H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[SharpStage](https://attack.mitre.org/software/S0546) is a .NET malware with backdoor capabilities.(Citation: Cybereason Molerats Dec 2020)(Citation: BleepingComputer Molerats Dec 2020)

Labels

malware

12 recorded

Relationships

uses

from Molerats

Group

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Ingress Tool Transfer

Technique

uses

to PowerShell

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Scheduled Task

Technique

uses

to Screen Capture

Technique

uses

to System Information Discovery

Technique

uses

to System Language Discovery

Technique

uses

to Web Service

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Management Instrumentation

Technique

4 external

References

mitre-attack

S0546

open

SharpStage

—

Cybereason Molerats Dec 2020

https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf

open

BleepingComputer Molerats Dec 2020

https://www.bleepingcomputer.com/news/security/hacking-group-s-new-malware-abuses-google-and-facebook-services/

open