BLINDINGCAN

ATP Sandbox Adv. Heuristics

Stats

First seen: March 2022
Last seen: September 2026

Also known as

BlindingCanBlindingcan

MITRE ATT&CK techniques

22 techniques across 8 tactics.

TA0001 Initial Access

T1566Phishing
- T1566.001Spearphishing Attachment

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
T1129Shared Modules
T1204User Execution
- T1204.002Malicious File

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.013Encrypted/Encoded File
- T1027.002Software Packing
T1036Masquerading
- T1036.005Match Legitimate Resource Name or Location
T1070Indicator Removal
- T1070.004File Deletion
- T1070.006Timestomp
T1140Deobfuscate/Decode Files or Information
T1218System Binary Proxy Execution
- T1218.011Rundll32

TA0007 Discovery

T1016System Network Configuration Discovery
T1082System Information Discovery
T1083File and Directory Discovery
T1680Local Storage Discovery

TA0009 Collection

T1005Data from Local System

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1105Ingress Tool Transfer
T1132Data Encoding
- T1132.001Standard Encoding
T1573Encrypted Channel
- T1573.001Symmetric Cryptography

TA0010 Exfiltration

T1041Exfiltration Over C2 Channel

TA0112 Defense Impairment

T1553Subvert Trust Controls
- T1553.002Code Signing

Associated groups

G0032Lazarus Group

Alert name variants

Alert Name	Engine
Win32.Trojan.Blindingcan	ATP Sandbox Adv. Heuristics
Win64.Trojan.Blindingcan	ATP Sandbox Adv. Heuristics
Win64.Trojan.BlindingCan	ATP Sandbox Adv. Heuristics

Related families

KONNI Bisonal Latrodectus QakBot Metamorfo