H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Fysbis](https://attack.mitre.org/software/S0410) is a Linux-based backdoor used by [APT28](https://attack.mitre.org/groups/G0007) that dates back to at least 2014.(Citation: Fysbis Palo Alto Analysis)

Labels

malware

13 recorded

Relationships

uses

from APT28

Group

uses

to Encrypted/Encoded File

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Keylogging

Technique

uses

to Masquerade Task or Service

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Process Discovery

Technique

uses

to Standard Encoding

Technique

uses

to Systemd Service

Technique

uses

to System Information Discovery

Technique

uses

to Unix Shell

Technique

uses

to XDG Autostart Entries

Technique

2 external

References

mitre-attack

S0410

open

Fysbis Palo Alto Analysis

https://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/

open