SLOTHFULMEDIA

Description

SLOTHFULMEDIA is a C++ remote access trojan used by an unidentified sophisticated cyber actor since at least January 2017. Its campaigns have targeted government organizations, defense contractors, universities, and energy companies across Russia, India, Kazakhstan, Kyrgyzstan, Malaysia, Ukraine, and Eastern Europe, and Kaspersky tracks the activity cluster as IAmTheKing.

Stats

First seen: April 2022
Last seen: October 2026

MITRE ATT&CK techniques

24 techniques across 9 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
T1569System Services
- T1569.002Service Execution

TA0003 Persistence

T1543Create or Modify System Process
- T1543.003Windows Service

TA0005 Stealth

T1036Masquerading
- T1036.005Match Legitimate Resource Name or Location
- T1036.004Masquerade Task or Service
T1055Process Injection
T1070Indicator Removal
- T1070.004File Deletion
T1564Hide Artifacts
- T1564.001Hidden Files and Directories

TA0007 Discovery

T1007System Service Discovery
T1033System Owner/User Discovery
T1049System Network Connections Discovery
T1057Process Discovery
T1082System Information Discovery
T1083File and Directory Discovery
T1680Local Storage Discovery

TA0009 Collection

T1005Data from Local System
T1056Input Capture
- T1056.001Keylogging
T1113Screen Capture

TA0011 Command and Control

T1001Data Obfuscation
T1071Application Layer Protocol
- T1071.001Web Protocols
T1105Ingress Tool Transfer

TA0010 Exfiltration

T1041Exfiltration Over C2 Channel

TA0040 Impact

T1489Service Stop

TA0112 Defense Impairment

T1112Modify Registry

Alert name variants

Alert Name	Engine
Win32.Trojan.SlothfulMedia	ATP Sandbox Adv. Heuristics

Related families

InvisiMole KONNI PlugX QakBot SysUpdate