S1081: BADHATCH

S1081: BADHATCH describes [BADHATCH](https://attack.mitre.org/software/S1081) is a backdoor that has been utilized by [FIN8](https://attack.mitre.org/groups/G0061) since at least 2019. [BADHATCH](https://attack.mitre.org/software/S1081) has been used to target the insurance, retail, technology, and chemical industries in the United States, Canada, South Africa, Panama, and Italy.(Citation: Gigamon BADHATCH Jul 2019)(Citation: BitDefender BADHATCH Mar 2021)

Executive priority

S1081: BADHATCH is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S1081: BADHATCH by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata
Network, endpoint, and security-tool telemetry

Detection direction

Validate whether S1081: BADHATCH appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

BADHATCH

BADHATCH is a backdoor that has been utilized by FIN8 since at least 2019. BADHATCH has been used to target the insurance, retail, technology, and chemical industries in the United States, Canada, South Africa, Panama, and Italy.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques35 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1135	Network Share Discovery	BADHATCH can check a user's access to the C$ share on a compromised machine.[2]
Enterprise	T1620	Reflective Code Loading	BADHATCH can copy a large byte array of 64-bit shellcode into process memory and execute it with a call to `CreateThread`.[1]
Enterprise	T1059.001	PowerShellSub-technique	BADHATCH can utilize `powershell.exe` to execute commands on a compromised host.[1][2]
Enterprise	T1055	Process Injection	BADHATCH can inject itself into an existing explorer.exe process by using `RtlCreateUserThread`.[1][2]
Enterprise	T1018	Remote System Discovery	BADHATCH can use a PowerShell object such as, `System.Net.NetworkInformation.Ping` to ping a computer.[2]
Enterprise	T1057	Process Discovery	BADHATCH can retrieve a list of running processes from a compromised machine.[2]
Enterprise	T1082	System Information Discovery	BADHATCH can obtain current system information from a compromised machine such as the `SHELL PID`, `PSVERSION`, `HOSTNAME`, `LOGONSERVER`, `LASTBOOTUP`, OS type/version, bitness, and hostname.[1][2]
Enterprise	T1113	Screen Capture	BADHATCH can take screenshots and send them to an actor-controlled C2 server.[2]
Enterprise	T1027.009	Embedded PayloadsSub-technique	BADHATCH has an embedded second stage DLL payload within the first stage of the malware.[1]
Enterprise	T1124	System Time Discovery	BADHATCH can obtain the `DATETIME` and `UPTIME` from a compromised machine.[2]
Enterprise	T1053.005	Scheduled TaskSub-technique	BADHATCH can use `schtasks.exe` to gain persistence.[2]
Enterprise	T1027.010	Command ObfuscationSub-technique	BADHATCH malicious PowerShell commands can be encoded with base64.[2]
Enterprise	T1071.001	Web ProtocolsSub-technique	BADHATCH can use HTTP and HTTPS over port 443 to communicate with actor-controlled C2 servers.[1][2]
Enterprise	T1033	System Owner/User Discovery	BADHATCH can obtain logged user information from a compromised machine and can execute the command `whoami.exe`.[2]
Enterprise	T1090	Proxy	BADHATCH can use SOCKS4 and SOCKS5 proxies to connect to actor-controlled C2 servers. BADHATCH can also emulate a reverse proxy on a compromised machine to connect with actor-controlled C2 servers.[2]
Enterprise	T1106	Native API	BADHATCH can utilize Native API functions such as, `ToolHelp32` and `Rt1AdjustPrivilege` to enable `SeDebugPrivilege` on a compromised machine.[1]
Enterprise	T1055.001	Dynamic-link Library InjectionSub-technique	BADHATCH has the ability to execute a malicious DLL by injecting into `explorer.exe` on a compromised machine.[1]
Enterprise	T1046	Network Service Discovery	BADHATCH can check for open ports on a computer by establishing a TCP connection.[2]
Enterprise	T1105	Ingress Tool Transfer	BADHATCH has the ability to load a second stage malicious DLL file onto a compromised machine.[1]
Enterprise	T1573.002	Asymmetric CryptographySub-technique	BADHATCH can beacon to a hardcoded C2 IP address using TLS encryption every 5 minutes.[1]
Enterprise	T1027.015	CompressionSub-technique	BADHATCH can be compressed with the ApLib algorithm.[2]
Enterprise	T1102	Web Service	BADHATCH can be utilized to abuse `sslip.io`, a free IP to domain mapping service, as part of actor-controlled C2 channels.[2]
Enterprise	T1070.004	File DeletionSub-technique	BADHATCH has the ability to delete PowerShell scripts from a compromised machine.[1]
Enterprise	T1546.003	Windows Management Instrumentation Event SubscriptionSub-technique	BADHATCH can use WMI event subscriptions for persistence.[2]
Enterprise	T1069.002	Domain GroupsSub-technique	BADHATCH can use `net.exe group "domain admins" /domain` to identify Domain Administrators.[2]
Enterprise	T1550.002	Pass the HashSub-technique	BADHATCH can perform pass the hash on compromised machines with x64 versions.[2]
Enterprise	T1482	Domain Trust Discovery	BADHATCH can use `nltest.exe /domain_trusts` to discover domain trust relationships on a compromised machine.[2]
Enterprise	T1059.003	Windows Command ShellSub-technique	BADHATCH can use `cmd.exe` to execute commands on a compromised host.[1][2]
Enterprise	T1071.002	File Transfer ProtocolsSub-technique	BADHATCH can emulate an FTP server to connect to actor-controlled C2 servers.[2]
Enterprise	T1047	Windows Management Instrumentation	BADHATCH can utilize WMI to collect system information, create new processes, and run malicious PowerShell scripts on a compromised machine.[1][2]
Enterprise	T1548.002	Bypass User Account ControlSub-technique	BADHATCH can utilize the CMSTPLUA COM interface and the SilentCleanup task to bypass UAC.[2]
Enterprise	T1055.004	Asynchronous Procedure CallSub-technique	BADHATCH can inject itself into a new `svchost.exe -k netsvcs` process using the asynchronous procedure call (APC) queue.[1][2]
Enterprise	T1134.001	Token Impersonation/TheftSub-technique	BADHATCH can impersonate a `lsass.exe` or `vmtoolsd.exe` token.[2]
Enterprise	T1049	System Network Connections Discovery	BADHATCH can execute `netstat.exe -f` on a compromised machine.[2]
Enterprise	T1041	Exfiltration Over C2 Channel	BADHATCH can exfiltrate data over the C2 channel.[1][2]

Associated objects

Groups, software, and campaigns

G0061: FIN8

FIN8 is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology, chemical, and financial sectors. In June 2021, security researchers detected FIN8 switching from targeting point-of-sale (POS) devices to distributing a number of ransomware variants.[1][2][3][4]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.2
Object version: 1.1
Created: Aug 1, 2023, 18:07 UTC (UTC+00:00)
Modified: Apr 11, 2024, 02:55 UTC (UTC+00:00)
Raw hash: 7adec98982ef0d28...

Imported snapshots across ATT&CK releases(2)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	1.1	Apr 11, 2024, 02:55 UTC (UTC+00:00)	Current bundle	`7adec98982ef…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.1	Apr 11, 2024, 02:55 UTC (UTC+00:00)	Older bundle	`7adec98982ef…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Gigamon BADHATCH Jul 2019
Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.
Open source URL
[2]
BitDefender BADHATCH Mar 2021
Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.
Open source URL
[3]
mitre-attackS1081
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use