HAMMERTOSS

ATP Sandbox Adv. Heuristics

Description

HAMMERTOSS is a backdoor that APT29 used in 2015.

Stats

First seen: March 2022
Last seen: September 2026

MITRE ATT&CK techniques

7 techniques across 4 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.001PowerShell

TA0005 Stealth

T1564Hide Artifacts
- T1564.003Hidden Window

TA0011 Command and Control

T1001Data Obfuscation
- T1001.002Steganography
T1071Application Layer Protocol
- T1071.001Web Protocols
T1102Web Service
- T1102.003One-Way Communication
T1573Encrypted Channel
- T1573.001Symmetric Cryptography

TA0010 Exfiltration

T1567Exfiltration Over Web Service
- T1567.002Exfiltration to Cloud Storage

Associated groups

G0016APT29

Alert name variants

Alert Name	Engine
ByteCode-MSIL.Backdoor.Hammertoss	ATP Sandbox Adv. Heuristics
Win32.Backdoor.Hammertoss	ATP Sandbox Adv. Heuristics

Related families

Sliver Tsundere Botnet Metamorfo TrickBot Bazar

References