MgBot

ATP Sandbox Adv. Heuristics

Stats

First seen: January 2025
Last seen: September 2026

MITRE ATT&CK techniques

17 techniques across 3 tactics.

TA0006 Credential Access

T1003OS Credential Dumping
T1539Steal Web Session Cookie
T1555Credentials from Password Stores
- T1555.003Credentials from Web Browsers

TA0007 Discovery

T1018Remote System Discovery
T1033System Owner/User Discovery
T1046Network Service Discovery
T1057Process Discovery
T1087Account Discovery
- T1087.002Domain Account
- T1087.001Local Account
T1482Domain Trust Discovery

TA0009 Collection

T1005Data from Local System
T1025Data from Removable Media
T1056Input Capture
- T1056.001Keylogging
T1115Clipboard Data
T1123Audio Capture
T1213Data from Information Repositories
- T1213.006Databases

Associated groups

G1034Daggerfly

Alert name variants

Alert Name	Engine
Win32.Trojan.MgBot	ATP Sandbox Adv. Heuristics

Related families

Empire InvisiMole QakBot Agent Tesla Bazar