H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[BADHATCH](https://attack.mitre.org/software/S1081) is a backdoor that has been utilized by [FIN8](https://attack.mitre.org/groups/G0061) since at least 2019. [BADHATCH](https://attack.mitre.org/software/S1081) has been used to target the insurance, retail, technology, and chemical industries in the United States, Canada, South Africa, Panama, and Italy.(Citation: Gigamon BADHATCH Jul 2019)(Citation: BitDefender BADHATCH Mar 2021)

Labels

malware

36 recorded

Relationships

uses

to Asymmetric Cryptography

Technique

uses

to Asynchronous Procedure Call

Technique

uses

to Bypass User Account Control

Technique

uses

to Command Obfuscation

Technique

uses

Technique

uses

to Domain Groups

Technique

uses

to Domain Trust Discovery

Technique

uses

to Dynamic-link Library Injection

Technique

uses

to Embedded Payloads

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to File Deletion

Technique

uses

to File Transfer Protocols

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

to Network Service Discovery

Technique

uses

to Network Share Discovery

Technique

uses

to Pass the Hash

Technique

uses

Technique

uses

to Process Discovery

Technique

uses

to Process Injection

Technique

uses

Technique

uses

to Reflective Code Loading

Technique

uses

to Remote System Discovery

Technique

uses

to Scheduled Task

Technique

uses

to Screen Capture

Technique

uses

to System Information Discovery

Technique

uses

to System Network Connections Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to System Time Discovery

Technique

uses

to Token Impersonation/Theft

Technique

uses

to Web Protocols

Technique

uses

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Management Instrumentation

Technique

uses

to Windows Management Instrumentation Event Subscription

Technique

uses

from FIN8

Group

3 external

References

mitre-attack

S1081

Gigamon BADHATCH Jul 2019

https://blog.gigamon.com/2019/07/23/abadbabe-8badf00d-discovering-badhatch-and-a-detailed-look-at-fin8s-tooling/

BitDefender BADHATCH Mar 2021

https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf