S1019: Shark

Glexia publishes ATT&CK takes only after source-hash and schema validation. Until then, use the official MITRE definition below and the defensive relationship context on this page.

Official MITRE ATT&CK definition

Shark

Shark is a backdoor malware written in C# and .NET that is an updated version of Milan; it has been used by HEXANE since at least July 2021.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques17 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1105	Ingress Tool Transfer	Shark can download additional files from its C2 via HTTP or DNS.[1][2]
Enterprise	T1041	Exfiltration Over C2 Channel	Shark has the ability to upload files from the compromised host over a DNS or HTTP C2 channel.[1]
Enterprise	T1027.013	Encrypted/Encoded FileSub-technique	Shark can use encrypted and encoded files for C2 configuration.[1][2]
Enterprise	T1029	Scheduled Transfer	Shark can pause C2 communications for a specified time.[1]
Enterprise	T1012	Query Registry	Shark can query `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid` to retrieve the machine GUID.[2]
Enterprise	T1082	System Information Discovery	Shark can collect the GUID of a targeted machine.[1][2]
Enterprise	T1059.003	Windows Command ShellSub-technique	Shark has the ability to use `CMD` to execute commands.[1][2]
Enterprise	T1008	Fallback Channels	Shark can update its configuration to use a different C2 server.[1]
Enterprise	T1005	Data from Local System	Shark can upload files to its C2.[1][2]
Enterprise	T1497.001	System ChecksSub-technique	Shark can stop execution if the screen width of the targeted machine is not over 600 pixels.[1]
Enterprise	T1036.005	Match Legitimate Resource Name or LocationSub-technique	Shark binaries have been named `audioddg.pdb` and `Winlangdb.pdb` in order to appear legitimate.[1]
Enterprise	T1070.004	File DeletionSub-technique	Shark can delete files downloaded to the compromised host.[1]
Enterprise	T1140	Deobfuscate/Decode Files or Information	Shark can extract and decrypt downloaded .zip files.[1]
Enterprise	T1071.001	Web ProtocolsSub-technique	Shark has the ability to use HTTP in C2 communications.[1][2]
Enterprise	T1071.004	DNSSub-technique	Shark can use DNS in C2 communications.[1][2]
Enterprise	T1074	Data Staged	Shark has stored information in folders named `U1` and `U2` prior to exfiltration.[1]
Enterprise	T1568.002	Domain Generation AlgorithmsSub-technique	Shark can send DNS C2 communications using a unique domain generation algorithm.[1][2]

Associated objects

Groups, software, and campaigns

G1001: HEXANE

HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. HEXANE's TTPs appear similar to APT33 and OilRig but due to differences in victims and tools it is tracked as a separate entity.[1][2][3][4]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 20.0
Object version: 1.1
Created: Jun 10, 2022, 19:45 UTC (UTC+00:00)
Modified: Apr 11, 2024, 00:08 UTC (UTC+00:00)
Raw hash: 41b1bc9532e8d0de...

Imported snapshots across ATT&CK releases(3)

Release	Bundle imported	Object version	Modified	Status	Raw hash
20.0	Oct 18, 2026, 20:39 UTC (UTC+00:00)	1.1	Apr 11, 2024, 00:08 UTC (UTC+00:00)	Current bundle	`41b1bc9532e8…`
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	1.1	Apr 11, 2024, 00:08 UTC (UTC+00:00)	Older bundle	`41b1bc9532e8…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.1	Apr 11, 2024, 00:08 UTC (UTC+00:00)	Older bundle	`41b1bc9532e8…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
ClearSky Siamesekitten August 2021
ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.
Open source URL
[2]
Accenture Lyceum Targets November 2021
Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.
Open source URL
[3]
mitre-attackS1019
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use