LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0660: Clambling

Clambling is a modular backdoor written in C++ that has been used by Threat Group-3390 since at least 2017.[1]

EnterpriseS0660MalwareObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

Clambling matters because ATT&CK describes it as a Windows modular C++ backdoor associated with broad post-compromise behavior: discovery, collection, command-and-control, registry activity, PowerShell/cmd execution, process injection/hollowing, and user-data capture such as keystrokes, screenshots, clipboard, and video. For leaders, the decision point is not a single malware name; it is whether Windows endpoint, identity, and network monitoring can prove visibility into a modular backdoor that may blend into normal admin and web traffic.

Executive priority

Prioritize Clambling as a coverage-validation use case for Windows resilience and incident readiness. The related techniques touch sensitive data collection, credential exposure through keylogging, C2 over web or other protocols, and persistence or defense impairment via registry modification. Security leaders should ask whether SOC runbooks can connect endpoint behavior, network egress, and user-risk evidence quickly enough to support containment decisions, regulatory evidence, and business continuity planning for sectors or environments where Threat Group-3390 tradecraft is relevant.

Technical view

ATT&CK provides no official detection text for Clambling, so defenders should validate coverage through the related behaviors rather than a malware-specific signature alone. On Windows, focus on correlated sequences: command shell or PowerShell execution; registry query or modification; system, user, process, network, file, directory, and share discovery; process injection or process hollowing indicators; local data access; clipboard, screen, video, or keystroke collection signals; and outbound C2 using web protocols, application-layer protocols, non-application-layer protocols, or bidirectional communication through external web services. Treat the relationship to Threat Group-3390 as context for threat-informed testing, not as proof of current activity in any environment.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry, including PowerShell and cmd activity
  • Windows Registry query and modification events
  • Endpoint memory or EDR telemetry relevant to process injection and process hollowing
  • File system access, directory enumeration, and local data access events
  • User, process, system information, system time, network configuration, and network share discovery telemetry

Detection direction

  • Build behavior-based detections mapped to the related ATT&CK techniques rather than relying only on a Clambling name or hash.
  • Correlate discovery commands, registry activity, and script or shell execution with later collection or outbound network activity to reduce false positives from normal administration.
  • Tune PowerShell and Windows command shell analytics against known administrative baselines; these interpreters are legitimate tools and will generate noise without context.
  • Validate whether EDR or host sensors can observe process injection and process hollowing behaviors, not just process starts.
  • Review coverage for collection behaviors such as clipboard, screen, video, and keystroke capture; many environments do not collect these signals by default or restrict them for privacy reasons.

Mitigation priorities

  • Start with Windows endpoint hardening and least-privilege controls that limit unnecessary registry modification, script execution, and high-risk administrative activity.
  • Apply application control or execution policy controls where feasible for PowerShell, cmd-launched tooling, and unapproved binaries, while preserving legitimate administration paths.
  • Ensure EDR or equivalent endpoint protection is configured to monitor process injection, process hollowing, registry changes, and suspicious collection behaviors.
  • Constrain outbound network access with proxy, firewall, and egress filtering controls; monitor approved web protocols and external web services rather than assuming they are benign.
  • Protect credentials and sensitive user activity by strengthening identity controls, privileged access management, and rapid credential reset procedures during suspected compromise.
Additional notes and limits

The strongest defensive value comes from using Clambling as a scenario for validating telemetry joins across Windows endpoint, registry, scripting, collection, and network egress data. The ATT&CK relationship to Threat Group-3390 provides threat context, and the source reference is Trend Micro’s DRBControl reporting, but local evidence is required before making any attribution or exposure claim.

The supplied ATT&CK object has no official detection guidance, no aliases, no malware-specific indicators, and no explicit tactic list on the malware object. Several related techniques are cross-platform in ATT&CK, but the Clambling object itself is supplied with Windows as its platform, so this take limits platform-specific guidance to Windows. Environment-specific baselines, logging configuration, privacy rules, and sensor capabilities will determine practical coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Clambling

Clambling is a modular backdoor written in C++ that has been used by Threat Group-3390 since at least 2017.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

34 rows
DomainIDNameRelationship / procedure
EnterpriseT1125Video Capture

Clambling can record screen content in AVI format.[1][2]

EnterpriseT1095Non-Application Layer Protocol

Clambling has the ability to use TCP and UDP for communication.[1]

EnterpriseT1564.001Hidden Files and DirectoriesSub-technique

Clambling has the ability to set its file attributes to hidden.[1]

EnterpriseT1102.002Bidirectional CommunicationSub-technique

Clambling can use Dropbox to download malicious payloads, send commands, and receive information.[1][2]

EnterpriseT1113Screen Capture

Clambling has the ability to capture screenshots.[1]

EnterpriseT1497.003Time Based ChecksSub-technique

Clambling can wait 30 minutes before initiating contact with C2.[1]

EnterpriseT1012Query Registry

Clambling has the ability to enumerate Registry keys, including KEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt\strDataDir to search for a bitcoin wallet.[1][2]

EnterpriseT1083File and Directory Discovery

Clambling can browse directories on a compromised host.[1][2]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

Clambling can establish persistence by adding a Registry run key.[1][2]

EnterpriseT1204.002Malicious FileSub-technique

Clambling has gained execution through luring victims into opening malicious files.[1]

EnterpriseT1567.002Exfiltration to Cloud StorageSub-technique

Clambling can send files from a victim's machine to Dropbox.[1][2]

EnterpriseT1027Obfuscated Files or Information

The Clambling executable has been obfuscated when dropped on a compromised host.[1]

EnterpriseT1569.002Service ExecutionSub-technique

Clambling can create and start services on a compromised host.[1]

EnterpriseT1055Process Injection

Clambling can inject into the `svchost.exe` process for execution.[1]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

Clambling has been delivered to victim's machines through malicious e-mail attachments.[1]

EnterpriseT1115Clipboard Data

Clambling has the ability to capture and store clipboard data.[1][2]

EnterpriseT1059.003Windows Command ShellSub-technique

Clambling can use cmd.exe for command execution.[1]

EnterpriseT1082System Information Discovery

Clambling can discover the hostname, computer name, and Windows version of a targeted machine.[1][2]

EnterpriseT1135Network Share Discovery

Clambling has the ability to enumerate network shares.[1]

EnterpriseT1071Application Layer Protocol

Clambling has the ability to use Telnet for communication.[1]

EnterpriseT1056.001KeyloggingSub-technique

Clambling can capture keystrokes on a compromised host.[1][2]

EnterpriseT1055.012Process HollowingSub-technique

Clambling can execute binaries through process hollowing.[1]

EnterpriseT1140Deobfuscate/Decode Files or Information

Clambling can deobfuscate its payload prior to execution.[1][2]

EnterpriseT1057Process Discovery

Clambling can enumerate processes on a targeted system.[1]

EnterpriseT1124System Time Discovery

Clambling can determine the current time.[1]

EnterpriseT1112Modify Registry

Clambling can set and delete Registry keys.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

Clambling has the ability to communicate over HTTP.[1]

EnterpriseT1548.002Bypass User Account ControlSub-technique

Clambling has the ability to bypass UAC using a `passuac.dll` file.[1][2]

EnterpriseT1543.003Windows ServiceSub-technique

Clambling can register itself as a system service to gain persistence.[2]

EnterpriseT1033System Owner/User Discovery

Clambling can identify the username on a compromised host.[1][2]

EnterpriseT1059.001PowerShellSub-technique

The Clambling dropper can use PowerShell to download the malware.[1]

EnterpriseT1016System Network Configuration Discovery

Clambling can enumerate the IP address of a compromised machine.[1][2]

EnterpriseT1005Data from Local System

Clambling can collect information from a compromised host.[1]

EnterpriseT1574.001DLLSub-technique

Clambling can store a file named `mpsvc.dll`, which opens a malicious `mpsvc.mui` file, in the same folder as the legitimate Microsoft executable `MsMpEng.exe` to gain execution.[1][2]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0027: Threat Group-3390

Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims.[1] The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.[2][3][4]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1125: Video CaptureEnterpriseuses · TechniqueT1095: Non-Application Layer ProtocolEnterpriseuses · TechniqueT1564.001: Hidden Files and DirectoriesEnterpriseuses · TechniqueT1102.002: Bidirectional CommunicationEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1497.003: Time Based ChecksEnterpriseuses · TechniqueT1012: Query RegistryEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1567.002: Exfiltration to Cloud StorageEnterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · TechniqueT1569.002: Service ExecutionEnterpriseuses · TechniqueT1055: Process InjectionEnterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · TechniqueT1115: Clipboard DataEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1135: Network Share DiscoveryEnterpriseuses · TechniqueT1071: Application Layer ProtocolEnterpriseuses · TechniqueT1056.001: KeyloggingEnterpriseuses · TechniqueT1055.012: Process HollowingEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1057: Process DiscoveryEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
c7c3830683a20a0e...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundlec7c3830683a2…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  2. [2]
    Talent-Jump Clambling February 2020

    Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.

    Open source URL
  3. [3]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  4. [4]
    Trend Micro Iron Tiger April 2021

    Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.

    Open source URL
  5. [5]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  6. [6]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  7. [7]
    mitre-attackS0660
    Open source URL
  8. [8]
    mitre-attackS0660
    Open source URL
  9. [9]
    mitre-attackS0660
    Open source URL
  10. [10]
    Talent-Jump Clambling February 2020

    Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.

    Open source URL
  11. [11]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  12. [12]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  13. [13]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  14. [14]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  15. [15]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  16. [16]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  17. [17]
    Talent-Jump Clambling February 2020

    Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.

    Open source URL
  18. [18]
    Talent-Jump Clambling February 2020

    Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.

    Open source URL
  19. [19]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  20. [20]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  21. [21]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  22. [22]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  23. [23]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  24. [24]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  25. [25]
    Talent-Jump Clambling February 2020

    Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.

    Open source URL
  26. [26]
    Talent-Jump Clambling February 2020

    Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.

    Open source URL
  27. [27]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  28. [28]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  29. [29]
    Talent-Jump Clambling February 2020

    Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.

    Open source URL
  30. [30]
    Talent-Jump Clambling February 2020

    Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.

    Open source URL
  31. [31]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  32. [32]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  33. [33]
    Talent-Jump Clambling February 2020

    Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.

    Open source URL
  34. [34]
    Talent-Jump Clambling February 2020

    Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.

    Open source URL
  35. [35]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  36. [36]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  37. [37]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  38. [38]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  39. [39]
    Talent-Jump Clambling February 2020

    Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.

    Open source URL
  40. [40]
    Talent-Jump Clambling February 2020

    Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.

    Open source URL
  41. [41]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  42. [42]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  43. [43]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  44. [44]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  45. [45]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  46. [46]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  47. [47]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  48. [48]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  49. [49]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  50. [50]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  51. [51]
    Talent-Jump Clambling February 2020

    Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.

    Open source URL
  52. [52]
    Talent-Jump Clambling February 2020

    Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.

    Open source URL
  53. [53]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  54. [54]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  55. [55]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  56. [56]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  57. [57]
    Talent-Jump Clambling February 2020

    Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.

    Open source URL
  58. [58]
    Talent-Jump Clambling February 2020

    Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.

    Open source URL
  59. [59]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  60. [60]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  61. [61]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  62. [62]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  63. [63]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  64. [64]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  65. [65]
    Talent-Jump Clambling February 2020

    Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.

    Open source URL
  66. [66]
    Talent-Jump Clambling February 2020

    Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.

    Open source URL
  67. [67]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  68. [68]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  69. [69]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  70. [70]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  71. [71]
    Talent-Jump Clambling February 2020

    Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.

    Open source URL
  72. [72]
    Talent-Jump Clambling February 2020

    Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.

    Open source URL
  73. [73]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  74. [74]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  75. [75]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  76. [76]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  77. [77]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  78. [78]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  79. [79]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  80. [80]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  81. [81]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  82. [82]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  83. [83]
    Talent-Jump Clambling February 2020

    Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.

    Open source URL
  84. [84]
    Talent-Jump Clambling February 2020

    Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.

    Open source URL
  85. [85]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  86. [86]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  87. [87]
    Talent-Jump Clambling February 2020

    Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.

    Open source URL
  88. [88]
    Talent-Jump Clambling February 2020

    Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.

    Open source URL
  89. [89]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  90. [90]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  91. [91]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  92. [92]
    Trend Micro Iron Tiger April 2021

    Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.

    Open source URL
  93. [93]
    Talent-Jump Clambling February 2020

    Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.

    Open source URL
  94. [94]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  95. [95]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  96. [96]
    Talent-Jump Clambling February 2020

    Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.

    Open source URL
  97. [97]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  98. [98]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  99. [99]
    Talent-Jump Clambling February 2020

    Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.

    Open source URL
  100. [100]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use