CHOPSTICK

Description

CHOPSTICK is a family of modular backdoors used by APT28 since at least 2012, usually dropped on victims as second stage malware. It has both Windows and Linux variants, and the US Department of Justice indictment against GRU officers references the family's use.

Stats

First seen: March 2022
Last seen: September 2026

Also known as

ChopstickXAgent

MITRE ATT&CK techniques

19 techniques across 7 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.011Fileless Storage
T1497Virtualization/Sandbox Evasion

TA0007 Discovery

T1012Query Registry
T1083File and Directory Discovery
T1518Software Discovery
- T1518.001Security Software Discovery

TA0008 Lateral Movement

T1091Replication Through Removable Media

TA0009 Collection

T1056Input Capture
- T1056.001Keylogging
T1113Screen Capture

TA0011 Command and Control

T1008Fallback Channels
T1071Application Layer Protocol
- T1071.003Mail Protocols
- T1071.001Web Protocols
T1090Proxy
- T1090.001Internal Proxy
T1092Communication Through Removable Media
T1105Ingress Tool Transfer
T1568Dynamic Resolution
- T1568.002Domain Generation Algorithms
T1573Encrypted Channel
- T1573.001Symmetric Cryptography
- T1573.002Asymmetric Cryptography

TA0112 Defense Impairment

T1112Modify Registry

Associated groups

G0007APT28

Alert name variants

Alert Name	Engine
Document-Excel.Backdoor.Chopstick	ATP Sandbox Adv. Heuristics
Document-Excel.Trojan.XAgent	ATP Sandbox Adv. Heuristics
Document-Word.Trojan.XAgent	ATP Sandbox Adv. Heuristics
MAC.IOS.XAgent.A	AV
MacOS.Trojan.XAgent	ATP Sandbox Adv. Heuristics
Win32.Trojan.XAgent	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-CNC Win.Downloader.XAgent variant outbound connection	IPS-SWG
MALWARE-CNC Win.Trojan.Chopstick variant outbound request	IPS-SWG

Related families

InvisiMole Bazar Cobalt Strike QakBot Metamorfo