STOWAWAY
- Malware type
- backdoor
- Last IoC activity
- 2026-07-21 04:36:58
- Profile updated
- 2026-07-07 13:16:44
Context
According to Mandiant, STOWAWAY is a publicly available backdoor and proxy. The project supports several types of communication like SSH, socks5. Backdoor component supports upload and download of files, remote shell and basic information gathering.
Detection coverage
- 2 YARA rules
Detection rules
- SEKOIA_Hacktool_Stowaway_Strings (yara-rule)
- MALPEDIA_Win_Stowaway_Auto (yara-rule)
Reports & references
- Trend Micro — Earth Lamia (report)
- blog.exatrack.com — Melofee (report)
- Mandiant — Trojanized Windows Installers Ukrainian Government (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Stowaway (report)
- github.com — Stowaway (report)
- businessinsights.bitdefender.com — Eggstreme Fileless Malware Cyberattack Apac (report)