable and email download locations where feasible.
  • Ensure endpoint detection and response collects process, file, and network evidence needed to reconstruct discovery, staging, and tool transfer behaviors.
  • Limit user access to sensitive local engineering, maritime, or business data so local collection activity has less reach if a workstation is compromised.
  • Prepare IR playbooks that connect email investigation, endpoint containment, malware triage, and data access review for backdoor incidents.
Additional notes and limits

The ATT&CK object identifies BADFLICK as a backdoor used by Leviathan in spearphishing campaigns first reported in 2018 and targeting U.S. engineering and maritime industries. The most useful defensive interpretation is relationship-driven: the malware’s mapped techniques indicate a path from phishing attachment execution to discovery, data collection, archive preparation, deobfuscation, anti-analysis timing checks, and tool transfer. Organizations in adjacent sectors should use this as a control validation scenario, while avoiding unsupported assumptions about current exposure or activity.

ATT&CK provides no official detection field for BADFLICK and the supplied object lists only Windows as the malware platform. The technique relationships provide behavioral context but do not include full procedure-level detail, indicators, hashes, infrastructure, or guaranteed detection logic. Local telemetry, asset criticality, email flow, endpoint configuration, and normal administrative behavior are required to turn this into reliable detections or risk conclusions.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

BADFLICK

BADFLICK is a backdoor used by Leviathan in spearphishing campaigns first reported in 2018 that targeted the U.S. engineering and maritime industries.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

10 rows
DomainIDNameRelationship / procedure
EnterpriseT1082System Information Discovery

BADFLICK has captured victim computer name, memory space, and CPU details.[2]

EnterpriseT1560.002Archive via LibrarySub-technique

BADFLICK has compressed data using the aPLib compression library.[2]

EnterpriseT1083File and Directory Discovery

BADFLICK has searched for files on the infected host.[2]

EnterpriseT1204.002Malicious FileSub-technique

BADFLICK has relied upon users clicking on a malicious attachment delivered through spearphishing.[2]

EnterpriseT1005Data from Local System

BADFLICK has uploaded files from victims' machines.[2]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

BADFLICK has been distributed via spearphishing campaigns containing malicious Microsoft Word documents.[2]

EnterpriseT1497.003Time Based ChecksSub-technique

BADFLICK has delayed communication to the actor-controlled IP address by 5 minutes.[2]

EnterpriseT1016System Network Configuration Discovery

BADFLICK has captured victim IP address details.[2]

EnterpriseT1105Ingress Tool Transfer

BADFLICK has download files from its C2 server.[2]

EnterpriseT1140Deobfuscate/Decode Files or Information

BADFLICK can decode shellcode using a custom rotating XOR cipher.[2]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0065: Leviathan

Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.[1] Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.[1][2][3][4]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1082: System Information DiscoveryEnterpriseuses · GroupG0065: LeviathanEnterpriseuses · TechniqueT1560.002: Archive via LibraryEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · TechniqueT1497.003: Time Based ChecksEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
b7a5f4d02acda565...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundleb7a5f4d02acd…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    FireEye Periscope March 2018

    FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.

    Open source URL
  2. [2]
    Accenture MUDCARP March 2019

    Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.

    Open source URL
  3. [3]
    Accenture MUDCARP March 2019

    Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.

    Open source URL
  4. [4]
    Accenture MUDCARP March 2019

    Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.

    Open source URL
  5. [5]
    FireEye Periscope March 2018

    FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.

    Open source URL
  6. [6]
    FireEye Periscope March 2018

    FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.

    Open source URL
  7. [7]
    mitre-attackS0642
    Open source URL
  8. [8]
    mitre-attackS0642
    Open source URL
  9. [9]
    mitre-attackS0642
    Open source URL
  10. [10]
    Accenture MUDCARP March 2019

    Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.

    Open source URL
  11. [11]
    Accenture MUDCARP March 2019

    Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.

    Open source URL
  12. [12]
    Accenture MUDCARP March 2019

    Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.

    Open source URL
  13. [13]
    Accenture MUDCARP March 2019

    Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.

    Open source URL
  14. [14]
    FireEye Periscope March 2018

    FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.

    Open source URL
  15. [15]
    FireEye Periscope March 2018

    FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.

    Open source URL
  16. [16]
    Accenture MUDCARP March 2019

    Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.

    Open source URL
  17. [17]
    Accenture MUDCARP March 2019

    Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.

    Open source URL
  18. [18]
    Accenture MUDCARP March 2019

    Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.

    Open source URL
  19. [19]
    Accenture MUDCARP March 2019

    Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.

    Open source URL
  20. [20]
    Accenture MUDCARP March 2019

    Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.

    Open source URL
  21. [21]
    Accenture MUDCARP March 2019

    Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.

    Open source URL
  22. [22]
    Accenture MUDCARP March 2019

    Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.

    Open source URL
  23. [23]
    Accenture MUDCARP March 2019

    Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.

    Open source URL
  24. [24]
    Accenture MUDCARP March 2019

    Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.

    Open source URL
  25. [25]
    Accenture MUDCARP March 2019

    Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.

    Open source URL
  26. [26]
    Accenture MUDCARP March 2019

    Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.

    Open source URL
  27. [27]
    Accenture MUDCARP March 2019

    Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.

    Open source URL
  28. [28]
    Accenture MUDCARP March 2019

    Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.

    Open source URL
  29. [29]
    Accenture MUDCARP March 2019

    Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.

    Open source URL
  30. [30]
    Accenture MUDCARP March 2019

    Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.

    Open source URL
  31. [31]
    Accenture MUDCARP March 2019

    Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.

    Open source URL
  32. [32]
    Accenture MUDCARP March 2019

    Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.

    Open source URL
  33. [33]
    Accenture MUDCARP March 2019

    Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use