H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[JHUHUGIT](https://attack.mitre.org/software/S0044) is malware used by [APT28](https://attack.mitre.org/groups/G0007). It is based on Carberp source code and serves as reconnaissance malware. (Citation: Kaspersky Sofacy) (Citation: F-Secure Sofacy 2015) (Citation: ESET Sednit Part 1) (Citation: FireEye APT28 January 2017)

Labels

malware

21 recorded

Relationships

uses

from APT28

Group

uses

to Clipboard Data

Technique

uses

to Component Object Model Hijacking

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exploitation for Privilege Escalation

Technique

uses

to Fallback Channels

Technique

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Local Storage Discovery

Technique

uses

to Logon Script (Windows)

Technique

uses

to Process Discovery

Technique

uses

to Process Injection

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

Technique

uses

to Scheduled Task

Technique

uses

to Screen Capture

Technique

uses

to Standard Encoding

Technique

uses

to System Network Configuration Discovery

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Service

Technique

15 external

References

mitre-attack

S0044

JHUHUGIT

—

JKEYSKW

—

GAMEFISH

—

Seduploader

—

SofacyCarberp

—

ESET Sednit Part 1

http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part1.pdf

F-Secure Sofacy 2015

https://labsblog.f-secure.com/2015/09/08/sofacy-recycles-carberp-and-metasploit-code/

FireEye APT28 January 2017

https://www.mandiant.com/sites/default/files/2021-09/APT28-Center-of-Storm-2017.pdf

Kaspersky Sofacy

https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/

Unit 42 Sofacy Feb 2018

https://researchcenter.paloaltonetworks.com/2018/02/unit42-sofacy-attacks-multiple-government-entities/

Talos Seduploader Oct 2017

https://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html

Symantec APT28 Oct 2018

https://www.symantec.com/blogs/election-security/apt28-espionage-military-government

Sednit

—

Trojan.Sofacy

—