H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

POSHSPY

[POSHSPY](https://attack.mitre.org/software/S0150) is a backdoor that has been used by [APT29](https://attack.mitre.org/groups/G0016) since at least 2015. It appears to be used as a secondary backdoor used if the actors lost access to their primary backdoors. (Citation: FireEye POSHSPY April 2017)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[POSHSPY](https://attack.mitre.org/software/S0150) is a backdoor that has been used by [APT29](https://attack.mitre.org/groups/G0016) since at least 2015. It appears to be used as a secondary backdoor used if the actors lost access to their primary backdoors. (Citation: FireEye POSHSPY April 2017)

Labels

malware
9 recorded

Relationships

uses
from APT29
Group
uses
to Asymmetric Cryptography
Technique
uses
to Data Transfer Size Limits
Technique
uses
to Domain Generation Algorithms
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Obfuscated Files or Information
Technique
uses
to PowerShell
Technique
uses
to Timestomp
Technique
uses
to Windows Management Instrumentation Event Subscription
Technique
3 external

References

mitre-attack
S0150
open
POSHSPY
—
FireEye POSHSPY April 2017
https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance