H3XA — Operational Evidence

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Suckfly](https://attack.mitre.org/groups/G0039) is a China-based threat group that has been active since at least 2014. (Citation: Symantec Suckfly March 2016)

6 recorded

Relationships

uses

to Code Signing

Technique

uses

to Network Service Discovery

Technique

uses

to Nidiran

Malware

uses

to OS Credential Dumping

Technique

uses

to Valid Accounts

Technique

uses

to Windows Command Shell

Technique

4 external

References

mitre-attack

G0039

open

Suckfly

—

Symantec Suckfly March 2016

http://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates

open

Symantec Suckfly May 2016

http://www.symantec.com/connect/blogs/indian-organizations-targeted-suckfly-attacks

open