H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

Downdelph

[Downdelph](https://attack.mitre.org/software/S0134) is a first-stage downloader written in Delphi that has been used by [APT28](https://attack.mitre.org/groups/G0007) in rare instances between 2013 and 2015. (Citation: ESET Sednit Part 3)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Downdelph](https://attack.mitre.org/software/S0134) is a first-stage downloader written in Delphi that has been used by [APT28](https://attack.mitre.org/groups/G0007) in rare instances between 2013 and 2015. (Citation: ESET Sednit Part 3)

Labels

malware
6 recorded

Relationships

uses
from APT28
Group
uses
to Bypass User Account Control
Technique
uses
to DLL
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Junk Data
Technique
uses
to Symmetric Cryptography
Technique
2 external

References

mitre-attack
S0134
open
ESET Sednit Part 3
http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part3.pdf
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance