WellMess

MITRE ATT&CK: S0514 View on attack.mitre.org

Aliases: WellMess

First seen
2018-07-01 00:00:00
Malware type
backdoor, rat, trojan
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 12:37:18

Targeted industries: government-and-public-sector technology-and-telecommunications healthcare-and-pharmaceutical

Targeted regions: country_code:us country_code:jp country_code:gb

Context

WellMess is lightweight malware family with variants written in .NET and Golang that has been in use since at least 2018 by APT29.

Detection coverage

  • 1 YARA rules
  • 430 Sigma rules

Malware & tools used

  • System Owner/User Discovery (attack-pattern)
  • PowerShell (attack-pattern)
  • Data from Local System (attack-pattern)
  • DNS (attack-pattern)
  • System Information Discovery (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Asymmetric Cryptography (attack-pattern)
  • Standard Encoding (attack-pattern)
  • Symmetric Cryptography (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • Domain Groups (attack-pattern)
  • System Network Configuration Discovery (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • Web Protocols (attack-pattern)
  • Junk Data (attack-pattern)

Used by threat actors

Detection rules

  • DITEKSHEN_MALWARE_Multi_Wellmess (yara-rule)

Reports & references

  • pwc.co.uk — Pwc Cyber Threats 2020 A Year In Retrospect (report)
  • Kaspersky — 97937 (report)
  • ncsc.gov.uk — Advisory Apt29 Targets Covid 19 Vaccine Development V1 1 (report)
  • pwc.co.uk — Cleaning Up After Wellmess (report)
  • intezer.com — Intezer 2020 Go Malware Round Up (report)
  • ncsc.gov.uk — Advisory Apt29 Targets Covid 19 Vaccine Development (report)
  • Cisco Talos — Attribution Puzzle (report)
  • ironnet.com — Russian Cyber Attack Campaigns And Actors (report)
  • CISA — Aa21 116A (report)
  • CISA — Aa21 116A Russian Foreign Intelligence Service Cyber Operations 508C (report)
  • botconf.eu — 2018 Y Ishikawa S Nagano Lets Go With A Go Rat Final (report)
  • blogs.jpcert.or.jp — Malware Wellmes 9B78 (report)
  • blackberry.com — Report Old Dogs New Tricks (report)
  • community.riskiq.com — Description (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Wellmess (report)
  • censys.com — Advanced Persistent Infrastructure Tracking (report)
  • CISA — Ar20 198B (report)
  • blog.jpcert.or.jp — Malware Wellmes 9B78 (report)
  • lac.co.jp — 20180614 Cecreport Vol3 (report)
  • MITRE ATT&CK — S0514 (report)

External references