H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[EnvyScout](https://attack.mitre.org/software/S0634) is a dropper that has been used by [APT29](https://attack.mitre.org/groups/G0016) since at least 2021.(Citation: MSTIC Nobelium Toolset May 2021)

Labels

malware

15 recorded

Relationships

uses

from APT29

Group

uses

to Data from Local System

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Execution Guardrails

Technique

uses

to Forced Authentication

Technique

uses

to Hidden Files and Directories

Technique

uses

to HTML Smuggling

Technique

uses

to JavaScript

Technique

uses

to Malicious File

Technique

uses

to Masquerading

Technique

uses

to Rundll32

Technique

uses

to Spearphishing Attachment

Technique

uses

to System Information Discovery

Technique

uses

to Windows Command Shell

Technique

2 external

References

mitre-attack

S0634

open

MSTIC Nobelium Toolset May 2021

https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/

open