WellMail

ATP Sandbox Adv. HeuristicsAV

Stats

First seen: March 2022
Last seen: September 2026

Also known as

Wellmail

MITRE ATT&CK techniques

9 techniques across 4 tactics.

TA0005 Stealth

T1140Deobfuscate/Decode Files or Information

TA0007 Discovery

T1016System Network Configuration Discovery
T1033System Owner/User Discovery

TA0009 Collection

T1005Data from Local System
T1560Archive Collected Data

TA0011 Command and Control

T1095Non-Application Layer Protocol
T1105Ingress Tool Transfer
T1571Non-Standard Port
T1573Encrypted Channel
- T1573.002Asymmetric Cryptography

Associated groups

G0016APT29

Alert name variants

Alert Name	Engine
Linux.Backdoor.WellMail	ATP Sandbox Adv. Heuristics
Linux.Trojan.WellMail	ATP Sandbox Adv. Heuristics
Trojan.Linux.Wellmail.A	AV
Trojan.Linux.Wellmail.D	AV
Trojan.Linux.Wellmail.E	AV

Related families

InvisibleFerret MacMa HiddenFace Bazar Cobalt Strike