Mosquito

MITRE ATT&CK: S0256 View on attack.mitre.org

Aliases: Mosquito

First seen
2017-01-01 00:00:00
Malware type
backdoor, loader
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 12:43:49

Targeted industries: government-and-public-sector energy-and-utilities

Targeted regions: country_code:us country_code:de country_code:fr country_code:ru

Context

Mosquito is a Win32 backdoor that has been used by Turla. Mosquito is made up of three parts: the installer, the launcher, and the backdoor. The main backdoor is called CommanderDLL and is launched by the loader program.

Detection coverage

  • 2 YARA rules
  • 543 Sigma rules

Malware & tools used

  • Windows Management Instrumentation (attack-pattern)
  • System Owner/User Discovery (attack-pattern)
  • Rundll32 (attack-pattern)
  • File Deletion (attack-pattern)
  • Symmetric Cryptography (attack-pattern)
  • Security Software Discovery (attack-pattern)
  • PowerShell (attack-pattern)
  • Modify Registry (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Component Object Model Hijacking (attack-pattern)
  • Encrypted/Encoded File (attack-pattern)
  • Process Discovery (attack-pattern)
  • System Network Configuration Discovery (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • Registry Run Keys / Startup Folder (attack-pattern)
  • Native API (attack-pattern)
  • Fileless Storage (attack-pattern)

Used by threat actors

Detection rules

  • SIGNATURE_BASE_APT_Turlamosquito_MAL_Oct22_1 (yara-rule)
  • MALPEDIA_Win_Mosquito_Auto (yara-rule)

Reports & references

  • ESET — Turla Mosquito Shift Towards Generic Tools (report)
  • secureworks.com — Iron Hunter (report)
  • ESET — Eset Turla Mosquito (report)
  • go.recordedfuture.com — Cta 2020 0312 (report)
  • Kaspersky — 88069 (report)
  • cocomelonc.github.io — Malware Pers 3 (report)
  • ESET — Tracking Turla New Backdoor Armenian Watering Holes (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Mosquito (report)
  • recordedfuture.com — Turla Apt Infrastructure (report)
  • MITRE ATT&CK — S0256 (report)

External references