H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

ELMER

[ELMER](https://attack.mitre.org/software/S0064) is a non-persistent, proxy-aware HTTP backdoor written in Delphi that has been used by [APT16](https://attack.mitre.org/groups/G0023). (Citation: FireEye EPS Awakens Part 2)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[ELMER](https://attack.mitre.org/software/S0064) is a non-persistent, proxy-aware HTTP backdoor written in Delphi that has been used by [APT16](https://attack.mitre.org/groups/G0023). (Citation: FireEye EPS Awakens Part 2)

Labels

malware
4 recorded

Relationships

uses
from APT16
Group
uses
to File and Directory Discovery
Technique
uses
to Process Discovery
Technique
uses
to Web Protocols
Technique
2 external

References

mitre-attack
S0064
open
FireEye EPS Awakens Part 2
https://web.archive.org/web/20151226205946/https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance