H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Explosive](https://attack.mitre.org/software/S0569) is a custom-made remote access tool used by the group [Volatile Cedar](https://attack.mitre.org/groups/G0123). It was first identified in the wild in 2015.(Citation: CheckPoint Volatile Cedar March 2015)(Citation: ClearSky Lebanese Cedar Jan 2021)

Labels

malware

13 recorded

Relationships

uses

to Clipboard Data

Technique

uses

to Data from Removable Media

Technique

uses

to Hidden Files and Directories

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

to Modify Registry

Technique

uses

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to Web Protocols

Technique

uses

from Volatile Cedar

Group

4 external

References

mitre-attack

S0569

Explosive

—

CheckPoint Volatile Cedar March 2015

https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/03/20082004/volatile-cedar-technical-report.pdf

ClearSky Lebanese Cedar Jan 2021

https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf