CANONSTAGER

ATP Sandbox Adv. Heuristics

Stats

First seen: January 2026
Last seen: October 2026

MITRE ATT&CK techniques

6 techniques across 2 tactics.

TA0002 Execution

T1106Native API

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.007Dynamic API Resolution
T1036Masquerading
- T1036.005Match Legitimate Resource Name or Location
T1055Process Injection
- T1055.005Thread Local Storage
T1564Hide Artifacts
- T1564.003Hidden Window
T1574Hijack Execution Flow
- T1574.001DLL

Associated groups

G0129Mustang Panda

Alert name variants

Alert Name	Engine
Win32.Trojan.CanonStager	ATP Sandbox Adv. Heuristics

Related families

PlugX InvisiMole Metamorfo TONESHELL Ursnif