RIFLESPINE

MITRE ATT&CK: S1222 View on attack.mitre.org

Aliases: RIFLESPINE

Malware type
backdoor
Family
Malware family
Operating systems
linux
Profile updated
2026-07-07 15:29:48

Targeted industries: government-and-public-sector defense-and-aerospace

Context

RIFLESPINE is a cross-platform backdoor that leverages Google Drive for file transfer and command execution.

Detection coverage

  • 183 Sigma rules

Malware & tools used

  • Bidirectional Communication (attack-pattern)
  • Exfiltration to Cloud Storage (attack-pattern)
  • Symmetric Cryptography (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Systemd Service (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • System Information Discovery (attack-pattern)
  • Web Protocols (attack-pattern)
  • Unix Shell (attack-pattern)
  • Local Data Staging (attack-pattern)

Used by threat actors

Reports & references

  • cloud.google.com — Uncovering Unc3886 Espionage Operations (report)
  • MITRE ATT&CK — S1222 (report)

External references