H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[SHARPSTATS](https://attack.mitre.org/software/S0450) is a .NET backdoor used by [MuddyWater](https://attack.mitre.org/groups/G0069) since at least 2019.(Citation: TrendMicro POWERSTATS V3 June 2019)

Labels

malware

8 recorded

Relationships

uses

from MuddyWater

Group

uses

to Command Obfuscation

Technique

uses

to Ingress Tool Transfer

Technique

uses

to PowerShell

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to System Time Discovery

Technique

2 external

References

mitre-attack

S0450

open

TrendMicro POWERSTATS V3 June 2019

https://blog.trendmicro.com/trendlabs-security-intelligence/muddywater-resurfaces-uses-multi-stage-backdoor-powerstats-v3-and-new-post-exploitation-tools/

open