H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[LitePower](https://attack.mitre.org/software/S0680) is a downloader and second stage malware that has been used by [WIRTE](https://attack.mitre.org/groups/G0090) since at least 2021.(Citation: Kaspersky WIRTE November 2021)

Labels

malware

13 recorded

Relationships

uses

to Exfiltration Over C2 Channel

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Local Storage Discovery

Technique

uses

to Native API

Technique

uses

to PowerShell

Technique

uses

to Query Registry

Technique

uses

to Scheduled Task

Technique

uses

to Screen Capture

Technique

uses

to Security Software Discovery

Technique

uses

to System Information Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to Web Protocols

Technique

uses

from WIRTE

Group

2 external

References

mitre-attack

S0680

open

Kaspersky WIRTE November 2021

https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044

open