Threat intelligence / Malware

Sibot

[Sibot](https://attack.mitre.org/software/S0589) is dual-purpose malware written in VBScript designed to achieve persistence on a compromised system as well as download and execute additional payloads. Microsoft discovered three [Sibot](https://attack.mitre.org/software/S0589) variants in early 2021 during its investigation of [APT29](https://attack.mitre.org/groups/G0016) and the [SolarWinds Compromise](https://attack.mitre.org/campaigns/C0024).(Citation: MSTIC NOBELIUM Mar 2021)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Sibot](https://attack.mitre.org/software/S0589) is dual-purpose malware written in VBScript designed to achieve persistence on a compromised system as well as download and execute additional payloads. Microsoft discovered three [Sibot](https://attack.mitre.org/software/S0589) variants in early 2021 during its investigation of [APT29](https://attack.mitre.org/groups/G0016) and the [SolarWinds Compromise](https://attack.mitre.org/campaigns/C0024).(Citation: MSTIC NOBELIUM Mar 2021)

Labels

malware

20 recorded

Relationships

uses

from APT29

Group

uses

to Command Obfuscation

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to File Deletion

Technique

uses

to Fileless Storage

Technique

uses

to Indicator Removal

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Modify Registry

Technique

uses

Technique

uses

to Query Registry

Technique

uses

Technique

uses

to Scheduled Task

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Network Connections Discovery

Technique

uses

to Visual Basic

Technique

uses

to Web Protocols

Technique

uses

Technique

uses

to Windows Management Instrumentation

Technique

uses

from SolarWinds Compromise

Campaign

2 external

References

mitre-attack

S0589

MSTIC NOBELIUM Mar 2021

https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/