H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[QUIETCANARY](https://attack.mitre.org/software/S1076) is a backdoor tool written in .NET that has been used since at least 2022 to gather and exfiltrate data from victim networks.(Citation: Mandiant Suspected Turla Campaign February 2023)

Labels

malware

10 recorded

Relationships

uses

from C0026

Campaign

uses

to Data Staged

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Hidden Window

Technique

uses

to Native API

Technique

uses

to Query Registry

Technique

uses

to Standard Encoding

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Network Configuration Discovery

Technique

uses

to Web Protocols

Technique

3 external

References

mitre-attack

S1076

open

Tunnus

—

Mandiant Suspected Turla Campaign February 2023

https://www.mandiant.com/resources/blog/turla-galaxy-opportunity

open