H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

XTunnel

[XTunnel](https://attack.mitre.org/software/S0117) a VPN-like network proxy tool that can relay traffic between a C2 server and a victim. It was first seen in May 2013 and reportedly used by [APT28](https://attack.mitre.org/groups/G0007) during the compromise of the Democratic National Committee. (Citation: Crowdstrike DNC June 2016) (Citation: Invincea XTunnel) (Citation: ESET Sednit Part 2)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[XTunnel](https://attack.mitre.org/software/S0117) a VPN-like network proxy tool that can relay traffic between a C2 server and a victim. It was first seen in May 2013 and reportedly used by [APT28](https://attack.mitre.org/groups/G0007) during the compromise of the Democratic National Committee. (Citation: Crowdstrike DNC June 2016) (Citation: Invincea XTunnel) (Citation: ESET Sednit Part 2)

Labels

malware
9 recorded

Relationships

uses
from APT28
Group
uses
to Asymmetric Cryptography
Technique
uses
to Credentials In Files
Technique
uses
to Fallback Channels
Technique
uses
to Junk Code Insertion
Technique
uses
to Network Service Discovery
Technique
uses
to Obfuscated Files or Information
Technique
uses
to Proxy
Technique
uses
to Windows Command Shell
Technique
9 external

References

mitre-attack
S0117
open
XTunnel
—
Trojan.Shunnael
—
X-Tunnel
—
XAPS
—
Crowdstrike DNC June 2016
https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
open
Invincea XTunnel
https://www.invincea.com/2016/07/tunnel-of-gov-dnc-hack-and-the-russian-xtunnel/
open
ESET Sednit Part 2
http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf
open
Symantec APT28 Oct 2018
https://www.symantec.com/blogs/election-security/apt28-espionage-military-government
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance