NetTraveler
MITRE ATT&CK: S0033 View on attack.mitre.org
Aliases: TravNet, NetTraveler
- First seen
- 2005-01-01 00:00:00
- Malware type
- spyware, backdoor
- Family
- Malware family
- Operating systems
- windows
- Related IoCs
- 4 (3 malicious)
- Last IoC activity
- 2026-10-13 05:52:48
- Profile updated
- 2026-07-07 15:44:16
Targeted industries: government-and-public-sector technology-and-telecommunications energy-and-utilities education-and-nonprofits financial-services
Targeted regions: country_code:cn country_code:ru country_code:kz country_code:in country_code:ir
Context
NetTraveler is malware that has been used in multiple cyber espionage campaigns for basic surveillance of victims. The earliest known samples have timestamps back to 2005, and the largest number of observed samples were created between 2010 and 2013.
Recent IoC activity
3 malicious indicators in Maltiverse are attributed to NetTraveler (S0033). The 3 most recently updated:
| Type | Indicator | Updated | Sources |
|---|---|---|---|
| file sample | 4ea71393d138924dcc70713ba4095357f39d4382d73cb17f33686082e0cd60fd | 2026-10-12 | 1 |
| file sample | XMOS-Stereo-USB-Audio-Class2-Driver-3033_v4.13.0.exe | 2026-10-08 | 1 |
| file sample | BEHRINGER_UMC_v4.59.0_2019-03-14_setup.exe | 2026-09-27 | 1 |
Detection coverage
- 1 YARA rules
- 4 Sigma rules
Malware & tools used
- Application Window Discovery (attack-pattern)
- Keylogging (attack-pattern)
Used by threat actors
- TA459 (threat-actor)
Detection rules
- MALPEDIA_Win_Nettraveler_Auto (yara-rule)
Reports & references
- media.kasperskycontenthub.com — Guerrero Saade Raiu Vb2017 (report)
- proofpoint.com — Nettraveler Apt Targets Russian European Interests (report)
- web.archive.org — Globalthreatintelreport (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Nettraveler (report)
- cybergeeks.tech — Dissecting Apt21 Samples Using A Step By Step Approach (report)
- MITRE ATT&CK — S0033 (report)
- web.archive.org — Kaspersky The Net Traveler Part1 Final (report)