Volgmer

Description

Volgmer is a backdoor trojan designed to provide covert access to compromised systems, used since at least 2013 against government, financial, automotive, and media targets, with spearphishing as its suspected primary delivery mechanism.

Stats

First seen: February 2022
Last seen: September 2026

MITRE ATT&CK techniques

19 techniques across 6 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
T1106Native API

TA0003 Persistence

T1543Create or Modify System Process
- T1543.003Windows Service

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.011Fileless Storage
- T1027.013Encrypted/Encoded File
T1036Masquerading
- T1036.004Masquerade Task or Service
T1070Indicator Removal
- T1070.004File Deletion
T1140Deobfuscate/Decode Files or Information

TA0007 Discovery

T1007System Service Discovery
T1012Query Registry
T1016System Network Configuration Discovery
T1049System Network Connections Discovery
T1057Process Discovery
T1082System Information Discovery
T1083File and Directory Discovery

TA0011 Command and Control

T1105Ingress Tool Transfer
T1573Encrypted Channel
- T1573.001Symmetric Cryptography
- T1573.002Asymmetric Cryptography

TA0112 Defense Impairment

T1112Modify Registry

Associated groups

G0032Lazarus Group

Alert name variants

Alert Name	Engine
Win32.Backdoor.Volgmer	ATP Sandbox Adv. Heuristics
Win32.Trojan.Volgmer	ATP Sandbox Adv. Heuristics

Related families

PlugX Uroburos InvisiMole KONNI SysUpdate