H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[KOPILUWAK](https://attack.mitre.org/software/S1075) is a JavaScript-based reconnaissance tool that has been used for victim profiling and C2 since at least 2017.(Citation: Mandiant Suspected Turla Campaign February 2023)

Labels

malware

15 recorded

Relationships

uses

from C0026

Campaign

uses

to Data from Local System

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to JavaScript

Technique

uses

to Local Data Staging

Technique

uses

to Local Storage Discovery

Technique

uses

to Malicious File

Technique

uses

to Network Share Discovery

Technique

uses

to Process Discovery

Technique

uses

to Spearphishing Attachment

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Network Connections Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to Web Protocols

Technique

uses

from Turla

Group

2 external

References

mitre-attack

S1075

open

Mandiant Suspected Turla Campaign February 2023

https://www.mandiant.com/resources/blog/turla-galaxy-opportunity

open