Description
[WellMess](https://attack.mitre.org/software/S0514) is lightweight malware family with variants written in .NET and Golang that has been in use since at least 2018 by [APT29](https://attack.mitre.org/groups/G0016).(Citation: CISA WellMess July 2020)(Citation: PWC WellMess July 2020)(Citation: NCSC APT29 July 2020)
External References
Techniques Used by This Malware
- T1001.001 — Junk Data
- T1005 — Data from Local System
- T1016 — System Network Configuration Discovery
- T1033 — System Owner/User Discovery
- T1059.001 — PowerShell
- T1059.003 — Windows Command Shell
- T1069.002 — Domain Groups
- T1071.001 — Web Protocols
- T1071.004 — DNS
- T1082 — System Information Discovery
- T1105 — Ingress Tool Transfer
- T1132.001 — Standard Encoding
- T1140 — Deobfuscate/Decode Files or Information
- T1573.001 — Symmetric Cryptography
- T1573.002 — Asymmetric Cryptography