LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0667: Chrommme

Chrommme is a backdoor tool written using the Microsoft Foundation Class (MFC) framework that was first reported in June 2021; security researchers noted infrastructure overlaps with Gelsemium malware.[1]

EnterpriseS0667MalwareObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Chrommme is a Windows backdoor described by ATT&CK as an MFC-based tool first reported in 2021, with reported infrastructure overlaps with Gelsemium malware. The practical risk is not just “a backdoor exists”; its ATT&CK relationships show a post-compromise pattern of discovery, local data collection, staging, archiving, and exfiltration over command-and-control. For leaders, this makes Chrommme a useful validation case for whether endpoint, network, and incident response processes can prove what data was accessed and whether it left the environment.

Executive priority

Treat this as a coverage and readiness question for Windows endpoints: can the organization detect and investigate a backdoor that profiles systems and users, collects local data including screenshots, stages or archives it, and transfers it through an existing C2 channel? Priority should be on evidence quality for breach scoping, audit defensibility, and data-loss decision-making, especially where sensitive files reside on workstations or servers.

Technical view

ATT&CK provides no official detection text for Chrommme, so defenders should validate behavior-based coverage against the related techniques: system, user, network, and storage discovery; local data access and staging; screen capture; archive or encoded/encrypted files; ingress tool transfer; native API execution; scheduled transfer; and exfiltration over C2. For SOC and IR teams, the key is correlating endpoint process/file activity with outbound network activity rather than relying on a malware name or static signature.

Likely telemetry

  • Windows endpoint process execution and parent/child process context
  • File creation, modification, archive creation, and unusual staging-directory activity
  • Endpoint records of screen capture or suspicious graphics/API-related behavior where available
  • Network egress metadata, including long-lived or recurring outbound connections
  • Proxy, firewall, DNS, and C2-adjacent connection logs

Detection direction

  • Build detections around behavior chains: discovery followed by file collection/staging, archive or encoded file creation, and outbound transfer.
  • Tune for repeated or scheduled outbound activity that aligns with local staging or archive creation, while accounting for legitimate backup, sync, and software-update workflows.
  • Validate visibility into Windows endpoints because the malware object’s supplied platform is Windows.
  • Do not depend on official ATT&CK detection guidance for this object; none is provided.
  • Use relationship-driven context to hunt for T1005, T1016, T1033, T1082, T1680, T1074.001, T1560, T1027.013, T1140, T1029, T1041, T1105, T1106, and T1113 patterns.

Mitigation priorities

  • Prioritize endpoint monitoring and retention sufficient to reconstruct discovery, collection, staging, and exfiltration behavior.
  • Restrict unnecessary outbound connectivity and maintain reviewable proxy, DNS, firewall, and endpoint network logs.
  • Apply least privilege and data-access controls so a compromised Windows host has limited access to sensitive local or shared data.
  • Harden controls around unauthorized tool transfer and execution from user-writable locations.
  • Ensure data-loss response procedures include file-access scoping, egress review, and preservation of endpoint artifacts.
Additional notes and limits

The supplied ATT&CK record identifies Chrommme as a Windows backdoor written with the Microsoft Foundation Class framework and cites an ESET report. The relationship set is more useful for defensive planning than the short malware description because it maps the tool to discovery, collection, staging, obfuscation, transfer, and exfiltration behaviors. Infrastructure overlap with Gelsemium is noted in the official description, but this take does not infer attribution or current activity.

ATT&CK provides no official detection section, no aliases, and no explicit tactics on the malware object. The related technique descriptions are generic ATT&CK technique context, not full Chrommme procedure detail. Local environment baselines, logging configuration, and confirmed telemetry coverage are required before judging actual detection or response capability.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Chrommme

Chrommme is a backdoor tool written using the Microsoft Foundation Class (MFC) framework that was first reported in June 2021; security researchers noted infrastructure overlaps with Gelsemium malware.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

14 rows
DomainIDNameRelationship / procedure
EnterpriseT1016System Network Configuration Discovery

Chrommme can enumerate the IP address of a compromised host.[1]

EnterpriseT1560Archive Collected Data

Chrommme can encrypt and store on disk collected data before exfiltration.[1]

EnterpriseT1105Ingress Tool Transfer

Chrommme can download its code from C2.[1]

EnterpriseT1680Local Storage Discovery

Chrommme has the ability to list drives.[1]

EnterpriseT1082System Information Discovery

Chrommme has the ability to obtain the computer name of a compromised host.[1]

EnterpriseT1140Deobfuscate/Decode Files or Information

Chrommme can decrypt its encrypted internal code.[1]

EnterpriseT1074.001Local Data StagingSub-technique

Chrommme can store captured system information locally prior to exfiltration.[1]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

Chrommme can encrypt sections of its code to evade detection.[1]

EnterpriseT1113Screen Capture

Chrommme has the ability to capture screenshots.[1]

EnterpriseT1041Exfiltration Over C2 Channel

Chrommme can exfiltrate collected data via C2.[1]

EnterpriseT1106Native API

Chrommme can use Windows API including `WinExec` for execution.[1]

EnterpriseT1029Scheduled Transfer

Chrommme can set itself to sleep before requesting a new command from C2.[1]

EnterpriseT1005Data from Local System

Chrommme can collect data from a local system.[1]

EnterpriseT1033System Owner/User Discovery

Chrommme can retrieve the username from a targeted system.[1]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1560: Archive Collected DataEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1680: Local Storage DiscoveryEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1074.001: Local Data StagingEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1029: Scheduled TransferEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
c679a6c81c3456ff...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.1Current bundlec679a6c81c34…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
  2. [2]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
  3. [3]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
  4. [4]
    mitre-attackS0667
    Open source URL
  5. [5]
    mitre-attackS0667
    Open source URL
  6. [6]
    mitre-attackS0667
    Open source URL
  7. [7]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
  8. [8]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
  9. [9]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
  10. [10]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
  11. [11]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
  12. [12]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
  13. [13]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
  14. [14]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
  15. [15]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
  16. [16]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
  17. [17]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
  18. [18]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
  19. [19]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
  20. [20]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
  21. [21]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
  22. [22]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
  23. [23]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
  24. [24]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
  25. [25]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
  26. [26]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
  27. [27]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
  28. [28]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
  29. [29]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
  30. [30]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
  31. [31]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
  32. [32]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
  33. [33]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use