H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

TDTESS

[TDTESS](https://attack.mitre.org/software/S0164) is a 64-bit .NET binary backdoor used by [CopyKittens](https://attack.mitre.org/groups/G0052). (Citation: ClearSky Wilted Tulip July 2017)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[TDTESS](https://attack.mitre.org/software/S0164) is a 64-bit .NET binary backdoor used by [CopyKittens](https://attack.mitre.org/groups/G0052). (Citation: ClearSky Wilted Tulip July 2017)

Labels

malware
6 recorded

Relationships

uses
from CopyKittens
Group
uses
to File Deletion
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Timestomp
Technique
uses
to Windows Command Shell
Technique
uses
to Windows Service
Technique
3 external

References

mitre-attack
S0164
open
TDTESS
—
ClearSky Wilted Tulip July 2017
http://www.clearskysec.com/wp-content/uploads/2017/07/Operation_Wilted_Tulip.pdf
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance