H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Solar](https://attack.mitre.org/software/S1166) is a C#/.NET backdoor that was used by [OilRig](https://attack.mitre.org/groups/G0049) during the [Outer Space](https://attack.mitre.org/campaigns/C0042) campaign to download, execute, and exfiltrate files.(Citation: ESET OilRig Campaigns Sep 2023)

Labels

malware

10 recorded

Relationships

uses

Group

uses

from Outer Space

Campaign

uses

to Automated Exfiltration

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Scheduled Task

Technique

uses

to Standard Encoding

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Information Discovery

Technique

2 external

References

mitre-attack

S1166

ESET OilRig Campaigns Sep 2023

https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/