H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[T9000](https://attack.mitre.org/software/S0098) is a backdoor that is a newer variant of the T5000 malware family, also known as Plat1. Its primary function is to gather information about the victim. It has been used in multiple targeted attacks against U.S.-based organizations. (Citation: FireEye admin@338 March 2014) (Citation: Palo Alto T9000 Feb 2016)

Labels

malware

13 recorded

Relationships

uses

to AppInit DLLs

Technique

uses

to Archive via Custom Method

Technique

uses

to Audio Capture

Technique

uses

to Automated Collection

Technique

uses

to DLL

Technique

uses

to Peripheral Device Discovery

Technique

uses

to Screen Capture

Technique

uses

to Security Software Discovery

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to System Time Discovery

Technique

uses

to Video Capture

Technique

3 external

References

mitre-attack

S0098

open

FireEye admin@338 March 2014

https://www.fireeye.com/blog/threat-research/2014/03/spear-phishing-the-news-cycle-apt-actors-leverage-interest-in-the-disappearance-of-malaysian-flight-mh-370.html

open

Palo Alto T9000 Feb 2016

http://researchcenter.paloaltonetworks.com/2016/02/t9000-advanced-modular-backdoor-uses-complex-anti-analysis-techniques/

open