Threat intelligence / Malware

Rising Sun

[Rising Sun](https://attack.mitre.org/software/S0448) is a modular backdoor that was used extensively in [Operation Sharpshooter](https://attack.mitre.org/campaigns/C0013) between 2017 and 2019. [Rising Sun](https://attack.mitre.org/software/S0448) infected at least 87 organizations around the world, including nuclear, defense, energy, and financial service companies. Security researchers assessed [Rising Sun](https://attack.mitre.org/software/S0448) included some source code from [Lazarus Group](https://attack.mitre.org/groups/G0032)'s Trojan Duuzer.(Citation: McAfee Sharpshooter December 2018)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Rising Sun](https://attack.mitre.org/software/S0448) is a modular backdoor that was used extensively in [Operation Sharpshooter](https://attack.mitre.org/campaigns/C0013) between 2017 and 2019. [Rising Sun](https://attack.mitre.org/software/S0448) infected at least 87 organizations around the world, including nuclear, defense, energy, and financial service companies. Security researchers assessed [Rising Sun](https://attack.mitre.org/software/S0448) included some source code from [Lazarus Group](https://attack.mitre.org/groups/G0032)'s Trojan Duuzer.(Citation: McAfee Sharpshooter December 2018)

Labels

malware

21 recorded

Relationships

uses

from Operation Sharpshooter

Campaign

uses

to Archive via Custom Method

Technique

uses

to Asymmetric Cryptography

Technique

uses

to Data from Local System

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Hidden Files and Directories

Technique

uses

to Indicator Removal

Technique

uses

to Internet Connection Discovery

Technique

uses

to Local Storage Discovery

Technique

uses

Technique

uses

to Process Discovery

Technique

uses

to Query Registry

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

2 external

References

mitre-attack

S0448

McAfee Sharpshooter December 2018

https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf