Threat intelligence / Malware

ShimRat

[ShimRat](https://attack.mitre.org/software/S0444) has been used by the suspected China-based adversary [Mofang](https://attack.mitre.org/groups/G0103) in campaigns targeting multiple countries and sectors including government, military, critical infrastructure, automobile, and weapons development. The name "[ShimRat](https://attack.mitre.org/software/S0444)" comes from the malware's extensive use of Windows Application Shimming to maintain persistence. (Citation: FOX-IT May 2016 Mofang)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[ShimRat](https://attack.mitre.org/software/S0444) has been used by the suspected China-based adversary [Mofang](https://attack.mitre.org/groups/G0103) in campaigns targeting multiple countries and sectors including government, military, critical infrastructure, automobile, and weapons development. The name "[ShimRat](https://attack.mitre.org/software/S0444)" comes from the malware's extensive use of Windows Application Shimming to maintain persistence. (Citation: FOX-IT May 2016 Mofang)

Labels

malware

22 recorded

Relationships

uses

Group

uses

to Application Shimming

Technique

uses

to Bypass User Account Control

Technique

uses

Technique

uses

to Data from Local System

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to External Proxy

Technique

uses

to Fallback Channels

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Hijack Execution Flow

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Masquerade Task or Service

Technique

uses

to Modify Registry

Technique

uses

Technique

uses

to Network Share Discovery

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Scheduled Transfer

Technique

uses

to Software Packing

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Service

Technique

2 external

References

mitre-attack

S0444

FOX-IT May 2016 Mofang

https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf