More_eggs

Description

More_eggs is a JScript backdoor used by the Cobalt Group and FIN6, named for the variable present in its code. Researchers have observed at least two distinct versions of the backdoor in circulation.

Stats

First seen: April 2022
Last seen: September 2026

Also known as

MoreeggsTerraLoaderTerraloader

MITRE ATT&CK techniques

15 techniques across 5 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.013Encrypted/Encoded File
T1070Indicator Removal
- T1070.004File Deletion
T1140Deobfuscate/Decode Files or Information
T1218System Binary Proxy Execution
- T1218.010Regsvr32

TA0007 Discovery

T1016System Network Configuration Discovery
- T1016.001Internet Connection Discovery
T1016System Network Configuration Discovery
- T1016.001Internet Connection Discovery
T1033System Owner/User Discovery
T1082System Information Discovery
T1518Software Discovery
- T1518.001Security Software Discovery

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1105Ingress Tool Transfer
T1132Data Encoding
- T1132.001Standard Encoding
T1573Encrypted Channel
- T1573.001Symmetric Cryptography

TA0112 Defense Impairment

T1553Subvert Trust Controls
- T1553.002Code Signing

Associated groups

Alert name variants

Alert Name	Engine
Script-JS.Backdoor.Moreeggs	ATP Sandbox Adv. Heuristics
Shortcut.Trojan.Moreeggs	ATP Sandbox Adv. Heuristics
Win32.Backdoor.Terraloader	ATP Sandbox Adv. Heuristics
Win32.Trojan.TerraLoader	ATP Sandbox Adv. Heuristics
Win64.Backdoor.Moreeggs	ATP Sandbox Adv. Heuristics
Win64.Trojan.TerraLoader	ATP Sandbox Adv. Heuristics

Related families

QakBot Bazar Latrodectus Woody RAT PUBLOAD