H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

SUGARUSH

[SUGARUSH](https://attack.mitre.org/software/S1049) is a small custom backdoor that can establish a reverse shell over TCP to a hard coded C2 address. [SUGARUSH](https://attack.mitre.org/software/S1049) was first identified during analysis of UNC3890's [C0010](https://attack.mitre.org/campaigns/C0010) campaign targeting Israeli companies, which began in late 2020.(Citation: Mandiant UNC3890 Aug 2022)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[SUGARUSH](https://attack.mitre.org/software/S1049) is a small custom backdoor that can establish a reverse shell over TCP to a hard coded C2 address. [SUGARUSH](https://attack.mitre.org/software/S1049) was first identified during analysis of UNC3890's [C0010](https://attack.mitre.org/campaigns/C0010) campaign targeting Israeli companies, which began in late 2020.(Citation: Mandiant UNC3890 Aug 2022)

Labels

malware
7 recorded

Relationships

uses
from C0010
Campaign
uses
to Internet Connection Discovery
Technique
uses
to Local Storage Discovery
Technique
uses
to Non-Application Layer Protocol
Technique
uses
to Non-Standard Port
Technique
uses
to Windows Command Shell
Technique
uses
to Windows Service
Technique
2 external

References

mitre-attack
S1049
open
Mandiant UNC3890 Aug 2022
https://www.mandiant.com/resources/blog/suspected-iranian-actor-targeting-israeli-shipping
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance