H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

OLDBAIT

[OLDBAIT](https://attack.mitre.org/software/S0138) is a credential harvester used by [APT28](https://attack.mitre.org/groups/G0007). (Citation: FireEye APT28) (Citation: FireEye APT28 January 2017)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[OLDBAIT](https://attack.mitre.org/software/S0138) is a credential harvester used by [APT28](https://attack.mitre.org/groups/G0007). (Citation: FireEye APT28) (Citation: FireEye APT28 January 2017)

Labels

malware
7 recorded

Relationships

uses
from APT28
Group
uses
to Credentials from Password Stores
Technique
uses
to Credentials from Web Browsers
Technique
uses
to Mail Protocols
Technique
uses
to Match Legitimate Resource Name or Location
Technique
uses
to Obfuscated Files or Information
Technique
uses
to Web Protocols
Technique
3 external

References

mitre-attack
S0138
open
FireEye APT28 January 2017
https://www.mandiant.com/sites/default/files/2021-09/APT28-Center-of-Storm-2017.pdf
open
FireEye APT28
https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance