H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

LOWBALL

[LOWBALL](https://attack.mitre.org/software/S0042) is malware used by [admin@338](https://attack.mitre.org/groups/G0018). It was used in August 2015 in email messages targeting Hong Kong-based media organizations. (Citation: FireEye admin@338)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[LOWBALL](https://attack.mitre.org/software/S0042) is malware used by [admin@338](https://attack.mitre.org/groups/G0018). It was used in August 2015 in email messages targeting Hong Kong-based media organizations. (Citation: FireEye admin@338)

Labels

malware
4 recorded

Relationships

uses
from admin@338
Group
uses
to Bidirectional Communication
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Web Protocols
Technique
2 external

References

mitre-attack
S0042
open
FireEye admin@338
https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance