S1030: Squirrelwaffle
Squirrelwaffle is a loader that was first seen in September 2021. It has been used in spam email campaigns to deliver additional malware such as Cobalt Strike and the QakBot banking trojan.[1][2]
Security context for executives and security teams
S1030: Squirrelwaffle describes [Squirrelwaffle](https://attack.mitre.org/software/S1030) is a loader that was first seen in September 2021. It has been used in spam email campaigns to deliver additional malware such as [Cobalt Strike](https://attack.mitre.org/software/S0154) and the [QakBot](https://attack.mitre.org/software/S0650) banking trojan.(Citation: ZScaler Squirrelwaffle Sep 2021)(Citation: Netskope Squirrelwaffle Oct 2021)
Executive priority
S1030: Squirrelwaffle is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate S1030: Squirrelwaffle by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
- Network, endpoint, and security-tool telemetry
Detection direction
- Validate whether S1030: Squirrelwaffle appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Squirrelwaffle
Squirrelwaffle is a loader that was first seen in September 2021. It has been used in spam email campaigns to deliver additional malware such as Cobalt Strike and the QakBot banking trojan.[1][2]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1033 | System Owner/User Discovery | Squirrelwaffle can collect the user name from a compromised host.[1] |
| Enterprise | T1059.005 | Visual BasicSub-technique | Squirrelwaffle has used malicious VBA macros in Microsoft Word documents and Excel spreadsheets that execute an `AutoOpen` subroutine.[1][2] |
| Enterprise | T1082 | System Information Discovery | Squirrelwaffle has gathered victim computer information and configurations.[1] |
| Enterprise | T1041 | Exfiltration Over C2 Channel | Squirrelwaffle has exfiltrated victim data using HTTP POST requests to its C2 servers.[1] |
| Enterprise | T1566.002 | Spearphishing LinkSub-technique | Squirrelwaffle has been distributed through phishing emails containing a malicious URL.[1] |
| Enterprise | T1218.010 | Regsvr32Sub-technique | Squirrelwaffle has been executed using `regsvr32.exe`.[1] |
| Enterprise | T1140 | Deobfuscate/Decode Files or Information | Squirrelwaffle has decrypted files and payloads using a XOR-based algorithm.[1][2] |
| Enterprise | T1204.001 | Malicious LinkSub-technique | Squirrelwaffle has relied on victims to click on a malicious link send via phishing campaigns.[1] |
| Enterprise | T1105 | Ingress Tool Transfer | Squirrelwaffle has downloaded and executed additional encoded payloads.[1][2] |
| Enterprise | T1566.001 | Spearphishing AttachmentSub-technique | Squirrelwaffle has been distributed via malicious Microsoft Office documents within spam emails.[2] |
| Enterprise | T1132.001 | Standard EncodingSub-technique | Squirrelwaffle has encoded its communications to C2 servers using Base64.[1] |
| Enterprise | T1071.001 | Web ProtocolsSub-technique | Squirrelwaffle has used HTTP POST requests for C2 communications.[1] |
| Enterprise | T1204.002 | Malicious FileSub-technique | Squirrelwaffle has relied on users enabling malicious macros within Microsoft Excel and Word attachments.[1][2] |
| Enterprise | T1027.013 | Encrypted/Encoded FileSub-technique | Squirrelwaffle has been obfuscated with a XOR-based algorithm.[1][2] |
| Enterprise | T1027.002 | Software PackingSub-technique | Squirrelwaffle has been packed with a custom packer to hide payloads.[1][2] |
| Enterprise | T1560.003 | Archive via Custom MethodSub-technique | Squirrelwaffle has encrypted collected data using a XOR-based algorithm.[1] |
| Enterprise | T1059.001 | PowerShellSub-technique | Squirrelwaffle has used PowerShell to execute its payload.[1][2] |
| Enterprise | T1059.003 | Windows Command ShellSub-technique | Squirrelwaffle has used `cmd.exe` for execution.[2] |
| Enterprise | T1497 | Virtualization/Sandbox Evasion | Squirrelwaffle has contained a hardcoded list of IP addresses to block that belong to sandboxes and analysis platforms.[1][2] |
| Enterprise | T1218.011 | Rundll32Sub-technique | Squirrelwaffle has been executed using `rundll32.exe`.[1][2] |
| Enterprise | T1016 | System Network Configuration Discovery | Squirrelwaffle has collected the victim’s external IP address.[1] |
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(2)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.2 | 1.1 | Current bundle | f2d18944fcba… | ||
| 19.1 | 1.1 | Older bundle | f2d18944fcba… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]ZScaler Squirrelwaffle Sep 2021
Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.
Open source URL - [2]Netskope Squirrelwaffle Oct 2021
Palazolo, G. (2021, October 7). SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot. Retrieved August 9, 2022.
Open source URL - [3]mitre-attackS1030Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.