RDFSNIFFER — Malware Profile

RDFSNIFFER is a module loaded by BOOSTWRITE which allows an attacker to monitor and tamper with legitimate connections made via an application designed to provide visibility and system management capabilities to remote IT techs.

MITRE ATT&CK techniques (3)

• T1056.004 Credential API Hooking
• T1070.004 File Deletion
• T1106 Native API

Attributed threat actors

• FIN7

Read the full analysis on IntelFusions