H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Daserf](https://attack.mitre.org/software/S0187) is a backdoor that has been used to spy on and steal from Japanese, South Korean, Russian, Singaporean, and Chinese victims. Researchers have identified versions written in both Visual C and Delphi. (Citation: Trend Micro Daserf Nov 2017) (Citation: Secureworks BRONZE BUTLER Oct 2017)

Labels

malware

17 recorded

Relationships

uses

from BRONZE BUTLER

Group

uses

to Archive Collected Data

Technique

uses

to Archive via Utility

Technique

uses

to Code Signing

Technique

uses

to Indicator Removal from Tools

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

to LSASS Memory

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Screen Capture

Technique

uses

to Software Packing

Technique

uses

to Standard Encoding

Technique

uses

to Steganography

Technique

uses

to Symmetric Cryptography

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

6 external

References

mitre-attack

S0187

Daserf

—

Muirim

—

Nioupale

—

Trend Micro Daserf Nov 2017

http://blog.trendmicro.com/trendlabs-security-intelligence/redbaldknight-bronze-butler-daserf-backdoor-now-using-steganography/

Secureworks BRONZE BUTLER Oct 2017

https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses