H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

Kerrdown

[Kerrdown](https://attack.mitre.org/software/S0585) is a custom downloader that has been used by [APT32](https://attack.mitre.org/groups/G0050) since at least 2018 to install spyware from a server on the victim's network.(Citation: Amnesty Intl. Ocean Lotus February 2021)(Citation: Unit 42 KerrDown February 2019)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Kerrdown](https://attack.mitre.org/software/S0585) is a custom downloader that has been used by [APT32](https://attack.mitre.org/groups/G0050) since at least 2018 to install spyware from a server on the victim's network.(Citation: Amnesty Intl. Ocean Lotus February 2021)(Citation: Unit 42 KerrDown February 2019)

Labels

malware
12 recorded

Relationships

uses
from APT32
Group
uses
to Compression
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to DLL
Technique
uses
to Encrypted/Encoded File
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Malicious File
Technique
uses
to Malicious Link
Technique
uses
to Spearphishing Attachment
Technique
uses
to Spearphishing Link
Technique
uses
to System Information Discovery
Technique
uses
to Visual Basic
Technique
3 external

References

mitre-attack
S0585
open
Amnesty Intl. Ocean Lotus February 2021
https://www.amnestyusa.org/wp-content/uploads/2021/02/Click-and-Bait_Vietnamese-Human-Rights-Defenders-Targeted-with-Spyware-Attacks.pdf
open
Unit 42 KerrDown February 2019
https://unit42.paloaltonetworks.com/tracking-oceanlotus-new-downloader-kerrdown/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance