H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

BADFLICK

[BADFLICK](https://attack.mitre.org/software/S0642) is a backdoor used by [Leviathan](https://attack.mitre.org/groups/G0065) in spearphishing campaigns first reported in 2018 that targeted the U.S. engineering and maritime industries.(Citation: FireEye Periscope March 2018)(Citation: Accenture MUDCARP March 2019)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[BADFLICK](https://attack.mitre.org/software/S0642) is a backdoor used by [Leviathan](https://attack.mitre.org/groups/G0065) in spearphishing campaigns first reported in 2018 that targeted the U.S. engineering and maritime industries.(Citation: FireEye Periscope March 2018)(Citation: Accenture MUDCARP March 2019)

Labels

malware
11 recorded

Relationships

uses
to Archive via Library
Technique
uses
to Data from Local System
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to File and Directory Discovery
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Malicious File
Technique
uses
to Spearphishing Attachment
Technique
uses
to System Information Discovery
Technique
uses
to System Network Configuration Discovery
Technique
uses
to Time Based Checks
Technique
uses
from Leviathan
Group
3 external

References

mitre-attack
S0642
open
FireEye Periscope March 2018
https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html
open
Accenture MUDCARP March 2019
https://www.accenture.com/us-en/blogs/cyber-defense/mudcarps-focus-on-submarine-technologies
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance