elf.wellmess
- Malware type
- backdoor, trojan
- Family
- Malware family
- Profile updated
- 2026-07-07 12:37:27
Targeted industries: government-and-public-sector energy-and-utilities technology-and-telecommunications
Targeted regions: country_code:jp country_code:us country_code:gb
Context
WellMess is designed to execute arbitrary commands and exfiltrate system information. It has been linked with state-sponsored actors and was mainly used for cyber-espionage activities targeting advanced technology sectors.
Reports & references
- pwc.co.uk — Pwc Cyber Threats 2020 A Year In Retrospect (report)
- intezer.com — Top Linux Cloud Threats Of 2020 (report)
- Kaspersky — 97937 (report)
- pwc.co.uk — Cleaning Up After Wellmess (report)
- pwc.co.uk — Wellmess Analysis Command Control (report)
- intezer.com — Intezer 2020 Go Malware Round Up (report)
- blackberry.com — Report Bb 2021 Threat Report (report)
- Kaspersky — 98440 (report)
- ncsc.gov.uk — Advisory Apt29 Targets Covid 19 Vaccine Development (report)
- Cisco Talos — Attribution Puzzle (report)
- ironnet.com — Russian Cyber Attack Campaigns And Actors (report)
- malpedia.caad.fkie.fraunhofer.de — Elf.Wellmess (report)
- CISA — Aa21 116A (report)
- CISA — Aa21 116A Russian Foreign Intelligence Service Cyber Operations 508C (report)
- botconf.eu — 2018 Y Ishikawa S Nagano Lets Go With A Go Rat Final (report)
- blogs.jpcert.or.jp — Malware Wellmes 9B78 (report)
- services.global.ntt — The Layered Infrastructure Operated By Apt29 (report)
- blackberry.com — Report Old Dogs New Tricks (report)
- community.riskiq.com — Description (report)