Aotera

ATP Sandbox Adv. HeuristicsAV

Stats

First seen: March 2026
Last seen: October 2026

Alert name variants

Alert Name	Engine
Trojan.Aotera.53	AV
Win64.Trojan.Aotera	ATP Sandbox Adv. Heuristics

Related blogs

$Sandbox process tree for the Underground loader, showing an injected dllhost.exe launching chrome.exe and msedge.exe and staging stolen cookies under C:\ProgramData\Underground, before a second dllhost.exe deletes that folder.$

$100k in Crypto Drained by the Underground Operation

October 1, 20268 min read