H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Hi-Zor](https://attack.mitre.org/software/S0087) is a remote access tool (RAT) that has characteristics similar to [Sakula](https://attack.mitre.org/software/S0074). It was used in a campaign named INOCNATION. (Citation: Fidelis Hi-Zor)

Labels

malware

9 recorded

Relationships

uses

to Asymmetric Cryptography

Technique

uses

to Encrypted/Encoded File

Technique

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Regsvr32

Technique

uses

to Symmetric Cryptography

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

2 external

References

mitre-attack

S0087

open

Fidelis Hi-Zor

https://www.fidelissecurity.com/threatgeek/archive/introducing-hi-zor-rat/

open