Kivars

ATP Sandbox Adv. Heuristics

Description

Kivars is a modular remote access tool derived from the Bifrost RAT that the BlackTech group used in a 2010 campaign.

Stats

First seen: June 2023
Last seen: October 2026

MITRE ATT&CK techniques

7 techniques across 5 tactics.

TA0005 Stealth

T1070Indicator Removal
- T1070.004File Deletion
T1564Hide Artifacts
- T1564.003Hidden Window

TA0007 Discovery

T1083File and Directory Discovery

TA0008 Lateral Movement

T1021Remote Services

TA0009 Collection

T1056Input Capture
- T1056.001Keylogging
T1113Screen Capture

TA0011 Command and Control

T1105Ingress Tool Transfer

Associated groups

G0098BlackTech

Alert name variants

Alert Name	Engine
Win32.Backdoor.Kivars	ATP Sandbox Adv. Heuristics
Win64.Backdoor.Kivars	ATP Sandbox Adv. Heuristics
Win64.Trojan.Kivars	ATP Sandbox Adv. Heuristics

Related families

MacMa PlugX Remcos InvisiMole Metamorfo

References