H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[SombRAT](https://attack.mitre.org/software/S0615) is a modular backdoor written in C++ that has been used since at least 2019 to download and execute malicious payloads, including [FIVEHANDS](https://attack.mitre.org/software/S0618) ransomware.(Citation: BlackBerry CostaRicto November 2020)(Citation: FireEye FiveHands April 2021)(Citation: CISA AR21-126A FIVEHANDS May 2021)

Labels

malware

25 recorded

Relationships

uses

from CostaRicto

Campaign

uses

to Archive via Custom Method

Technique

uses

to Asymmetric Cryptography

Technique

uses

to Data from Local System

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to DNS

Technique

uses

to Domain Generation Algorithms

Technique

uses

to Dynamic-link Library Injection

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Local Data Staging

Technique

uses

to Masquerading

Technique

uses

Technique

uses

to Non-Application Layer Protocol

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Process Argument Spoofing

Technique

uses

to Process Discovery

Technique

uses

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Information Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to System Service Discovery

Technique

uses

to System Time Discovery

Technique

4 external

References

mitre-attack

S0615

CISA AR21-126A FIVEHANDS May 2021

https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a

FireEye FiveHands April 2021

https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html

BlackBerry CostaRicto November 2020

https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced