H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[HyperBro](https://attack.mitre.org/software/S0398) is a custom in-memory backdoor used by [Threat Group-3390](https://attack.mitre.org/groups/G0027).(Citation: Unit42 Emissary Panda May 2019)(Citation: Securelist LuckyMouse June 2018)(Citation: Hacker News LuckyMouse June 2018)

Labels

malware

13 recorded

Relationships

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to DLL

Technique

uses

to Encrypted/Encoded File

Technique

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

to Process Injection

Technique

uses

to Screen Capture

Technique

uses

to Service Execution

Technique

uses

to Software Packing

Technique

uses

to System Service Discovery

Technique

uses

to Web Protocols

Technique

uses

from Threat Group-3390

Group

5 external

References

mitre-attack

S0398

HyperBro

—

Unit42 Emissary Panda May 2019

https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/

Hacker News LuckyMouse June 2018

https://thehackernews.com/2018/06/chinese-watering-hole-attack.html

Securelist LuckyMouse June 2018

https://securelist.com/luckymouse-hits-national-data-center/86083/