Kevin

MITRE ATT&CK: S1020 View on attack.mitre.org

Aliases: Kevin

First seen
2020-06-01 00:00:00
Malware type
backdoor
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 12:56:44

Targeted industries: energy-and-utilities

Targeted regions: country_code:tn

Context

Kevin is a backdoor implant written in C++ that has been used by HEXANE since at least June 2020, including in operations against organizations in Tunisia.

Detection coverage

  • 296 Sigma rules

Malware & tools used

  • DNS (attack-pattern)
  • Hidden Window (attack-pattern)
  • System Network Configuration Discovery (attack-pattern)
  • Standard Encoding (attack-pattern)
  • System Information Discovery (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Exfiltration Over C2 Channel (attack-pattern)
  • Protocol Tunneling (attack-pattern)
  • Data Transfer Size Limits (attack-pattern)
  • File Deletion (attack-pattern)
  • Web Protocols (attack-pattern)
  • Native API (attack-pattern)
  • Data from Local System (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • Junk Data (attack-pattern)
  • Encrypted/Encoded File (attack-pattern)
  • Data Staged (attack-pattern)
  • Windows Management Instrumentation Event Subscription (attack-pattern)
  • Fallback Channels (attack-pattern)
  • Virtualization/Sandbox Evasion (attack-pattern)
  • Rename Legitimate Utilities (attack-pattern)

Used by threat actors

Reports & references

  • vblocalhost.com — Vb2021 Kayal Etal (report)
  • MITRE ATT&CK — S1020 (report)

External references