Netskope Threat Labs

SharpStage

ATP Sandbox Adv. Heuristics

Stats

First seen
May 2025
Last seen
September 2026

MITRE ATT&CK techniques

11 techniques across 6 tactics.

TA0002 Execution

TA0003 Persistence

  • T1547Boot or Logon Autostart Execution

TA0005 Stealth

  • T1140Deobfuscate/Decode Files or Information

TA0007 Discovery

  • T1082System Information Discovery
  • T1614System Location Discovery

TA0009 Collection

TA0011 Command and Control

Associated groups

Alert name variants

Alert Name
ByteCode-MSIL.Backdoor.Sharpstage
Win32.Backdoor.Sharpstage

Related families

BazarBADHATCHEmpireNETWIREPUBLOAD