HiddenWasp

ATP Sandbox Adv. HeuristicsAVNetskope IPS

Stats

First seen: October 2022
Last seen: October 2026

MITRE ATT&CK techniques

10 techniques across 4 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell

TA0003 Persistence

T1037Boot or Logon Initialization Scripts
- T1037.004RC Scripts
T1136Create Account
- T1136.001Local Account

TA0005 Stealth

T1014Rootkit
T1027Obfuscated Files or Information
- T1027.013Encrypted/Encoded File
T1140Deobfuscate/Decode Files or Information
T1574Hijack Execution Flow
- T1574.006Dynamic Linker Hijacking

TA0011 Command and Control

T1095Non-Application Layer Protocol
T1105Ingress Tool Transfer
T1573Encrypted Channel
- T1573.001Symmetric Cryptography

Alert name variants

Alert Name	Engine
Linux.Trojan.HiddenWasp	ATP Sandbox Adv. Heuristics
Trojan.Linux.HiddenWasp.1	AV
Trojan.Linux.HiddenWasp.A	AV

Related IPS Signatures

Signature Name	Engine
MALWARE-TOOLS Unix.Downloader.HiddenWasp initial deployment script download attempt	IPS-SWG

Related families

Uroburos Bisonal Metamorfo PlugX Taidoor