H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Cadelspy](https://attack.mitre.org/software/S0454) is a backdoor that has been used by [APT39](https://attack.mitre.org/groups/G0087).(Citation: Symantec Chafer Dec 2015)

Labels

malware

9 recorded

Relationships

uses

from APT39

Group

uses

to Application Window Discovery

Technique

uses

to Archive Collected Data

Technique

uses

to Audio Capture

Technique

uses

to Clipboard Data

Technique

uses

to Keylogging

Technique

uses

to Peripheral Device Discovery

Technique

uses

to Screen Capture

Technique

uses

to System Information Discovery

Technique

2 external

References

mitre-attack

S0454

open

Symantec Chafer Dec 2015

https://www.symantec.com/connect/blogs/iran-based-attackers-use-back-door-threats-spy-middle-eastern-targets

open