H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

AuTo Stealer

[AuTo Stealer](https://attack.mitre.org/software/S1029) is malware written in C++ has been used by [SideCopy](https://attack.mitre.org/groups/G1008) since at least December 2021 to target government agencies and personnel in India and Afghanistan.(Citation: MalwareBytes SideCopy Dec 2021)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[AuTo Stealer](https://attack.mitre.org/software/S1029) is malware written in C++ has been used by [SideCopy](https://attack.mitre.org/groups/G1008) since at least December 2021 to target government agencies and personnel in India and Afghanistan.(Citation: MalwareBytes SideCopy Dec 2021)

Labels

malware
11 recorded

Relationships

uses
to Data from Local System
Technique
uses
to Exfiltration Over C2 Channel
Technique
uses
to Local Data Staging
Technique
uses
to Non-Application Layer Protocol
Technique
uses
to Registry Run Keys / Startup Folder
Technique
uses
to Security Software Discovery
Technique
uses
to System Information Discovery
Technique
uses
to System Owner/User Discovery
Technique
uses
to Web Protocols
Technique
uses
to Windows Command Shell
Technique
uses
from SideCopy
Group
2 external

References

mitre-attack
S1029
open
MalwareBytes SideCopy Dec 2021
https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance