Micropsia

MITRE ATT&CK: S0339 View on attack.mitre.org

Aliases: Micropsia

First seen
2017-07-01 00:00:00
Malware type
rat
Family
Malware family
Operating systems
windows
Last IoC activity
2026-07-20 17:17:57
Profile updated
2026-07-07 12:51:56

Targeted industries: government-and-public-sector technology-and-telecommunications media-and-entertainment

Targeted regions: country_code:il country_code:us

Context

Micropsia is a remote access tool written in Delphi.

Detection coverage

  • 310 Sigma rules

Malware & tools used

  • Automated Collection (attack-pattern)
  • Security Software Discovery (attack-pattern)
  • Keylogging (attack-pattern)
  • File and Directory Discovery (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • Shortcut Modification (attack-pattern)
  • System Owner/User Discovery (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Archive via Utility (attack-pattern)
  • Web Protocols (attack-pattern)
  • Encrypted/Encoded File (attack-pattern)
  • Screen Capture (attack-pattern)
  • Audio Capture (attack-pattern)
  • Hidden Files and Directories (attack-pattern)
  • Windows Management Instrumentation (attack-pattern)
  • System Information Discovery (attack-pattern)

Used by threat actors

Reports & references

  • Cisco Talos — Palestine Delphi (report)
  • sentinelone.com — Gaza Cybergang Unified Front Targeting Hamas Opposition (report)
  • research.checkpoint.com — Apt Attack Middle East Big Bang (report)
  • Cisco Talos — Palestine Delphi (report)
  • about.fb.com — Technical Threat Report Arid Viper April 2021 (report)
  • Broadcom/Symantec — Mantis Palestinian Attacks (report)
  • researchcenter.paloaltonetworks.com — Unit42 Targeted Attacks Middle East Using Kasperagent Micropsia (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Micropsia (report)
  • Cisco Talos — Arid Viper Targets Palestine (report)
  • github.com — Micropsia Apt C 23.Md (report)
  • MITRE ATT&CK — S0339 (report)
  • radware.com — Micropsia Malware (report)

External references