H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

Hikit

[Hikit](https://attack.mitre.org/software/S0009) is malware that has been used by [Axiom](https://attack.mitre.org/groups/G0001) for late-stage persistence and exfiltration after the initial compromise.(Citation: Novetta-Axiom)(Citation: FireEye Hikit Rootkit)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Hikit](https://attack.mitre.org/software/S0009) is malware that has been used by [Axiom](https://attack.mitre.org/groups/G0001) for late-stage persistence and exfiltration after the initial compromise.(Citation: Novetta-Axiom)(Citation: FireEye Hikit Rootkit)

Labels

malware
12 recorded

Relationships

uses
from Axiom
Group
uses
to Code Signing Policy Modification
Technique
uses
to Data from Local System
Technique
uses
to DLL
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Install Root Certificate
Technique
uses
to Internal Proxy
Technique
uses
to Phishing
Technique
uses
to Rootkit
Technique
uses
to Symmetric Cryptography
Technique
uses
to Web Protocols
Technique
uses
to Windows Command Shell
Technique
3 external

References

mitre-attack
S0009
open
FireEye Hikit Rootkit
https://web.archive.org/web/20190216180458/https://www.fireeye.com/blog/threat-research/2012/08/hikit-rootkit-advanced-persistent-attack-techniques-part-1.html
open
Novetta-Axiom
https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance