H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Wingbird](https://attack.mitre.org/software/S0176) is a backdoor that appears to be a version of commercial software [FinFisher](https://attack.mitre.org/software/S0182). It is reportedly used to attack individual computers instead of networks. It was used by [NEODYMIUM](https://attack.mitre.org/groups/G0055) in a May 2016 campaign. (Citation: Microsoft SIR Vol 21) (Citation: Microsoft NEODYMIUM Dec 2016)

Labels

malware

10 recorded

Relationships

uses

Group

uses

to DLL

Technique

uses

to Exploitation for Privilege Escalation

Technique

uses

to File Deletion

Technique

uses

to LSASS Driver

Technique

uses

to Process Injection

Technique

uses

to Security Software Discovery

Technique

uses

to Service Execution

Technique

uses

to System Information Discovery

Technique

uses

to Windows Service

Technique

5 external

References

mitre-attack

S0176

Wingbird

—

Microsoft SIR Vol 21

http://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf

Microsoft NEODYMIUM Dec 2016

https://blogs.technet.microsoft.com/mmpc/2016/12/14/twin-zero-day-attacks-promethium-and-neodymium-target-individuals-in-europe/

Microsoft Wingbird Nov 2017

https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Wingbird.A!dha