SHOTPUT

ATP Sandbox Adv. Heuristics

Description

SHOTPUT is a custom backdoor used by the APT3 threat actor in its intrusion campaigns.

Stats

First seen: May 2022
Last seen: October 2026

MITRE ATT&CK techniques

6 techniques across 2 tactics.

TA0005 Stealth

T1027Obfuscated Files or Information

TA0007 Discovery

T1018Remote System Discovery
T1049System Network Connections Discovery
T1057Process Discovery
T1083File and Directory Discovery
T1087Account Discovery
- T1087.001Local Account

Associated groups

G0022APT3

Alert name variants

Alert Name	Engine
Win32.Backdoor.Pirpi	ATP Sandbox Adv. Heuristics
Win32.Trojan.Pirpi	ATP Sandbox Adv. Heuristics
Win64.Infostealer.Pirpi	ATP Sandbox Adv. Heuristics

Related families

QakBot Cobalt Strike Kwampirs Remsec TrickBot

References