H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

Chrommme

[Chrommme](https://attack.mitre.org/software/S0667) is a backdoor tool written using the Microsoft Foundation Class (MFC) framework that was first reported in June 2021; security researchers noted infrastructure overlaps with [Gelsemium](https://attack.mitre.org/software/S0666) malware.(Citation: ESET Gelsemium June 2021)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Chrommme](https://attack.mitre.org/software/S0667) is a backdoor tool written using the Microsoft Foundation Class (MFC) framework that was first reported in June 2021; security researchers noted infrastructure overlaps with [Gelsemium](https://attack.mitre.org/software/S0666) malware.(Citation: ESET Gelsemium June 2021)

Labels

malware
14 recorded

Relationships

uses
to Archive Collected Data
Technique
uses
to Data from Local System
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Encrypted/Encoded File
Technique
uses
to Exfiltration Over C2 Channel
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Local Data Staging
Technique
uses
to Local Storage Discovery
Technique
uses
to Native API
Technique
uses
to Scheduled Transfer
Technique
uses
to Screen Capture
Technique
uses
to System Information Discovery
Technique
uses
to System Network Configuration Discovery
Technique
uses
to System Owner/User Discovery
Technique
2 external

References

mitre-attack
S0667
open
ESET Gelsemium June 2021
https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance