H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Valak](https://attack.mitre.org/software/S0476) is a multi-stage modular malware that can function as a standalone information stealer or downloader, first observed in 2019 targeting enterprises in the US and Germany.(Citation: Cybereason Valak May 2020)(Citation: Unit 42 Valak July 2020)

Labels

malware

35 recorded

Relationships

uses

from TA551

Group

uses

to Automated Collection

Technique

uses

to Credentials in Registry

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Domain Account

Technique

uses

to Dynamic Data Exchange

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Fallback Channels

Technique

uses

to Fileless Storage

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

to Local Account

Technique

uses

to Malicious File

Technique

uses

to Modify Registry

Technique

uses

to Multi-Stage Channels

Technique

uses

to NTFS File Attributes

Technique

uses

to Obfuscated Files or Information

Technique

uses

Technique

uses

to Process Discovery

Technique

uses

to Query Registry

Technique

uses

Technique

uses

to Remote Email Collection

Technique

uses

to Scheduled Task

Technique

uses

to Screen Capture

Technique

uses

to Security Software Discovery

Technique

uses

to Software Packing

Technique

uses

to Spearphishing Attachment

Technique

uses

to Spearphishing Link

Technique

uses

to Standard Encoding

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to Web Protocols

Technique

uses

to Windows Credential Manager

Technique

uses

to Windows Management Instrumentation

Technique

3 external

References

mitre-attack

S0476

Unit 42 Valak July 2020

https://unit42.paloaltonetworks.com/valak-evolution/

Cybereason Valak May 2020

https://www.cybereason.com/blog/valak-more-than-meets-the-eye