H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[PipeMon](https://attack.mitre.org/software/S0501) is a multi-stage modular backdoor used by [Winnti Group](https://attack.mitre.org/groups/G0044).(Citation: ESET PipeMon May 2020)

Labels

malware

24 recorded

Relationships

uses

to Bypass User Account Control

Technique

uses

to Code Signing

Technique

uses

to Create Process with Token

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Dynamic-link Library Injection

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Fallback Channels

Technique

uses

to Fileless Storage

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Modify Registry

Technique

uses

to Native API

Technique

uses

to Non-Application Layer Protocol

Technique

uses

to Parent PID Spoofing

Technique

uses

to Print Processors

Technique

uses

to Process Discovery

Technique

uses

to Security Software Discovery

Technique

uses

to Shared Modules

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Time Discovery

Technique

uses

to Windows Service

Technique

uses

from Winnti Group

Group

2 external

References

mitre-attack

S0501

open

ESET PipeMon May 2020

https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/

open