H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[HAWKBALL](https://attack.mitre.org/software/S0391) is a backdoor that was observed in targeting of the government sector in Central Asia.(Citation: FireEye HAWKBALL Jun 2019)

Labels

malware

11 recorded

Relationships

uses

to Archive via Custom Method

Technique

uses

to Dynamic Data Exchange

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Exploitation for Client Execution

Technique

uses

to File Deletion

Technique

uses

to Native API

Technique

uses

to System Information Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

3 external

References

mitre-attack

S0391

open

HAWKBALL

—

FireEye HAWKBALL Jun 2019

https://www.fireeye.com/blog/threat-research/2019/06/government-in-central-asia-targeted-with-hawkball-backdoor.html

open