LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S1025: Amadey

Amadey is a Trojan bot that has been used since at least October 2018.[1][2]

EnterpriseS1025MalwareObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Amadey is a Windows Trojan bot documented by ATT&CK as used since at least October 2018. Its mapped behaviors make it relevant beyond “malware detection”: it can support host discovery, security-tool discovery, persistence through Registry Run Keys or Startup Folder, web-based command-and-control, tool transfer, and exfiltration over the C2 channel. For leaders, the practical issue is whether endpoint, DNS/web, and Windows registry telemetry can show the full intrusion path quickly enough for containment decisions.

Executive priority

Prioritize Amadey as a readiness test for Windows endpoint resilience and SOC visibility. The ATT&CK relationships tie it to financially motivated and espionage-related group contexts, but local risk should be assessed from exposure, telemetry, and response capability rather than assuming current targeting. Executives should ask whether teams can prove coverage for Windows persistence, suspicious discovery activity, web-protocol C2, fast-flux DNS patterns, and data movement over existing C2 channels.

Technical view

SOC and IR teams should validate detection and investigation coverage across the mapped Windows-relevant behaviors: Registry modification and Run Key or Startup Folder persistence, system/user/network/security-software discovery, file and directory enumeration, obfuscated or decoded payloads, native API execution indicators, ingress tool transfer, web-protocol C2, fast-flux DNS, and exfiltration over the C2 channel. ATT&CK provides no official detection text for Amadey, so detection engineering should be behavior-led and mapped to the related techniques rather than dependent on a single malware signature.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry
  • Windows Registry auditing for modification and Run Key or Startup Folder changes
  • Endpoint file creation, file modification, and directory enumeration events
  • Security tool inventory or process/service discovery telemetry
  • DNS query logs including TTL and rapidly changing resolution patterns

Detection direction

  • Build detections around behavior clusters rather than Amadey name alone: discovery followed by persistence, tool transfer, C2, or outbound data movement is higher value than isolated events.
  • Tune Windows Registry monitoring for suspicious Run Key and Startup Folder additions while accounting for legitimate software installers and enterprise management tools.
  • Correlate DNS and web telemetry for domains with rapidly changing IP addresses, short TTL behavior, and unusual outbound web-protocol sessions from endpoints.
  • Look for discovery of users, system information, network configuration, files, directories, location, and security software, especially when performed by unusual processes or shortly before network beaconing.
  • Account for false positives from administration scripts, inventory tools, patching systems, and software deployment platforms; detections should include process lineage, signer/reputation context, user context, and destination reputation where available.

Mitigation priorities

  • Start with endpoint hardening and monitoring for Windows persistence locations, especially Registry Run Keys and Startup Folders.
  • Ensure EDR and Windows logging capture process, registry, file, and network events needed to reconstruct discovery, persistence, and C2 activity.
  • Restrict and monitor outbound web traffic, DNS behavior, and file transfer paths from endpoints to reduce blind spots around web-protocol C2 and ingress tool transfer.
  • Improve incident response playbooks for suspected bot infections: isolate affected Windows hosts, preserve endpoint and network evidence, review persistence locations, and scope for related discovery and exfiltration behaviors.
  • Use the mapped techniques as control-validation requirements for managed detection, compliance evidence, and tabletop exercises rather than relying only on malware-family indicators.
Additional notes and limits

ATT&CK identifies Amadey as a Trojan bot and maps it to multiple techniques across discovery, persistence, defense evasion, command-and-control, collection, and exfiltration. Relationship context states TA505 and Kimsuky use this object; this should inform threat intelligence enrichment but not be treated as attribution for any local event without supporting evidence.

