DOUBLEBACK
- First seen
- 2020-12-01 00:00:00
- Malware type
- backdoor
- Last IoC activity
- 2026-07-19 17:49:13
- Profile updated
- 2026-07-07 14:42:57
Targeted industries: financial-services technology-and-telecommunications government-and-public-sector
Context
DOUBLEBACK is a newly discovered fileless malware deployed as part of an attack campaign that took place in December 2020. The threat actors responsible for the operations are tracked as UNC2529 by researchers. According to their findings, DOUBLEBACK is the final payload delivered onto the compromised systems. Its task is to establish and maintain a backdoor on the victim's machine.
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Doubleback_Auto (yara-rule)
Reports & references
- Mandiant — Unc2529 Triple Double Trifecta Phishing Campaign (report)
- research.loginsoft.com — From Innocence To Malice The Onenote Malware Campaign Uncovered (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Doubleback (report)