WellMess

Description

WellMess is a lightweight malware family with .NET and Golang variants that APT29 has used since at least 2018, and which came to wide attention during the 2020 investigations into intrusions against research and development organizations.

Stats

First seen: March 2022
Last seen: September 2026

Also known as

Wellmess

MITRE ATT&CK techniques

15 techniques across 5 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.001PowerShell
- T1059.003Windows Command Shell

TA0005 Stealth

T1140Deobfuscate/Decode Files or Information

TA0007 Discovery

T1016System Network Configuration Discovery
T1033System Owner/User Discovery
T1069Permission Groups Discovery
- T1069.002Domain Groups
T1082System Information Discovery

TA0009 Collection

T1005Data from Local System

TA0011 Command and Control

T1001Data Obfuscation
- T1001.001Junk Data
T1071Application Layer Protocol
- T1071.004DNS
- T1071.001Web Protocols
T1105Ingress Tool Transfer
T1132Data Encoding
- T1132.001Standard Encoding
T1573Encrypted Channel
- T1573.002Asymmetric Cryptography
- T1573.001Symmetric Cryptography

Associated groups

G0016APT29

Alert name variants

Alert Name	Engine
ByteCode-MSIL.Trojan.WellMess	ATP Sandbox Adv. Heuristics
Gen:Variant.Linux.Wellmess.1	AV
Gen:Variant.Trojan.Linux.Wellmess.1	AV
Linux.Spyware.WellMess	ATP Sandbox Adv. Heuristics
Linux.Trojan.WellMess	ATP Sandbox Adv. Heuristics
Win32.Trojan.WellMess	ATP Sandbox Adv. Heuristics
Win64.Trojan.WellMess	ATP Sandbox Adv. Heuristics

Related families

Cobalt Strike Bazar Latrodectus TrickBot KONNI