Sliver
MITRE ATT&CK: S0633 View on attack.mitre.org
Aliases: Sliver
- Malware type
- rat
- Family
- Malware family
- Operating systems
- windows, linux, macos
- Related IoCs
- 4819 (942 malicious)
- Last IoC activity
- 2026-10-18 03:09:46
- Profile updated
- 2026-07-07 13:03:22
Targeted industries: government-and-public-sector technology-and-telecommunications financial-services
Context
Sliver is an open source, cross-platform, red team command and control (C2) framework written in Golang. Sliver includes its own package manager, "armory," for staging and downloading additional tools and payloads to the primary C2 framework.
Recent IoC activity
941 malicious indicators in Maltiverse are attributed to Sliver (S0633). The 20 most recently updated:
Detection coverage
- 7 YARA rules
- 602 Sigma rules
Malware & tools used
- Obfuscated Files or Information (attack-pattern)
- Process Injection (attack-pattern)
- File and Directory Discovery (attack-pattern)
- Compile After Delivery (attack-pattern)
- Steganography (attack-pattern)
- Access Token Manipulation (attack-pattern)
- PowerShell (attack-pattern)
- DNS (attack-pattern)
- Encrypted/Encoded File (attack-pattern)
- Asymmetric Cryptography (attack-pattern)
- Internal Proxy (attack-pattern)
- System Network Configuration Discovery (attack-pattern)
- Screen Capture (attack-pattern)
- Web Protocols (attack-pattern)
- Ingress Tool Transfer (attack-pattern)
- Symmetric Cryptography (attack-pattern)
- Application Layer Protocol (attack-pattern)
- Golden Ticket (attack-pattern)
- Exfiltration Over C2 Channel (attack-pattern)
- Bypass User Account Control (attack-pattern)
- Standard Encoding (attack-pattern)
- LSASS Memory (attack-pattern)
- System Network Connections Discovery (attack-pattern)
Used by threat actors
- C0018 (campaign)
- Cinnamon Tempest (threat-actor)
- APT29 (threat-actor)
- TA551 (threat-actor)
- German Entity Sliver Implant Targeting (campaign)
Detection rules
- GCTI_Sliver_Implant_64Bit (yara-rule)
- SIGNATURE_BASE_Sliver_Implant_32Bit_1 (yara-rule)
- SIGNATURE_BASE_Sliver_Implant_64Bit_1 (yara-rule)
- DITEKSHEN_INDICATOR_TOOL_Sliver (yara-rule)
- SEKOIA_Implant_Win_Sliver_Dll (yara-rule)
- SEKOIA_Implant_Any_Sliver (yara-rule)
- SEKOIA_Implant_Any_Sliver_Not_Stripped (yara-rule)
Reports & references
- asec.ahnlab.com — 56941 (report)
- volexity.com — Driftingcloud Zero Day Sophos Firewall Exploitation And An Insidious Breach (report)
- MITRE ATT&CK — G1021 (report)
- intel471.com — Malware Before Ransomware Trojan Information Stealer Cobalt Strike (report)
- spamhaus.org — Botnet Threat Update January To June 2025 (report)
- info.spamhaus.com — Jul Dec%202024%20Botnet%20Threat%20Update (report)
- spamhaus.org — Botnet Threat Update July To December 2025 (report)
- info.spamhaus.com — Jan Jun%202024%20Botnet%20Threat%20Update (report)
- blog.cluster25.duskrise.com — Russian Apt Opposition (report)
- blog.sekoia.io — Exposing Fakebat Loader Distribution Methods And Adversary Infrastructure (report)
- global.ptsecurity.com — Dragons In Thunder (report)
- sysdig.com — Unc5174 Chinese Threat Actor Vshell (report)
- info.spamhaus.com — 2023%20Q2%20Botnet%20Threat%20Update (report)
- info.spamhaus.com — 2023%20Q3%20Botnet%20Threat%20Update (report)
- info.spamhaus.com — Q4%202023%20Botnet%20Threat%20Update (report)
- info.spamhaus.com — 2023%20Q1%20Botnet%20Threat%20Update (report)
- embeeresearch.io — Shodan Censys Queries (report)
- embee-research.ghost.io — Shodan Censys Queries (report)
- jsac.jpcert.or.jp — Jsac2024 1 9 Takeda Furukawa En (report)
- insights.bridewell.com — Cyber%20Threat%20Intelligence%20Report%202025 (report)
- github.com — Gcti (report)
- harfanglab.io — Supposed Grasshopper Operators Impersonate Israeli Gov Private Companies Deploy Open Source Malware (report)
- Palo Alto Unit 42 — North Korean Threat Group Play Ransomware (report)
- seqrite.com — Operation Oxidovy Sophisticated Malware Campaign Targets Czech Officials Using Nato Themed Decoys (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Sliver (report)