H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Neoichor](https://attack.mitre.org/software/S0691) is C2 malware used by [Ke3chang](https://attack.mitre.org/groups/G0004) since at least 2019; similar malware families used by the group include Leeson and Numbldea.(Citation: Microsoft NICKEL December 2021)

Labels

malware

12 recorded

Relationships

uses

Group

uses

to Component Object Model

Technique

uses

to Data from Local System

Technique

uses

to Indicator Removal

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Internet Connection Discovery

Technique

uses

to Modify Registry

Technique

uses

to System Information Discovery

Technique

uses

to System Language Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to Web Protocols

Technique

2 external

References

mitre-attack

S0691

Microsoft NICKEL December 2021

https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe