WellMail
MITRE ATT&CK: S0515 View on attack.mitre.org
Aliases: WellMail
- First seen
- 2020-07-01 00:00:00
- Malware type
- backdoor, spyware
- Family
- Malware family
- Operating systems
- windows
- Profile updated
- 2026-07-07 12:59:14
Targeted industries: government-and-public-sector healthcare-and-pharmaceutical technology-and-telecommunications
Targeted regions: country_code:us country_code:gb country_code:ca
Context
WellMail is a lightweight malware written in Golang used by APT29, similar in design and structure to WellMess.
Detection coverage
- 144 Sigma rules
Malware & tools used
- Ingress Tool Transfer (attack-pattern)
- Non-Standard Port (attack-pattern)
- Archive Collected Data (attack-pattern)
- Non-Application Layer Protocol (attack-pattern)
- System Owner/User Discovery (attack-pattern)
- System Network Configuration Discovery (attack-pattern)
- Deobfuscate/Decode Files or Information (attack-pattern)
- Asymmetric Cryptography (attack-pattern)
- Data from Local System (attack-pattern)
Used by threat actors
- APT29 (threat-actor)
Reports & references
- intezer.com — Top Linux Cloud Threats Of 2020 (report)
- ncsc.gov.uk — Advisory Apt29 Targets Covid 19 Vaccine Development V1 1 (report)
- intezer.com — Intezer 2020 Go Malware Round Up (report)
- malpedia.caad.fkie.fraunhofer.de — Elf.Wellmail (report)
- Kaspersky — 99204 (report)
- ncsc.gov.uk — Advisory Apt29 Targets Covid 19 Vaccine Development (report)
- Cisco Talos — Attribution Puzzle (report)
- ironnet.com — Russian Cyber Attack Campaigns And Actors (report)
- pwc.co.uk — Wellmail (report)
- CISA — Ar20 198C (report)
- MITRE ATT&CK — S0515 (report)