Small Sieve

MITRE ATT&CK: S1035 View on attack.mitre.org

Aliases: GRAMDOOR, Small Sieve

First seen
2022-01-01 00:00:00
Malware type
backdoor
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 13:22:48

Targeted industries: government-and-public-sector financial-services technology-and-telecommunications

Targeted regions: country_code:sa country_code:ir country_code:tr

Context

Small Sieve is a Telegram Bot API-based Python backdoor that has been distributed using a Nullsoft Scriptable Install System (NSIS) Installer; it has been used by MuddyWater since at least January 2022. Security researchers have also noted Small Sieve's use by UNC3313, which may be associated with MuddyWater.

Detection coverage

  • 305 Sigma rules

Malware & tools used

  • Windows Command Shell (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Non-Standard Encoding (attack-pattern)
  • Execution Guardrails (attack-pattern)
  • System Network Configuration Discovery (attack-pattern)
  • Asymmetric Cryptography (attack-pattern)
  • Python (attack-pattern)
  • Registry Run Keys / Startup Folder (attack-pattern)
  • Match Legitimate Resource Name or Location (attack-pattern)
  • Obfuscated Files or Information (attack-pattern)
  • System Owner/User Discovery (attack-pattern)
  • Bidirectional Communication (attack-pattern)
  • Web Protocols (attack-pattern)

Used by threat actors

Reports & references

  • CISA — Aa22 055A (report)
  • CISA — Aa22 055A Iranian Government Sponsored Actors Conduct Cyber Operations (report)
  • inforisktoday.com — Muddywater Targets Critical Infrastructure In Asia Europe A 18611 (report)
  • thehackernews.com — Irans Muddywater Hacker Group Using New (report)
  • Mandiant — Telegram Malware Iranian Espionage (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Gramdoor (report)
  • MITRE ATT&CK — S1035 (report)
  • ncsc.gov.uk — Ncsc Malware Analysis Report Small Sieve (report)

External references