H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[SHOTPUT](https://attack.mitre.org/software/S0063) is a custom backdoor used by [APT3](https://attack.mitre.org/groups/G0022). (Citation: FireEye Clandestine Wolf)

Labels

malware

7 recorded

Relationships

uses

from APT3

Group

uses

to File and Directory Discovery

Technique

uses

to Local Account

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Process Discovery

Technique

uses

to Remote System Discovery

Technique

uses

to System Network Connections Discovery

Technique

5 external

References

mitre-attack

S0063

open

Backdoor.APT.CookieCutter

—

Pirpi

—

FireEye Clandestine Wolf

https://www.fireeye.com/blog/threat-research/2015/06/operation-clandestine-wolf-adobe-flash-zero-day.html

open

FireEye Clandestine Fox Part 2

https://www.fireeye.com/blog/threat-research/2014/06/clandestine-fox-part-deux.html

open