KOPILUWAK

MITRE ATT&CK: S1075 View on attack.mitre.org

Aliases: KOPILUWAK

First seen
2017-01-01 00:00:00
Malware type
spyware
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 13:12:35

Targeted industries: government-and-public-sector energy-and-utilities

Targeted regions: country_code:ru country_code:ua country_code:us

Context

KOPILUWAK is a JavaScript-based reconnaissance tool that has been used for victim profiling and C2 since at least 2017.

Detection coverage

  • 172 Sigma rules

Malware & tools used

  • Web Protocols (attack-pattern)
  • Malicious File (attack-pattern)
  • Process Discovery (attack-pattern)
  • Network Share Discovery (attack-pattern)
  • System Network Configuration Discovery (attack-pattern)
  • Exfiltration Over C2 Channel (attack-pattern)
  • Local Storage Discovery (attack-pattern)
  • System Network Connections Discovery (attack-pattern)
  • Spearphishing Attachment (attack-pattern)
  • Data from Local System (attack-pattern)
  • Local Data Staging (attack-pattern)
  • JavaScript (attack-pattern)
  • System Owner/User Discovery (attack-pattern)

Used by threat actors

  • Turla (threat-actor)
  • C0026 (campaign)

Reports & references

  • Kaspersky — 109552 (report)
  • ti.qianxin.com — Cb78386A082F465F259B37Dae5Df4884 (report)
  • malpedia.caad.fkie.fraunhofer.de — Js.Kopiluwak (report)
  • Kaspersky — Kopiluwak A New Javascript Payload From Turla (report)
  • Kaspersky — 88069 (report)
  • pdfhost.io — F0@Qelmu2 Macprostorage 2017Finalbitdefenderwhitepapernetrepsera4En Enbitdefenderwhitepapernetrepsera4En Enindd (report)
  • proofpoint.com — Turla Apt Actor Refreshes Kopiluwak Javascript Backdoor Use G20 Themed Attack (report)
  • blog.angelalonso.es — Analysis Of Malicious Doc Used By Turla (report)
  • Mandiant — Turla Galaxy Opportunity (report)
  • MITRE ATT&CK — S1075 (report)

External references