H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Attor](https://attack.mitre.org/software/S0438) is a Windows-based espionage platform that has been seen in use since 2013. [Attor](https://attack.mitre.org/software/S0438) has a loadable plugin architecture to customize functionality for specific targets.(Citation: ESET Attor Oct 2019)

Labels

malware

35 recorded

Relationships

uses

to Application Window Discovery

Technique

uses

to Archive via Custom Method

Technique

uses

to Asymmetric Cryptography

Technique

uses

to Asynchronous Procedure Call

Technique

uses

to Audio Capture

Technique

uses

to Automated Collection

Technique

uses

to Automated Exfiltration

Technique

uses

to Clipboard Data

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to File Transfer Protocols

Technique

uses

to Hidden Files and Directories

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

to Local Data Staging

Technique

uses

to Local Storage Discovery

Technique

uses

to Logon Script (Windows)

Technique

uses

to Masquerade Task or Service

Technique

uses

to Modify Registry

Technique

uses

to Multi-hop Proxy

Technique

uses

Technique

uses

to Peripheral Device Discovery

Technique

uses

to Process Injection

Technique

uses

to Query Registry

Technique

uses

Technique

uses

to Scheduled Task

Technique

uses

to Screen Capture

Technique

uses

to Service Execution

Technique

uses

to Shared Modules

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Checks

Technique

uses

Technique

uses

to Windows Service

Technique

3 external

References

mitre-attack

S0438

Attor

—

ESET Attor Oct 2019

https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf