Volgmer

MITRE ATT&CK: S0180 View on attack.mitre.org

Aliases: FALLCHILL, Manuscrypt, Volgmer

First seen
2013-01-01 00:00:00
Malware type
backdoor, trojan
Family
Malware family
Operating systems
windows
Related IoCs
1 (1 malicious)
Last IoC activity
2026-09-24 01:13:39
Profile updated
2026-07-07 15:43:53

Targeted industries: financial-services government-and-public-sector media-and-entertainment manufacturing

Context

Volgmer is a backdoor Trojan designed to provide covert access to a compromised system. It has been used since at least 2013 to target the government, financial, automotive, and media industries. Its primary delivery mechanism is suspected to be spearphishing.

Recent IoC activity

1 malicious indicator in Maltiverse are attributed to Volgmer (S0180). The 1 most recently updated:

TypeIndicatorUpdatedSources
file sample edd2aff8fad0c76021adc74fe3cb3cb1a02913a839ad0f2cf31fdea8b5aa8195 2026-09-24 2

Detection coverage

  • 1 YARA rules
  • 345 Sigma rules

Malware & tools used

  • File and Directory Discovery (attack-pattern)
  • Windows Service (attack-pattern)
  • Query Registry (attack-pattern)
  • System Information Discovery (attack-pattern)
  • Native API (attack-pattern)
  • Symmetric Cryptography (attack-pattern)
  • System Service Discovery (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Process Discovery (attack-pattern)
  • System Network Configuration Discovery (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • Asymmetric Cryptography (attack-pattern)
  • Fileless Storage (attack-pattern)
  • Modify Registry (attack-pattern)
  • Masquerade Task or Service (attack-pattern)
  • Encrypted/Encoded File (attack-pattern)
  • System Network Connections Discovery (attack-pattern)
  • File Deletion (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)

Used by threat actors

Detection rules

  • SEKOIA_Backdoor_Win_Volgmer (yara-rule)

Related threat objects

Reports & references

  • us-cert.gov — Ta17 318B (report)
  • Kaspersky — 87553 (report)
  • Kaspersky — 97937 (report)
  • ti.qianxin.com — Cb78386A082F465F259B37Dae5Df4884 (report)
  • blog.lexfo.fr — Lexfo Whitepaper The Lazarus Constellation (report)
  • Kaspersky — 100803 (report)
  • asec.ahnlab.com — 57685 (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Volgmer (report)
  • lifars.com — Lazarus (report)
  • drive.google.com — View (report)
  • drive.google.com — View (report)
  • medium.com — Analysis Of Threatneedle C C Communication Feat Google Tag Warning To Researchers 782Aa51Cf74 (report)
  • MITRE ATT&CK — S0180 (report)
  • web.archive.org — 2014 081811 3237 99 (report)
  • us-cert.gov — Mar 10135536 D White S508C (report)
  • wiz.io — North Korean Tradertraitor Crypto Heist (report)
  • Kaspersky — 109490 (report)
  • asec.ahnlab.com — 56256 (report)
  • asec.ahnlab.com — 56405 (report)
  • secureworks.com — Nickel Academy (report)

External references