H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

OceanSalt

[OceanSalt](https://attack.mitre.org/software/S0346) is a Trojan that was used in a campaign targeting victims in South Korea, United States, and Canada. [OceanSalt](https://attack.mitre.org/software/S0346) shares code similarity with [SpyNote RAT](https://attack.mitre.org/software/S0305), which has been linked to [APT1](https://attack.mitre.org/groups/G0006).(Citation: McAfee Oceansalt Oct 2018)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[OceanSalt](https://attack.mitre.org/software/S0346) is a Trojan that was used in a campaign targeting victims in South Korea, United States, and Canada. [OceanSalt](https://attack.mitre.org/software/S0346) shares code similarity with [SpyNote RAT](https://attack.mitre.org/software/S0305), which has been linked to [APT1](https://attack.mitre.org/groups/G0006).(Citation: McAfee Oceansalt Oct 2018)

Labels

malware
8 recorded

Relationships

uses
to File and Directory Discovery
Technique
uses
to File Deletion
Technique
uses
to Non-Standard Encoding
Technique
uses
to Process Discovery
Technique
uses
to Spearphishing Attachment
Technique
uses
to System Information Discovery
Technique
uses
to System Network Configuration Discovery
Technique
uses
to Windows Command Shell
Technique
3 external

References

mitre-attack
S0346
open
OceanSalt
—
McAfee Oceansalt Oct 2018
https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-oceansalt.pdf
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance