Comnie
MITRE ATT&CK: S0244 View on attack.mitre.org
Aliases: Comnie
- First seen
- 2014-01-01 00:00:00
- Malware type
- backdoor
- Family
- Malware family
- Operating systems
- windows
- Profile updated
- 2026-07-07 15:30:51
Targeted industries: government-and-public-sector
Targeted regions: country_code:cn
Context
Comnie is a remote backdoor which has been used in attacks in East Asia.
Detection coverage
- 336 Sigma rules
Malware & tools used
- System Service Discovery (attack-pattern)
- Automated Collection (attack-pattern)
- Security Software Discovery (attack-pattern)
- Windows Command Shell (attack-pattern)
- Bidirectional Communication (attack-pattern)
- Process Discovery (attack-pattern)
- System Network Configuration Discovery (attack-pattern)
- Local Account (attack-pattern)
- System Network Connections Discovery (attack-pattern)
- Remote System Discovery (attack-pattern)
- Shortcut Modification (attack-pattern)
- Web Protocols (attack-pattern)
- Visual Basic (attack-pattern)
- Symmetric Cryptography (attack-pattern)
- System Information Discovery (attack-pattern)
- Rundll32 (attack-pattern)
- Registry Run Keys / Startup Folder (attack-pattern)
- Binary Padding (attack-pattern)
- Obfuscated Files or Information (attack-pattern)
Reports & references
- MITRE ATT&CK — S0244 (report)
- researchcenter.paloaltonetworks.com — Unit42 Comnie Continues Target Organizations East Asia (report)
- exchange.xforce.ibmcloud.com — East Asia Organizations Victims Of Comnie Attack 12749A9Dbc20E2F40B3Ae99C43416D8C (report)