HAMMERTOSS

MITRE ATT&CK: S0037 View on attack.mitre.org

Aliases: HammerDuke, NetDuke, HAMMERTOSS

First seen
2015-01-01 00:00:00
Malware type
backdoor
Family
Malware family
Operating systems
windows
Last IoC activity
2026-07-17 17:16:23
Profile updated
2026-07-07 12:43:28

Targeted industries: government-and-public-sector technology-and-telecommunications

Targeted regions: country_code:us country_code:ca country_code:uk

Context

HAMMERTOSS is a backdoor that was used by APT29 in 2015.

Detection coverage

  • 233 Sigma rules

Malware & tools used

  • Exfiltration to Cloud Storage (attack-pattern)
  • Steganography (attack-pattern)
  • Hidden Window (attack-pattern)
  • Symmetric Cryptography (attack-pattern)
  • Web Protocols (attack-pattern)
  • PowerShell (attack-pattern)
  • One-Way Communication (attack-pattern)

Used by threat actors

Reports & references

  • Mandiant — Rpt Apt29 Hammertoss (report)
  • f-secure.com — Dukes Whitepaper (report)
  • mrtiepolo.medium.com — Sophisticated Apt29 Campaign Abuses Notion Api To Target The European Commission 200188059F58 (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Tdiscoverer (report)
  • youtube.com — Watch (report)
  • securityintelligence.com — Hammertoss What Me Worry (report)
  • MITRE ATT&CK — S0037 (report)
  • services.google.com — Rpt Apt29 Hammertoss Stealthy Tactics Define En (report)

External references