Description
InvisiMole is a Windows backdoor used for espionage, documented by ESET in 2018 but active since at least 2013. Its modules provide extensive surveillance capabilities, including webcam and microphone control, screen capture, file exfiltration, and execution of commands on compromised systems. Cyberattackers typically deploy it on already compromised machines, often following Gamaredon intrusions, and its victims have been concentrated in Russia and Ukraine.
Stats
- First seen
- May 2022
- Last seen
- October 2026
Also known as
Invisimole
MITRE ATT&CK techniques
73 techniques across 10 tactics.
TA0002 Execution
TA0003 Persistence
TA0004 Privilege Escalation
TA0005 Stealth
- T1027Obfuscated Files or Information
- T1027.005Indicator Removal from Tools
- T1036Masquerading
- T1055Process Injection
- T1055Process Injection
- T1070Indicator Removal
- T1140Deobfuscate/Decode Files or Information
- T1218System Binary Proxy Execution
- T1480Execution Guardrails
- T1480.001Environmental Keying
- T1497Virtualization/Sandbox Evasion
- T1497.001System Checks
- T1564Hide Artifacts
- T1574Hijack Execution Flow
- T1574.001DLL
TA0007 Discovery
- T1007System Service Discovery
- T1010Application Window Discovery
- T1012Query Registry
- T1016System Network Configuration Discovery
- T1033System Owner/User Discovery
- T1046Network Service Discovery
- T1057Process Discovery
- T1082System Information Discovery
- T1083File and Directory Discovery
- T1087Account Discovery
- T1087.001Local Account
- T1124System Time Discovery
- T1135Network Share Discovery
- T1518Software Discovery
- T1518.001Security Software Discovery
- T1680Local Storage Discovery
TA0009 Collection
TA0011 Command and Control
TA0040 Impact
- T1490Inhibit System Recovery
Alert name variants
| Alert Name |
|---|
| Trojan.InvisiMole.A |
| Win32.Trojan.InvisiMole |
| Win64.Trojan.Invisimole |
| Win64.Trojan.InvisiMole |