LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S1030: Squirrelwaffle

Squirrelwaffle is a loader that was first seen in September 2021. It has been used in spam email campaigns to deliver additional malware such as Cobalt Strike and the QakBot banking trojan.[1][2]

EnterpriseS1030MalwareObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Squirrelwaffle matters because ATT&CK describes it as a Windows malware loader seen in spam email campaigns that can deliver additional malware, including Cobalt Strike and QakBot. For leaders, the practical issue is not just the loader itself: it represents an email-to-endpoint intrusion path where a user action can lead to follow-on tooling, discovery, command-and-control, ingress tool transfer, and potential exfiltration over the same channel.

Executive priority

Prioritize Squirrelwaffle as a readiness test for phishing resilience, Windows endpoint visibility, and incident escalation around malware loaders. Executives should ask whether email security, endpoint detection, PowerShell and command-shell monitoring, web egress visibility, and IR playbooks can connect the initial phish to later-stage behaviors such as discovery, tool transfer, and C2. This is useful for budget and audit conversations because ATT&CK provides no official detection text here, so coverage must be proven through local telemetry and control validation rather than assumed from signatures.

Technical view

For SOC and IR teams, validate the full behavior chain supported by the relationships: spearphishing attachment/link and user execution; Windows script and shell execution via PowerShell, cmd, and Visual Basic; proxy execution through Regsvr32 and Rundll32; obfuscation through packing, encoded/encrypted files, decoding, and standard encoding; host discovery for users, system information, and network configuration; web-protocol C2; ingress tool transfer; custom archiving; and exfiltration over C2. Because Squirrelwaffle is described as a loader, detections should avoid focusing only on a single file hash or family name and should instead correlate email, process, file, and network evidence around a suspicious delivery-to-execution sequence.

Likely telemetry

  • Email gateway and mail security logs for spearphishing attachments and links
  • Endpoint process creation telemetry for PowerShell, cmd.exe, Visual Basic-related execution, regsvr32.exe, and rundll32.exe
  • Command-line arguments and parent-child process relationships on Windows endpoints
  • File creation, download, archive, packing, encoding, and decoding indicators where available
  • Endpoint security alerts and malware analysis metadata for packed or encoded files

Detection direction

  • Validate correlation from email delivery to user execution rather than treating phishing, endpoint execution, and outbound traffic as separate alert classes.
  • Tune detections for suspicious use of PowerShell, Windows Command Shell, Visual Basic, Regsvr32, and Rundll32, with attention to unusual parents, command-line content, network access, and file loads.
  • Review coverage for obfuscated, packed, encrypted, or encoded files because the related techniques indicate evasion of simple signature-based detection.
  • Monitor discovery commands and system/user/network enumeration occurring shortly after a suspicious email-open or file/link execution event.
  • Use web egress analytics to identify unusual outbound communications and potential encoded C2 traffic, while accounting for high false-positive volume in normal HTTP/S traffic.

Mitigation priorities

  • Start with phishing controls and user-execution reduction: harden email attachment and link handling, and ensure awareness and reporting processes are operational.
  • Strengthen Windows endpoint controls for script interpreters and trusted binary proxy execution, especially PowerShell, cmd.exe, Visual Basic, regsvr32.exe, and rundll32.exe.
  • Improve egress governance and monitoring for web-protocol command-and-control and external tool transfer paths.
  • Ensure endpoint logging captures process command lines, parent-child relationships, file activity, and network connections needed to reconstruct the chain.
  • Prepare IR playbooks for loader incidents that require rapid scoping for secondary payloads, discovery activity, C2, and possible exfiltration.
Additional notes and limits

The ATT&CK object identifies Squirrelwaffle as a Windows loader first seen in September 2021 and used in spam campaigns to deliver additional malware. Relationship context gives the most useful defensive shape: phishing-based initial access, user execution, Windows scripting and proxy execution, obfuscation, discovery, web C2, tool transfer, collection/archive behavior, and exfiltration over C2. Treat it as a coverage model for loader-driven intrusions, not as proof of current activity or exposure in any specific environment.

Official ATT&CK detection guidance is not provided for S1030, and the supplied data does not include indicators, procedures, campaign timing beyond first-seen context, prevalence, affected organizations, or confirmed current exploitation. Platform support for the malware itself is Windows; related techniques list broader platforms, but those should not be interpreted as Squirrelwaffle platform support without additional evidence. Local telemetry and case evidence are required to confirm detection coverage or incident impact.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Squirrelwaffle

Squirrelwaffle is a loader that was first seen in September 2021. It has been used in spam email campaigns to deliver additional malware such as Cobalt Strike and the QakBot banking trojan.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

21 rows
DomainIDNameRelationship / procedure
EnterpriseT1033System Owner/User Discovery

Squirrelwaffle can collect the user name from a compromised host.[1]

EnterpriseT1059.005Visual BasicSub-technique

Squirrelwaffle has used malicious VBA macros in Microsoft Word documents and Excel spreadsheets that execute an `AutoOpen` subroutine.[1][2]

EnterpriseT1082System Information Discovery

Squirrelwaffle has gathered victim computer information and configurations.[1]

EnterpriseT1041Exfiltration Over C2 Channel

Squirrelwaffle has exfiltrated victim data using HTTP POST requests to its C2 servers.[1]

EnterpriseT1566.002Spearphishing LinkSub-technique

Squirrelwaffle has been distributed through phishing emails containing a malicious URL.[1]

EnterpriseT1218.010Regsvr32Sub-technique

Squirrelwaffle has been executed using `regsvr32.exe`.[1]

EnterpriseT1140Deobfuscate/Decode Files or Information

Squirrelwaffle has decrypted files and payloads using a XOR-based algorithm.[1][2]

EnterpriseT1204.001Malicious LinkSub-technique

Squirrelwaffle has relied on victims to click on a malicious link send via phishing campaigns.[1]

EnterpriseT1105Ingress Tool Transfer

Squirrelwaffle has downloaded and executed additional encoded payloads.[1][2]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

Squirrelwaffle has been distributed via malicious Microsoft Office documents within spam emails.[2]

EnterpriseT1132.001Standard EncodingSub-technique

Squirrelwaffle has encoded its communications to C2 servers using Base64.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

Squirrelwaffle has used HTTP POST requests for C2 communications.[1]

EnterpriseT1204.002Malicious FileSub-technique

Squirrelwaffle has relied on users enabling malicious macros within Microsoft Excel and Word attachments.[1][2]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

Squirrelwaffle has been obfuscated with a XOR-based algorithm.[1][2]

EnterpriseT1027.002Software PackingSub-technique

Squirrelwaffle has been packed with a custom packer to hide payloads.[1][2]

EnterpriseT1560.003Archive via Custom MethodSub-technique

Squirrelwaffle has encrypted collected data using a XOR-based algorithm.[1]

EnterpriseT1059.001PowerShellSub-technique

Squirrelwaffle has used PowerShell to execute its payload.[1][2]

EnterpriseT1059.003Windows Command ShellSub-technique

Squirrelwaffle has used `cmd.exe` for execution.[2]

EnterpriseT1497Virtualization/Sandbox Evasion

Squirrelwaffle has contained a hardcoded list of IP addresses to block that belong to sandboxes and analysis platforms.[1][2]

EnterpriseT1218.011Rundll32Sub-technique

Squirrelwaffle has been executed using `rundll32.exe`.[1][2]

EnterpriseT1016System Network Configuration Discovery

Squirrelwaffle has collected the victim’s external IP address.[1]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1059.005: Visual BasicEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1566.002: Spearphishing LinkEnterpriseuses · TechniqueT1218.010: Regsvr32Enterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1204.001: Malicious LinkEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · TechniqueT1132.001: Standard EncodingEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1027.002: Software PackingEnterpriseuses · TechniqueT1560.003: Archive via Custom MethodEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1497: Virtualization/Sandbox EvasionEnterpriseuses · TechniqueT1218.011: Rundll32Enterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
f2d18944fcba05b3...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.1Current bundlef2d18944fcba…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  2. [2]
    Netskope Squirrelwaffle Oct 2021

    Palazolo, G. (2021, October 7). SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot. Retrieved August 9, 2022.

    Open source URL
  3. [3]
    Netskope Squirrelwaffle Oct 2021

    Palazolo, G. (2021, October 7). SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot. Retrieved August 9, 2022.

    Open source URL
  4. [4]
    Netskope Squirrelwaffle Oct 2021

    Palazolo, G. (2021, October 7). SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot. Retrieved August 9, 2022.

    Open source URL
  5. [5]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  6. [6]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  7. [7]
    mitre-attackS1030
    Open source URL
  8. [8]
    mitre-attackS1030
    Open source URL
  9. [9]
    mitre-attackS1030
    Open source URL
  10. [10]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  11. [11]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  12. [12]
    Netskope Squirrelwaffle Oct 2021

    Palazolo, G. (2021, October 7). SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot. Retrieved August 9, 2022.

    Open source URL
  13. [13]
    Netskope Squirrelwaffle Oct 2021

    Palazolo, G. (2021, October 7). SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot. Retrieved August 9, 2022.

    Open source URL
  14. [14]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  15. [15]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  16. [16]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  17. [17]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  18. [18]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  19. [19]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  20. [20]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  21. [21]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  22. [22]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  23. [23]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  24. [24]
    Netskope Squirrelwaffle Oct 2021

    Palazolo, G. (2021, October 7). SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot. Retrieved August 9, 2022.

    Open source URL
  25. [25]
    Netskope Squirrelwaffle Oct 2021

    Palazolo, G. (2021, October 7). SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot. Retrieved August 9, 2022.

    Open source URL
  26. [26]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  27. [27]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  28. [28]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  29. [29]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  30. [30]
    Netskope Squirrelwaffle Oct 2021

    Palazolo, G. (2021, October 7). SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot. Retrieved August 9, 2022.

    Open source URL
  31. [31]
    Netskope Squirrelwaffle Oct 2021

    Palazolo, G. (2021, October 7). SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot. Retrieved August 9, 2022.

    Open source URL
  32. [32]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  33. [33]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  34. [34]
    Netskope Squirrelwaffle Oct 2021

    Palazolo, G. (2021, October 7). SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot. Retrieved August 9, 2022.

    Open source URL
  35. [35]
    Netskope Squirrelwaffle Oct 2021

    Palazolo, G. (2021, October 7). SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot. Retrieved August 9, 2022.

    Open source URL
  36. [36]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  37. [37]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  38. [38]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  39. [39]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  40. [40]
    Netskope Squirrelwaffle Oct 2021

    Palazolo, G. (2021, October 7). SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot. Retrieved August 9, 2022.

    Open source URL
  41. [41]
    Netskope Squirrelwaffle Oct 2021

    Palazolo, G. (2021, October 7). SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot. Retrieved August 9, 2022.

    Open source URL
  42. [42]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  43. [43]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  44. [44]
    Netskope Squirrelwaffle Oct 2021

    Palazolo, G. (2021, October 7). SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot. Retrieved August 9, 2022.

    Open source URL
  45. [45]
    Netskope Squirrelwaffle Oct 2021

    Palazolo, G. (2021, October 7). SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot. Retrieved August 9, 2022.

    Open source URL
  46. [46]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  47. [47]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  48. [48]
    Netskope Squirrelwaffle Oct 2021

    Palazolo, G. (2021, October 7). SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot. Retrieved August 9, 2022.

    Open source URL
  49. [49]
    Netskope Squirrelwaffle Oct 2021

    Palazolo, G. (2021, October 7). SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot. Retrieved August 9, 2022.

    Open source URL
  50. [50]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  51. [51]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  52. [52]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  53. [53]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  54. [54]
    Netskope Squirrelwaffle Oct 2021

    Palazolo, G. (2021, October 7). SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot. Retrieved August 9, 2022.

    Open source URL
  55. [55]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  56. [56]
    Netskope Squirrelwaffle Oct 2021

    Palazolo, G. (2021, October 7). SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot. Retrieved August 9, 2022.

    Open source URL
  57. [57]
    Netskope Squirrelwaffle Oct 2021

    Palazolo, G. (2021, October 7). SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot. Retrieved August 9, 2022.

    Open source URL
  58. [58]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  59. [59]
    Netskope Squirrelwaffle Oct 2021

    Palazolo, G. (2021, October 7). SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot. Retrieved August 9, 2022.

    Open source URL
  60. [60]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
  61. [61]
    ZScaler Squirrelwaffle Sep 2021

    Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use