The supplied ATT&CK object has no official detection text, no aliases, no labels, and no specified tactics on the malware object itself. Some related techniques list broader platforms, but the Amadey object platform is Windows; local detection planning should therefore focus on Windows unless other evidence exists. This take does not assert current exploitation, customer exposure, or guaranteed detection coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Amadey

Amadey is a Trojan bot that has been used since at least October 2018.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

17 rows
DomainIDNameRelationship / procedure
EnterpriseT1083File and Directory Discovery

Amadey has searched for folders associated with antivirus software.[1]

EnterpriseT1027Obfuscated Files or Information

Amadey has obfuscated strings such as antivirus vendor names, domains, files, and others.[2]

EnterpriseT1568.001Fast Flux DNSSub-technique

Amadey has used fast flux DNS for its C2.[1]

EnterpriseT1518.001Security Software DiscoverySub-technique

Amadey has checked for a variety of antivirus products.[1][2]

EnterpriseT1106Native API

Amadey has used a variety of Windows API calls, including `GetComputerNameA`, `GetUserNameA`, and `CreateProcessA`.[2]

EnterpriseT1005Data from Local System

Amadey can collect information from a compromised host.[2]

EnterpriseT1041Exfiltration Over C2 Channel

Amadey has sent victim data to its C2 servers.[2]

EnterpriseT1553.005Mark-of-the-Web BypassSub-technique

Amadey has modified the `:Zone.Identifier` in the ADS area to zero.[1]

EnterpriseT1105Ingress Tool Transfer

Amadey can download and execute files to further infect a host machine with additional malware.[2]

EnterpriseT1082System Information Discovery

Amadey has collected the computer name and OS version from a compromised machine.[1][2]

EnterpriseT1112Modify Registry

Amadey has overwritten registry keys for persistence.[2]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

Amadey has changed the Startup folder to the one containing its executable by overwriting the registry keys.[1][2]

EnterpriseT1140Deobfuscate/Decode Files or Information

Amadey has decoded antivirus name strings.[1]

EnterpriseT1033System Owner/User Discovery

Amadey has collected the user name from a compromised host using `GetUserNameA`.[2]

EnterpriseT1614System Location Discovery

Amadey does not run any tasks or install additional malware if the victim machine is based in Russia.[2]

EnterpriseT1071.001Web ProtocolsSub-technique

Amadey has used HTTP for C2 communications.[2]

EnterpriseT1016System Network Configuration Discovery

Amadey can identify the IP address of a victim machine.[2]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0094: Kimsuky

Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. Kimsuky has focused collection on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy, and sanctions. Kimsuky operations have overlapped with those of other North Korean state-sponsored cyber espionage actors as a result of ad hoc collaborations or other limited resource sharing.[1][2][3][4][5][6]

Kimsuky was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019).[7][8][9] In 2023, Kimsuky was observed using commercial large language models (LLMs) to assist with vulnerability research, scripting, social engineering and reconnaissance.[10]

DPRK threat actor cluster boundaries overlap in open source reporting, with some security researchers consolidating all attributed North Korean state-sponsored cyber activity under Lazarus Group, rather than tracking operationally distinct subgroups.

GroupEnterprise

G0092: TA505

TA505 is a cyber criminal group that has been active since at least 2014. TA505 is known for frequently changing malware, driving global trends in criminal malware distribution, and ransomware campaigns involving Clop.[1][2][3][4][5]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · TechniqueT1568.001: Fast Flux DNSEnterpriseuses · TechniqueT1518.001: Security Software DiscoveryEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · GroupG0094: KimsukyEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1553.005: Mark-of-the-Web BypassEnterpriseuses · GroupG0092: TA505Enterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1112: Modify RegistryEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1614: System Location DiscoveryEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
62173724e1ba1f45...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.1Current bundle62173724e1ba…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Korean FSI TA505 2020

    Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.

    Open source URL
  2. [2]
    BlackBerry Amadey 2020

    Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.

    Open source URL
  3. [3]
    Mandiant APT43 March 2024

    Mandiant. (2024, March 14). APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations. Retrieved May 3, 2024.

    Open source URL
  4. [4]
    BlackBerry Amadey 2020

    Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.

    Open source URL
  5. [5]
    BlackBerry Amadey 2020

    Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.

    Open source URL
  6. [6]
    Korean FSI TA505 2020

    Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.

    Open source URL
  7. [7]
    Korean FSI TA505 2020

    Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.

    Open source URL
  8. [8]
    mitre-attackS1025
    Open source URL
  9. [9]
    mitre-attackS1025
    Open source URL
  10. [10]
    mitre-attackS1025
    Open source URL
  11. [11]
    Korean FSI TA505 2020

    Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.

    Open source URL
  12. [12]
    Korean FSI TA505 2020

    Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.

    Open source URL
  13. [13]
    BlackBerry Amadey 2020

    Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.

    Open source URL
  14. [14]
    BlackBerry Amadey 2020

    Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.

    Open source URL
  15. [15]
    Korean FSI TA505 2020

    Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.

    Open source URL
  16. [16]
    Korean FSI TA505 2020

    Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.

    Open source URL
  17. [17]
    BlackBerry Amadey 2020

    Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.

    Open source URL
  18. [18]
    BlackBerry Amadey 2020

    Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.

    Open source URL
  19. [19]
    Korean FSI TA505 2020

    Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.

    Open source URL
  20. [20]
    Korean FSI TA505 2020

    Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.

    Open source URL
  21. [21]
    BlackBerry Amadey 2020

    Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.

    Open source URL
  22. [22]
    BlackBerry Amadey 2020

    Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.

    Open source URL
  23. [23]
    BlackBerry Amadey 2020

    Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.

    Open source URL
  24. [24]
    BlackBerry Amadey 2020

    Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.

    Open source URL
  25. [25]
    Mandiant APT43 March 2024

    Mandiant. (2024, March 14). APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations. Retrieved May 3, 2024.

    Open source URL
  26. [26]
    BlackBerry Amadey 2020

    Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.

    Open source URL
  27. [27]
    BlackBerry Amadey 2020

    Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.

    Open source URL
  28. [28]
    Korean FSI TA505 2020

    Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.

    Open source URL
  29. [29]
    Korean FSI TA505 2020

    Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.

    Open source URL
  30. [30]
    BlackBerry Amadey 2020

    Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.

    Open source URL
  31. [31]
    BlackBerry Amadey 2020

    Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.

    Open source URL
  32. [32]
    Korean FSI TA505 2020

    Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.

    Open source URL
  33. [33]
    Korean FSI TA505 2020

    Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.

    Open source URL
  34. [34]
    BlackBerry Amadey 2020

    Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.

    Open source URL
  35. [35]
    BlackBerry Amadey 2020

    Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.

    Open source URL
  36. [36]
    BlackBerry Amadey 2020

    Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.

    Open source URL
  37. [37]
    BlackBerry Amadey 2020

    Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.

    Open source URL
  38. [38]
    Korean FSI TA505 2020

    Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.

    Open source URL
  39. [39]
    Korean FSI TA505 2020

    Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.

    Open source URL
  40. [40]
    BlackBerry Amadey 2020

    Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.

    Open source URL
  41. [41]
    BlackBerry Amadey 2020

    Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.

    Open source URL
  42. [42]
    BlackBerry Amadey 2020

    Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.

    Open source URL
  43. [43]
    BlackBerry Amadey 2020

    Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.

    Open source URL
  44. [44]
    Korean FSI TA505 2020

    Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.

    Open source URL
  45. [45]
    Korean FSI TA505 2020

    Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.

    Open source URL
  46. [46]
    Korean FSI TA505 2020

    Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.

    Open source URL
  47. [47]
    Korean FSI TA505 2020

    Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.

    Open source URL
  48. [48]
    BlackBerry Amadey 2020

    Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.

    Open source URL
  49. [49]
    BlackBerry Amadey 2020

    Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.

    Open source URL
  50. [50]
    BlackBerry Amadey 2020

    Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.

    Open source URL
  51. [51]
    BlackBerry Amadey 2020

    Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.

    Open source URL
  52. [52]
    BlackBerry Amadey 2020

    Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use