Netskope Threat Labs

SysUpdate

ATP Sandbox Adv. HeuristicsAVNetskope IPS

Description

SysUpdate is a backdoor written in C++ that the Threat Group-3390 intrusion set has used since at least 2020.

Stats

First seen
May 2022
Last seen
September 2026

Also known as

SoldierSysupdate

MITRE ATT&CK techniques

31 techniques across 8 tactics.

TA0002 Execution

TA0003 Persistence

TA0005 Stealth

TA0007 Discovery

  • T1007System Service Discovery
  • T1016System Network Configuration Discovery
  • T1016System Network Configuration Discovery
  • T1033System Owner/User Discovery
  • T1057Process Discovery
  • T1082System Information Discovery
  • T1083File and Directory Discovery
  • T1680Local Storage Discovery

TA0009 Collection

TA0011 Command and Control

TA0010 Exfiltration

  • T1041Exfiltration Over C2 Channel

TA0112 Defense Impairment

Associated groups

Alert name variants

Alert Name
DOS.Virus.Soldier
Gen:Variant.Trojan.Linux.Sysupdate.1
Linux.Trojan.Sysupdate
Win32.Trojan.Sysupdate
Win32.Trojan.SysUpdate
Win64.Spyware.Sysupdate

Related IPS Signatures

Signature Name
MALWARE-OTHER Linux.Trojan.SysUpdate variant download attempt

Related families

QakBotInvisiMolePlugXKONNITrickBot

References