H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

TINYTYPHON

[TINYTYPHON](https://attack.mitre.org/software/S0131) is a backdoor that has been used by the actors responsible for the MONSOON campaign. The majority of its code was reportedly taken from the MyDoom worm. (Citation: Forcepoint Monsoon)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[TINYTYPHON](https://attack.mitre.org/software/S0131) is a backdoor that has been used by the actors responsible for the MONSOON campaign. The majority of its code was reportedly taken from the MyDoom worm. (Citation: Forcepoint Monsoon)

Labels

malware
5 recorded

Relationships

uses
from Patchwork
Group
uses
to Automated Exfiltration
Technique
uses
to Encrypted/Encoded File
Technique
uses
to File and Directory Discovery
Technique
uses
to Registry Run Keys / Startup Folder
Technique
2 external

References

mitre-attack
S0131
open
Forcepoint Monsoon
https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance