HyperStack — Malware Profile

HyperStack is a RPC-based backdoor used by Turla since at least 2018. HyperStack has similarities to other backdoors used by Turla including Carbon.

MITRE ATT&CK techniques (6)

• T1078.001 Default Accounts
• T1087.001 Local Account
• T1106 Native API
• T1112 Modify Registry
• T1559 Inter-Process Communication
• T1573.001 Symmetric Cryptography

Attributed threat actors

• Turla

Read the full analysis on IntelFusions