PipeMon

ATP Sandbox Adv. Heuristics

Description

PipeMon is a multi-stage modular backdoor used by the Winnti Group.

Stats

First seen: February 2023
Last seen: September 2026

Also known as

Pipemon

MITRE ATT&CK techniques

23 techniques across 7 tactics.

TA0002 Execution

T1106Native API
T1129Shared Modules

TA0003 Persistence

T1543Create or Modify System Process
- T1543.003Windows Service
T1547Boot or Logon Autostart Execution
- T1547.012Print Processors

TA0004 Privilege Escalation

T1548Abuse Elevation Control Mechanism
- T1548.002Bypass User Account Control

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.013Encrypted/Encoded File
- T1027.011Fileless Storage
T1036Masquerading
- T1036.005Match Legitimate Resource Name or Location
T1055Process Injection
- T1055.001Dynamic-link Library Injection
T1134Access Token Manipulation
- T1134.002Create Process with Token
- T1134.004Parent PID Spoofing
T1140Deobfuscate/Decode Files or Information

TA0007 Discovery

T1016System Network Configuration Discovery
T1057Process Discovery
T1082System Information Discovery
T1124System Time Discovery
T1518Software Discovery
- T1518.001Security Software Discovery

TA0011 Command and Control

T1008Fallback Channels
T1095Non-Application Layer Protocol
T1105Ingress Tool Transfer
T1573Encrypted Channel
- T1573.001Symmetric Cryptography

TA0112 Defense Impairment

T1112Modify Registry
T1553Subvert Trust Controls
- T1553.002Code Signing

Associated groups

G0044Winnti Group

Alert name variants

Alert Name	Engine
Win64.Backdoor.Pipemon	ATP Sandbox Adv. Heuristics
Win64.Trojan.PipeMon	ATP Sandbox Adv. Heuristics

Related families

InvisiMole Metamorfo QakBot KONNI Bazar

References