H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

WellMess

[WellMess](https://attack.mitre.org/software/S0514) is lightweight malware family with variants written in .NET and Golang that has been in use since at least 2018 by [APT29](https://attack.mitre.org/groups/G0016).(Citation: CISA WellMess July 2020)(Citation: PWC WellMess July 2020)(Citation: NCSC APT29 July 2020)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[WellMess](https://attack.mitre.org/software/S0514) is lightweight malware family with variants written in .NET and Golang that has been in use since at least 2018 by [APT29](https://attack.mitre.org/groups/G0016).(Citation: CISA WellMess July 2020)(Citation: PWC WellMess July 2020)(Citation: NCSC APT29 July 2020)

Labels

malware
16 recorded

Relationships

uses
from APT29
Group
uses
to Asymmetric Cryptography
Technique
uses
to Data from Local System
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to DNS
Technique
uses
to Domain Groups
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Junk Data
Technique
uses
to PowerShell
Technique
uses
to Standard Encoding
Technique
uses
to Symmetric Cryptography
Technique
uses
to System Information Discovery
Technique
uses
to System Network Configuration Discovery
Technique
uses
to System Owner/User Discovery
Technique
uses
to Web Protocols
Technique
uses
to Windows Command Shell
Technique
4 external

References

mitre-attack
S0514
open
CISA WellMess July 2020
https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198b
open
PWC WellMess July 2020
https://www.pwc.co.uk/issues/cyber-security-services/insights/cleaning-up-after-wellmess.html
open
NCSC APT29 July 2020
https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development-V1-1.pdf
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance