SUGARDUMP

Description

SUGARDUMP is a proprietary browser credential harvesting tool that UNC3890 used during its campaign against Israeli targets. Multiple versions evolved over time, adding SMTP and HTTP command and control channels between early 2021 and April 2022.

Stats

First seen: October 2022
Last seen: October 2026

MITRE ATT&CK techniques

13 techniques across 7 tactics.

TA0002 Execution

T1053Scheduled Task/Job
- T1053.005Scheduled Task
T1204User Execution
- T1204.002Malicious File

TA0005 Stealth

T1036Masquerading
- T1036.004Masquerade Task or Service
- T1036.005Match Legitimate Resource Name or Location

TA0006 Credential Access

T1555Credentials from Password Stores
- T1555.003Credentials from Web Browsers

TA0007 Discovery

T1083File and Directory Discovery
T1217Browser Information Discovery
T1518Software Discovery

TA0009 Collection

T1074Data Staged
- T1074.001Local Data Staging
T1560Archive Collected Data
- T1560.003Archive via Custom Method

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
- T1071.003Mail Protocols

TA0010 Exfiltration

T1041Exfiltration Over C2 Channel

Associated campaigns

C0010C0010

Alert name variants

Alert Name	Engine
ByteCode-MSIL.Backdoor.Sugardump	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Trojan.Sugardump	ATP Sandbox Adv. Heuristics
Document-Excel.Trojan.Sugardump	ATP Sandbox Adv. Heuristics
Win32.Backdoor.Sugardump	ATP Sandbox Adv. Heuristics
Win32.Trojan.Sugardump	ATP Sandbox Adv. Heuristics

Related families

Machete InvisiMole PlugX QakBot NETWIRE