H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Rover](https://attack.mitre.org/software/S0090) is malware suspected of being used for espionage purposes. It was used in 2015 in a targeted email sent to an Indian Ambassador to Afghanistan. (Citation: Palo Alto Rover)

Labels

malware

10 recorded

Relationships

uses

to Automated Collection

Technique

uses

to Automated Exfiltration

Technique

uses

to Data from Local System

Technique

uses

to Data from Removable Media

Technique

uses

to File and Directory Discovery

Technique

uses

to Keylogging

Technique

uses

to Local Data Staging

Technique

uses

to Modify Registry

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Screen Capture

Technique

2 external

References

mitre-attack

S0090

open

Palo Alto Rover

http://researchcenter.paloaltonetworks.com/2016/02/new-malware-rover-targets-indian-ambassador-to-afghanistan/

open