H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Spark](https://attack.mitre.org/software/S0543) is a Windows backdoor and has been in use since as early as 2017.(Citation: Unit42 Molerat Mar 2020)

Labels

malware

11 recorded

Relationships

uses

from Molerats

Group

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Software Packing

Technique

uses

to Standard Encoding

Technique

uses

to System Information Discovery

Technique

uses

to System Language Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to User Activity Based Checks

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

3 external

References

mitre-attack

S0543

open

Spark

—

Unit42 Molerat Mar 2020

https://unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor/

open