Small Sieve — Malware Profile

Small Sieve is a Telegram Bot API-based Python backdoor that has been distributed using a Nullsoft Scriptable Install System (NSIS) Installer; it has been used by MuddyWater since at least January 2022. Security researchers have also noted Small Sieve's use by UNC3313, which may be associated with MuddyWater.

MITRE ATT&CK techniques (13)

• T1016 System Network Configuration Discovery
• T1027 Obfuscated Files or Information
• T1033 System Owner/User Discovery
• T1036.005 Match Legitimate Resource Name or Location
• T1059.003 Windows Command Shell
• T1059.006 Python
• T1071.001 Web Protocols
• T1102.002 Bidirectional Communication
• T1105 Ingress Tool Transfer
• T1132.002 Non-Standard Encoding
• T1480 Execution Guardrails
• T1547.001 Registry Run Keys / Startup Folder
• T1573.002 Asymmetric Cryptography

Attributed threat actors

• MuddyWater

Read the full analysis on IntelFusions