H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

HAMMERTOSS

[HAMMERTOSS](https://attack.mitre.org/software/S0037) is a backdoor that was used by [APT29](https://attack.mitre.org/groups/G0016) in 2015. (Citation: FireEye APT29) (Citation: F-Secure The Dukes)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[HAMMERTOSS](https://attack.mitre.org/software/S0037) is a backdoor that was used by [APT29](https://attack.mitre.org/groups/G0016) in 2015. (Citation: FireEye APT29) (Citation: F-Secure The Dukes)

Labels

malware
8 recorded

Relationships

uses
from APT29
Group
uses
to Exfiltration to Cloud Storage
Technique
uses
to Hidden Window
Technique
uses
to One-Way Communication
Technique
uses
to PowerShell
Technique
uses
to Steganography
Technique
uses
to Symmetric Cryptography
Technique
uses
to Web Protocols
Technique
3 external

References

mitre-attack
S0037
open
F-Secure The Dukes
https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf
open
FireEye APT29
https://services.google.com/fh/files/misc/rpt-apt29-hammertoss-stealthy-tactics-define-en.pdf
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance