SUPERNOVA

Description

SUPERNOVA is an in-memory web shell written in .NET C sharp, discovered in November 2020 during the investigation into APT29's SolarWinds operation, but researchers determined it unrelated to that operation. Subsequent analysis suggests the China based SPIRAL group may have used it.

Stats

First seen: March 2022
Last seen: October 2026

Also known as

SuperNovaSupernova

MITRE ATT&CK techniques

5 techniques across 4 tactics.

TA0002 Execution

T1203Exploitation for Client Execution

TA0003 Persistence

T1505Server Software Component
- T1505.003Web Shell

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.013Encrypted/Encoded File
T1036Masquerading
- T1036.005Match Legitimate Resource Name or Location

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols

Alert name variants

Alert Name	Engine
ByteCode-MSIL.Backdoor.Supernova	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Trojan.SuperNova	ATP Sandbox Adv. Heuristics
Trojan.Supernova.A	AV
Trojan.Supernova.D	AV

Related families

Bazar Bisonal BRICKSTORM GoldenSpy GoldMax