HTRAN

MITRE ATT&CK: S0040 View on attack.mitre.org

Aliases: HUC Packet Transmit Tool, lcx, HTRAN

First seen
2010-01-01 00:00:00
Family
Malware family
Operating systems
linux, windows
Related IoCs
2 (2 malicious)
Last IoC activity
2025-12-09 12:09:23
Profile updated
2026-07-07 15:45:32

Context

HTRAN is a tool that proxies connections through intermediate hops and aids users in disguising their true geographical location. It can be used by adversaries to hide their location when interacting with the victim networks.

Recent IoC activity

2 malicious indicators in Maltiverse are attributed to HTRAN (S0040). The 2 most recently updated:

TypeIndicatorUpdatedSources
file sample f3fa7272169d1ac6c6f88ed3cfb90c76d59d2cfaac8f2df4fc4b53e8e6942911 2025-12-09 1
file sample 35a36514a67027979707cfda413c79d1c174f1303edd1aeaa3df76b84a3f4174 2025-12-09 1

Detection coverage

  • 2 YARA rules
  • 47 Sigma rules

Malware & tools used

  • Proxy (attack-pattern)
  • Rootkit (attack-pattern)
  • Process Injection (attack-pattern)

Used by threat actors

Detection rules

  • MALPEDIA_Win_Htran_Auto (yara-rule)
  • SEKOIA_Tool_Htran_Strings (yara-rule)

Reports & references

  • secureworks.com — Bronze Mayfair (report)
  • secureworks.com — Bronze Atlas (report)
  • cybereason.com — Operation Soft Cell A Worldwide Campaign Against Telecommunications Providers (report)
  • Microsoft — Gallium Targeting Global Telecom (report)
  • web.archive.org — Wp Operation Quantum Entanglement (report)
  • Mandiant — Cds19 Executive S08 Achievement Unlocked (report)
  • ESET — No Game Over Winnti Group (report)
  • adeo.com.tr — Apt10 Report (report)
  • Mandiant — Proxyshell Exploiting Microsoft Exchange Servers (report)
  • lab52.io — The Energy Reserves In The Eastern Mediterranean Sea And A Malicious Campaign Of Apt10 Against Turkey (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Htran (report)
  • synacktiv.com — Open Source Toolset Of An Ivanti Csa Attacker (report)
  • Trend Micro — In Depth Look Apt Attack Tools Of The Trade (report)
  • secureworks.com — Htran (report)
  • Cisco Talos — New Zardoor Backdoor (report)
  • ncsc.gov.uk — Joint Report On Publicly Available Hacking Tools (report)
  • MITRE ATT&CK — S0040 (report)

External references