H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Crutch](https://attack.mitre.org/software/S0538) is a backdoor designed for document theft that has been used by [Turla](https://attack.mitre.org/groups/G0010) since at least 2015.(Citation: ESET Crutch December 2020)

Labels

malware

16 recorded

Relationships

uses

to Archive via Utility

Technique

uses

to Automated Collection

Technique

uses

to Automated Exfiltration

Technique

uses

to Bidirectional Communication

Technique

uses

to Data from Local System

Technique

uses

to Data from Removable Media

Technique

uses

to DLL

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Exfiltration to Cloud Storage

Technique

uses

to Fallback Channels

Technique

uses

to Local Data Staging

Technique

uses

to Masquerade Task or Service

Technique

uses

to Peripheral Device Discovery

Technique

uses

to Scheduled Task

Technique

uses

to Web Protocols

Technique

uses

from Turla

Group

2 external

References

mitre-attack

S0538

open

ESET Crutch December 2020

https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/

open